{ "Event": { "published": true, "date": "2023-12-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-12-27", "timestamp": 1703721781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c8169a5f-b4ab-486e-b1e8-b5f348de64be", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9efd037-a47b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656207, "uuid": "2b2c91c3-fcca-47bf-9a20-3945fad3cd9c", "comment": "Malware payload (Mirai)", "value": "5f097b05f20381a52c3e070df5733e19", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656207, "uuid": "cf398b8f-5683-412a-8127-d718b31cf925", "comment": "Malware payload (Mirai)", "value": "01c41f37cb81493aa253b2f360c61b9e612e04621e9a7a17c987205a6826a196", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656207, "uuid": "c403870a-dbf5-402b-ad22-7b333355fc72", "comment": "Malware payload (Mirai)", "value": "ec3bb9cb56176dbcbe439ce18b1092b883a7be0f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656207, "uuid": "7eb73782-604f-44b4-9c17-1174584f6fc2", "comment": "Malware payload (Mirai)", "value": "85f2f55013148b95a723a430c90abaa462ede3b0447292a5393fe2b588ba888b1aae0e4e50a353e8ccbd459eaadf55d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656207, "uuid": "50e9f6bc-8b34-4830-b8cf-8fe89e660748", "value": "T1ECC2D030A6AE1CB2D7500532E6B856C9BF534FBDE9FE3890114086FB3941D4529DA9D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656207, "uuid": "0cb16d43-161c-498b-b2ba-8f71bf29a71f", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEi0o0uszhymdGUop5J:AWsoTAZ3alkXLvFh8nNEi00Ws3UozJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656207, "uuid": "8ca6af81-dc3a-4508-9722-4b758eccb055", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656207, "uuid": "e16da362-268f-43e7-81a5-3f7eb74635c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656207, "uuid": "965a7108-5c93-417f-9845-1e75a02758f6", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f5caf6-a47b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656203, "uuid": "0a48072d-6aed-4bd1-a8bd-8c9e3b4a1d7d", "comment": "Malware payload (Mirai)", "value": "f276bc851e9de474ba85d2a210ff083d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656203, "uuid": "81ea836c-19a3-4917-abf4-d81f446fe434", "comment": "Malware payload (Mirai)", "value": "03bd6343dd4fde40574d129ff506bac81219a51fa739fec90787049e3479d499", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656203, "uuid": "ab26b3bf-d6d2-4096-8738-fae9a98b7e23", "comment": "Malware payload (Mirai)", "value": "9e9c065e2a71b15fe04020360fb388a899b58cac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656203, "uuid": "5d268443-c540-47b4-a40c-42fb545551fe", "comment": "Malware payload (Mirai)", "value": "1236738e560ebaaf9d667a191861106977881ce3694ff40b6283ee4b5f6fad3c2073d6c7fb29ca5780a7263c687861a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656203, "uuid": "d0d9b230-30bd-430f-ac7d-538cc5366222", "value": "T18933F27267AE29D551B09777FC32AC1A62EC16F89D67309A38F0661977C48024FF2782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656203, "uuid": "e56da611-41e5-4a5c-b4d8-5bd0f4740ba9", "value": "1536:M9O/ZMAXIxNUk0UfnLcPqF1aBexo4opKZbz:M9O/ZNKywvLGqFUFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656203, "uuid": "1ccab298-1e61-4eba-bbfa-612dd077a1b2", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656203, "uuid": "5743d752-06d1-4c4b-9b13-0ebc7f543060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656203, "uuid": "05de3872-e243-4cc6-9eef-92e634e3d2d3", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3df34d5-a490-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1703665216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703665216, "uuid": "14ec8907-7262-4c08-8917-09a2fd2e35d3", "comment": "Malware payload (Smoke Loader)", "value": "16ec30858f67b385b44d52c803395145", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703665216, "uuid": "62e2d173-fe85-4a2b-ac48-64fe83e6ac42", "comment": "Malware payload (Smoke Loader)", "value": "05bb2b8ec89c29fabba089b0b8e691681506685ee35edc601821678ad9551106", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703665216, "uuid": "ff00ea10-f002-4359-9f3f-82d5657a8c60", "comment": "Malware payload (Smoke Loader)", "value": "14b08fc785cba2cfc5402b060b6d3808545d7c0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703665216, "uuid": "b17fc240-056f-4b34-91ee-df901385937f", "comment": "Malware payload (Smoke Loader)", "value": "e502f19f57ebdaed59535297f1b5486201576e3e4138ec13f0862e4876607f69c5679a508190fe7f37a4cbfb60ebea60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703665216, "uuid": "f1cc2771-3784-4069-8fd4-c7919cb574c8", "value": "T15504CF2179F095B3E2B7567519F1A6B86A7FB8626BB4C0CB2348071F4F322D14A39317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703665216, "uuid": "80bb8d31-f40e-4e45-87c7-f876c0e35b41", "value": "06f98f4d929a6c5ef0fb810799afdacd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703665216, "uuid": "126078d9-6591-4e36-aa50-19868127349e", "value": "3072:GoPwc9KL57AIHIeI49abXPYr5FJDQeAR/eg7GAktYQUkGLAEEZp4l:NPwc9KL57AkPpq6jD3pAkthUP4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703665216, "uuid": "ca2258ce-29f3-454c-bb99-f966dcf6a156", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703665216, "uuid": "06a28d37-4f4d-463e-b157-1f642fbafc52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703665216, "uuid": "9567f0a1-2590-432d-abfe-664f6dce628f", "value": "16ec30858f67b385b44d52c803395145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f25f09-a48e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703664312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703664312, "uuid": "ef0fee33-2164-45d9-a034-903af35f9dbe", "comment": "Malware payload (LummaStealer)", "value": "ba2681aa148a5ace05fadedf9e2504cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703664312, "uuid": "c7143c9f-12a1-4e12-bf82-9ea23494bc6e", "comment": "Malware payload (LummaStealer)", "value": "07299b78425d60c60b48eb093441721deb590181eb9c711540f364d01ae81e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703664312, "uuid": "e9fd781e-18f5-4a9e-b8ad-986425f187dd", "comment": "Malware payload (LummaStealer)", "value": "0248a0cf0b397ed81f6e7a61c149921eaa66ea70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703664312, "uuid": "6527db84-eb85-406c-a4c5-553b14f341ea", "comment": "Malware payload (LummaStealer)", "value": "f97b01b437647484e7680d732747c7aa3fe1afe80105ad794c23335d7cd30cff549a38c3a345da3451fe094719581e16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703664312, "uuid": "311b1bc3-316c-4e17-8554-9003b8901e84", "value": "T15E574BCC261E4CC387039E6DBDC3516DE5BD917B891E6E72DA5572B2338720ACC9807A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703664312, "uuid": "a8b5ae9d-d670-45e2-ba74-feb7db464adb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703664312, "uuid": "4475b609-e846-4b70-b90e-c1aaac0ac30f", "value": "24576:g/JBy55iM3BpW7DTsBT1m17I1kdQPgXlp8QMd3KA801OisLey2uoMiviVA3G3cmg:g/He/69zI36qx71WOr7ymbXUIj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703664312, "uuid": "5a89c85e-7c7d-4812-a8f0-c42a3c46f594", "value": 27130880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703664312, "uuid": "597d11a8-d0b4-4e3c-9e95-e62e1d52d108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703664312, "uuid": "90bf4287-b4b4-43bb-b493-f3f4dea03cda", "value": "BA2681AA148A5ACE05FADEDF9E2504CF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581341cc-a4a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703674054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674054, "uuid": "b843e7c3-0d26-450a-85ab-459aabab02c2", "comment": "Malware payload", "value": "3297854a485b9533c6304e00f6c143b4", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674054, "uuid": "3ae652a2-efbf-43eb-b311-9f541d0700f5", "comment": "Malware payload", "value": "0afec1aa47f3af928890cac91bcb174a60482b6a740c247e561332af63cd835b", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674054, "uuid": "1d222832-ee9f-4704-a842-bcbf7ebb5e57", "comment": "Malware payload", "value": "8d323db39c5278fceb2a41f2388542da1b443263", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674054, "uuid": "569a5002-fd8a-481d-912b-df12b4280d7d", "comment": "Malware payload", "value": "e7dd7bb8529380bdaff4b102794c20b87f743671174bab423ff9e67541a841835d6d957b0032762ff283fe296e3b9eeb", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674054, "uuid": "52306dec-0b24-48b8-b261-fd7526dc422c", "value": "T19AB361A6B672C895D2150B755CEB87816733FC126FA3430BF794B32E2CB15E0A943293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674054, "uuid": "5e8c89b5-687f-46a7-89a8-d95d906e8bb8", "value": "3072:wyFu70pk3hbdlylKsgqopeJBWhZFGkE+crUZnWx0c7NDeVHAkDL:Nk3hbdlylKsgqopeJBWhZFVE++UZnWx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674054, "uuid": "ab928c21-8e59-4488-ac1a-ff53d5844224", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674054, "uuid": "90a9d1f7-d205-4afe-9260-6dc86fea282d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674054, "uuid": "c8515072-75d7-4b48-bff1-83387db67f5a", "value": "BOB_CBR_TRICHUR_WBS_24_12_2023_NCR.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa460115-a512-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703721007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721007, "uuid": "0b21179e-47a4-442b-ac1c-c47c1fd131ef", "comment": "Malware payload (Mirai)", "value": "930556c3af20af4a28d6533bca8db60a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721007, "uuid": "39c752c2-43e5-47a0-b0c1-2f39c4d68c59", "comment": "Malware payload (Mirai)", "value": "0c2af4abd7e5972b0b3a22541d4fdd9c1508f64583e6afb0d0479859cec4e4f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721007, "uuid": "25325fda-c307-415b-bffa-896c139a2408", "comment": "Malware payload (Mirai)", "value": "4f17cb7a6fadd768631b7c3b3fecb19cbb04c834", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721007, "uuid": "93947ff3-4236-4a9b-8e4e-1a02bb9f9f4b", "comment": "Malware payload (Mirai)", "value": "9d996fb07a6c7d02e0997263aaf8fb9dffdd4ad88a25013c175fbc1f5d42ec8ba2d935882c06d85aaab5727252dd9d64", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721007, "uuid": "24635b5f-f6d9-4b10-b85c-efb37e5d5604", "value": "T155833881FC41A622C7C11677FE5F018E371553C8E2EA32079C295FA03ADF95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721007, "uuid": "a631916e-7e31-4364-856f-440778dcbc68", "value": "1536:ROMd/8+g9CMlOC+1T33eZtP5PioGSH3KsUHcbvn:ROMd/8XET3wJGS6J4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703721007, "uuid": "ea6e0488-7e0e-4525-ae81-9b4e4f8f41d9", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703721007, "uuid": "b8cadf18-729a-49ee-98c0-9c32850f63f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721007, "uuid": "17f6a6d9-545e-4bbd-8a09-e736e7ce952e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddc4009-a4fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703712209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712209, "uuid": "8ce03896-88b9-4238-869a-3d38d0647e7a", "comment": "Malware payload", "value": "eeafbd6453addd6bc6113e1c23ea1fb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712209, "uuid": "cb96ce7b-d5a3-4f3d-a578-6fc41a52814e", "comment": "Malware payload", "value": "0cabb7c92a7f58f1fee4f16f94c1061027088d8a41f7e1cd1a93d6e02a986619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712209, "uuid": "3ee20d50-d0a0-4b90-b8aa-d44469d4b966", "comment": "Malware payload", "value": "5dd9cc10b264d1d823d8d5ec41401f0b96f32f97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712209, "uuid": "6d2abe1e-08c8-4dd8-a033-65375f8b742e", "comment": "Malware payload", "value": "a9ceda4f750acf9b10db199b90d96b10a9cf9b67a951fd4f7f8f2d36d84ad8a89f4adecc99dfea7bed1807870f84c4ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712209, "uuid": "61588215-b94a-474a-b1a1-1ea21bc6b42c", "value": "T1A0954B5BBCA014F6C4AA923189629192BB71BC450F3127CB3F90B27C3F76BD4AA75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712209, "uuid": "51a8f901-a655-48a5-bc25-4a2d2c8b747e", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712209, "uuid": "d10a5915-5747-4ea0-ac19-de08984d1d86", "value": "24576:kkF5dZitG/Meu5fjw/n+l0/N069hx/lFI5ts/:l5XitmMzjwm6Hhx/rILw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703712209, "uuid": "aa89431c-dca4-4b4e-b891-b724a19a08b2", "value": 1940656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703712209, "uuid": "39778a39-bcdb-490a-bc53-5fdcfadd3c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712209, "uuid": "25d29f27-16e0-4dd6-8840-14a067366fca", "value": "Outlook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02910d3-a48b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703663116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663116, "uuid": "c0839ef4-e1d9-474b-a9cc-9b5bcfadb035", "comment": "Malware payload (Mirai)", "value": "4ca3b379b2b181694cc2003ad048511a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663116, "uuid": "02101be9-5037-4d3d-8d03-620d9694b5c9", "comment": "Malware payload (Mirai)", "value": "0d11d293a082543dcd8b9c3917523186eb317a0ed6386e70af7b314a3cc85be9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663116, "uuid": "14cf1343-5d8e-498a-9600-d8dd938b6d19", "comment": "Malware payload (Mirai)", "value": "933e405e732cf8a56ab386359631b1c2d95377a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663116, "uuid": "f6f1c843-5fcc-4a3b-8e15-150e7dd9afa2", "comment": "Malware payload (Mirai)", "value": "06dc7d5fdfae9e5e4d88be47b32e7c65f06891351642601860cf6027d8e3a7a960be0fe0b3b5084984372af3c17b57d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663116, "uuid": "9e7ed8cd-c49b-478a-960d-710f1e72741f", "value": "T116538D75D11DEEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663116, "uuid": "8de18c59-4f02-4918-a8fb-563f3cac3817", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703663116, "uuid": "80ee4748-5b32-4a19-949f-ba1104d99912", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703663116, "uuid": "50fc278f-404c-41af-be67-47f1a358d50f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663116, "uuid": "60f2b43f-77bf-42fe-a52c-eeb7b3c6859f", "value": "4ca3b379b2b181694cc2003ad048511a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a624c23-a4b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703678702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678702, "uuid": "9180893c-e67b-4105-ac6a-7c45b9e3cc3c", "comment": "Malware payload (AgentTesla)", "value": "87e99e3b925a0f2946bedf8233162183", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678702, "uuid": "fc15eacd-c4f3-4f2d-92e5-10471acf96b2", "comment": "Malware payload (AgentTesla)", "value": "0daca45e8414d4a62e2da6fd2d768a369e557713f83e581a21c9ae4ea93209fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678702, "uuid": "5070d52e-cca1-44fb-bfa4-7958c5f66571", "comment": "Malware payload (AgentTesla)", "value": "3d808230b9ac08f94d84bc4fee68534ec5131351", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678702, "uuid": "c826b07b-10ef-4f59-a2fc-249048b7b6a4", "comment": "Malware payload (AgentTesla)", "value": "666def7c01e584d6b824f5ae178484b48565424d28f22ef0907e85f497bbd55893ef2cc834ff5c2876a5b529713a4565", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678702, "uuid": "75964061-5119-43cd-b244-996c999953c0", "value": "T18CC40205D741922ACCDA4179747B8A11EB72DC0B32330F8F7414792B78B3B5A196EBB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678702, "uuid": "cdd9eb8f-4ad3-41e6-a856-0f2eee7a028d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678702, "uuid": "e12bfd75-d0d7-45d4-9415-88ff773d077d", "value": "12288:ffXMVB/uSVw6ZNo8RkbaT8GJsbczFCIEKGSLT0SXhI2xU:sVB/FVw8NojUpYczFL4WT0SX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703678702, "uuid": "96e1b4b4-adfc-4392-b0f9-2de9b48a198e", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703678702, "uuid": "24b85945-8158-4163-80ce-7416e92ed709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678702, "uuid": "37b5ec84-f181-4bb3-94b9-36a3a4504779", "value": "z47orderdetails.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4c9d7b-a4a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adwind)", "timestamp": 1703674434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674434, "uuid": "07580b5a-3c9c-4650-9742-c373518340cd", "comment": "Malware payload (Adwind)", "value": "1e0b1b66ed579403b6953b326a6112be", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674434, "uuid": "c512532c-0b9f-4875-a7e4-4db9ebd3a8ff", "comment": "Malware payload (Adwind)", "value": "0f3dd1651102ede8e5701ecdf1d7dbacbcb559b9fec5115295539b18c17b6221", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674434, "uuid": "1f1a295f-d4b5-47a5-92f7-22e367e1ebcd", "comment": "Malware payload (Adwind)", "value": "2e3e96ebbb3d9bab1ecab68bf8220dafa9aa7c7b", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674434, "uuid": "f9d2853f-c356-4f85-90ae-892e169eaa8e", "comment": "Malware payload (Adwind)", "value": "e9f4aa3e067487686b62a07f3c07db012de8d470d138990bbafb20ad9ac9f3c133413f749b5385527228f5f024279c10", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674434, "uuid": "b12d6e3d-45c6-4bb7-a497-d504baa47dee", "value": "T1D90412FE554E2143CDAFD3B80201C01B706673129D8E614190A3D572A96BF5BBFA27B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674434, "uuid": "630b64f7-69b3-43fc-a8a3-5ab4d421c2a5", "value": "3072:XITVQMNnfAxP0k6w8H+9DzTHJQ/2kBu6gMlyXT0bS/vRFCrf9C3gH51DAYTaFEvt:uBnIl0k6/EKekB7pbAZFCrfBHYYTIeVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674434, "uuid": "82776ed6-8506-4dfd-96d4-a59368707ab3", "value": 188983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674434, "uuid": "75b26efb-8800-460b-ba8f-2371b0a1b344", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674434, "uuid": "0c8017aa-7d0e-4de7-bc9f-f2200bf2210e", "value": "1e0b1b66ed579403b6953b326a6112be.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1b6d61-a45b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703642250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642250, "uuid": "114afbdf-df8c-4324-8558-f397f88ea8ec", "comment": "Malware payload (Mirai)", "value": "e1ba700f2cc4e3c5084fb98ccacd925d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642250, "uuid": "e32da5be-fb0b-4e36-abff-2e6f7527b0c9", "comment": "Malware payload (Mirai)", "value": "0f99fbf1458aacdf4b12c6f5edf6eb252ad2d35ebe393a2c30831d7044d3a30b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642250, "uuid": "e381b580-f6d6-499f-bd3c-94402a32bda4", "comment": "Malware payload (Mirai)", "value": "fc85710fd5e2b087c827d48e0c6d97ebcbb0407e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642250, "uuid": "da678187-6985-49f5-86d2-e52cc7f0885e", "comment": "Malware payload (Mirai)", "value": "1b99f6e192dc3172ca308aa9bc4654adb545c8ef66e1d9fb43e93f8998179095fbf6e33da0f9d1bdb828f12ea4d75130", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642250, "uuid": "1359d76e-de73-4aa7-97c0-ec1ba5cb8df4", "value": "T15FE34D56EA818A13C4D527BABAAF01893332A75493DF730689145FB43FC6B6F0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642250, "uuid": "2874767f-31dd-4458-aba7-5c682943fd94", "value": "3072:cgxYi2gojQeTWKrsRdx4KDuw/2yCmkdG7u+bn52xK1lXnu/IM/9dhqh:XxYi2gojvTWK4R4K50G7u+bn0x8XnIIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703642250, "uuid": "c23d0802-04bd-46e2-a55d-83ac7b555a88", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703642250, "uuid": "e2cd7e6b-054f-477a-8d06-a0d1d7ad985f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642250, "uuid": "365cc752-b1f6-4167-a68d-c6f4a8a66cc2", "value": "e1ba700f2cc4e3c5084fb98ccacd925d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8512e81-a4fa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703710804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710804, "uuid": "564aef19-223c-43ab-963b-05acb81cb19f", "comment": "Malware payload (Mirai)", "value": "3d8b7065aaa25d581cf8a4bb8919460a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710804, "uuid": "f9070afd-bfc4-4b6d-987c-77a8f84e3452", "comment": "Malware payload (Mirai)", "value": "11b638163de225e1a3da22d2f51800e16debcce3812d9f34c4291e65700fb590", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710804, "uuid": "fd0be928-4bca-4ce9-9dee-aba42d75794d", "comment": "Malware payload (Mirai)", "value": "1c6364d1ce04e08f22a43fd6425e7babfea6cda2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710804, "uuid": "4b200ed8-f082-4989-a4cb-2951858a6cf7", "comment": "Malware payload (Mirai)", "value": "9ead0d1a60dbe666ed29373ba7c0280803c20e41c945079c3e5a4d5979770f79c0be46a27c6283c5fd35ff1200152de0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703710804, "uuid": "a956a9a7-4e24-4118-b47b-68ca4aad8597", "value": "T101236CC1A543DDF8DC1105F12173EBB79BBAF07A6029EDD7D7A9A932D801A01E50329E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703710804, "uuid": "cc80e45b-c39c-4394-b0d4-9f47d92e826a", "value": "768:3W8Vw1BBOGSc2Wlo/bvnhwMMPRwEEQZ8nbRWEsYybJminO+YkX4aP:3LV0BOGSc2Wlo/bvhwMMPSCZ8MZYuJm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703710804, "uuid": "e4292408-3955-4ef7-8462-de05597d5cee", "value": 45660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703710804, "uuid": "783605b6-76fb-4cb7-8b06-a9267aa13bfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703710804, "uuid": "41c5ed2a-ce4d-450a-86de-52cd5f47747d", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a850d265-a512-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703721004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721004, "uuid": "54881383-9751-4eb7-b04c-07a3daf76073", "comment": "Malware payload (Mirai)", "value": "e56cbcd9450fa6356a75abbbf6c06b48", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721004, "uuid": "80f5e6f0-3e7c-4777-894c-7896a8238c28", "comment": "Malware payload (Mirai)", "value": "15a94aee62b4715c01c02444835f21813e9b7bb2e1527ca58e0246d343f39982", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721004, "uuid": "451032a0-8397-412b-9824-a5d7e35a726d", "comment": "Malware payload (Mirai)", "value": "dc62a77e8a2691692a9f88836cca1fbe68dcf04e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721004, "uuid": "e69dafcb-79eb-4498-9443-14b9ed3c70ae", "comment": "Malware payload (Mirai)", "value": "75472037590d16702fb0e31926d301fe9fe6216604437d342b99b92c8be5aae9098b0f68a3a8ee26d73a0a0b52f0ba96", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721004, "uuid": "8577b3d5-a17f-4c15-a1b3-bf00f6a8ed0b", "value": "T12DF34C46EA418B13C1D31776FA9F414A33229794E3DB73068D286BF43F87A5E0E57A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721004, "uuid": "c39b1f8c-2afa-4dd6-b9bc-fbc918de940c", "value": "3072:JrE0wQVv8UhMM+tKXaRGLKW3Sfz8azYEBPFsleM/96O1M:JrMQVwRsXaRGLKWCfXDBPFsQM/96O1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703721004, "uuid": "ff8b243e-cf7d-42be-a4c4-08adde5fc84b", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703721004, "uuid": "186b735f-437a-4bde-ac91-81c830c4e7bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721004, "uuid": "b5740730-162a-404d-a122-e4185fabb6e9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33c439b-a455-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703639928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639928, "uuid": "66e727be-fdb8-4cb1-ad60-593bfde38ec5", "comment": "Malware payload", "value": "e2db32aaa6d2bfa962e0f715a561b54d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639928, "uuid": "a38cc217-10ff-41e8-819e-f9f8ce32770b", "comment": "Malware payload", "value": "175a69f9363f96fb0d8253fc25a73322b29e4e078e0d51382a082be8eda69010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639928, "uuid": "b7a6c9eb-d293-435e-88aa-cceb89de2ea7", "comment": "Malware payload", "value": "dd7157bdb676b8b5d6144bd1c8e980ad52100d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639928, "uuid": "217eae81-c461-46e2-8b34-e8ca233782b3", "comment": "Malware payload", "value": "b034ca19d60f33a0a9d530d59e24ed11e154e2208bb720afc8ee674f2603306c38de37a9d8a79ad4ecf8c3a978d179ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639928, "uuid": "6d161820-33c7-466e-a2ac-90ac8de76dcc", "value": "T171A48D8933966113E7BF6378507B1142F332A986E40DCE28B48894EC1EB5B948577F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639928, "uuid": "59d3c558-314a-4ff9-9ba0-dd1fe26758f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639928, "uuid": "87dfbf60-0638-49fc-a5c1-254a5fa735da", "value": "6144:POIWRmiYdcGLgFq1YCLHqHrHFHwHLC1UTvC38kAieWbdKilXMjTwnOeAR:POIamiYdcGLgqrAyvC3RpJKPjsnOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703639928, "uuid": "29d15569-7ae0-41c1-9f3c-431bf4924ceb", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703639928, "uuid": "9cd71dc5-df62-404e-80a0-831138e42423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639928, "uuid": "c7b02d29-a262-4224-b736-2d8c32a26662", "value": "SecuriteInfo.com.TScope.Trojan.MSIL.26417.25054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f4c44d-a4a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703674042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674042, "uuid": "950d44c2-82b2-4099-a235-21d3c5493499", "comment": "Malware payload", "value": "675b07e16ddb0c7d8a184600c2c0e37d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674042, "uuid": "a5d1b202-5521-4614-8d2f-1eafcc2f101e", "comment": "Malware payload", "value": "19a79430dbc3ec39d967788e6fcf51d61b53e696eb9ccf919e5c9617023b579a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674042, "uuid": "67ea5899-9575-4571-a0d3-05e9e656e1fb", "comment": "Malware payload", "value": "49f45bbc4b5b8f04b643a59e3819f3a9d5092728", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674042, "uuid": "489c5638-2dfd-447e-b633-d1098cd322ce", "comment": "Malware payload", "value": "157e4856414ef4714f23929830e240ebb40a5501e91acbc4ac8a7f6d51cc344d0f735c5238efab41f29a7e59bf8ae4da", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674042, "uuid": "21959c5c-8627-4077-8cfa-dbdeba7c44dc", "value": "T1A4B34401B753AE2AC07D4D39D0A343EC4A3DACBE6D11632774C63E6D3B795A0A907D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674042, "uuid": "5f135319-0204-421a-8ca9-b273197f2edb", "value": "1536:gr8KrrONhAQycAP9kIkokWULxkdkCkGkGkdk5WZklkpVQPeLzLbtbkBkokGkYAPT:iL0jA2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674042, "uuid": "fad5c220-acea-49f6-9ff9-7ce1c53f2778", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674042, "uuid": "983c0f66-15c6-4394-a28c-bf3365818c5d", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674042, "uuid": "ba8e7a3c-44dd-43ea-8c43-556fb5caa45a", "value": "Resume C.D.Murali.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c54aaad-a466-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SpyNote)", "timestamp": 1703646923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646923, "uuid": "ea719f24-84f0-4db3-9090-a8c07b9aba0a", "comment": "Malware payload (SpyNote)", "value": "9439b0e0a965c789c8e18f6d1b2ef624", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646923, "uuid": "95035e58-14fa-48d7-ad27-326ed4d916bd", "comment": "Malware payload (SpyNote)", "value": "19b468b99966d5d8f88c19e4b371cac9d3b2b45b5ac3fa00ff222edda353f31d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646923, "uuid": "9e66fa4e-ffa0-4cb3-a7aa-d69f30605fa8", "comment": "Malware payload (SpyNote)", "value": "93b0e2dbe3bef2638d18fe6a03f3131e151714f2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646923, "uuid": "b840d8be-6095-48a4-91f5-8cc3215f4ee4", "comment": "Malware payload (SpyNote)", "value": "e3ef996c1474266b9a2835db7cb4a1d2063762a106fda9cf595bb2d7a10336a59e6ffd651d6bd1b36b5030f2cf56a6f0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646923, "uuid": "c90ff546-8767-4a6b-9691-3f7b0e953d9b", "value": "T1C9C68B8AE2979B67C4F703B9743D27651DF64C20DF838287AB08323E64739E78A545D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646923, "uuid": "c5f66f87-5bda-42d3-accb-4b49d90b6a33", "value": "196608:efqX8wUGLwYGBonSEvsHEfecLCTyinuVScft9hdKKxr:kMNGBVz3TyinuV9ff/FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703646923, "uuid": "7f34ad8b-7413-46d2-aaa8-d9019f1d6a76", "value": 12268452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703646923, "uuid": "ac49409a-5331-40ee-8760-df1ffeb4f5d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646923, "uuid": "a4b1fe84-e4d9-418c-8f90-7b4ac4f53570", "value": "YouTube-Premium.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7faec333-a4d4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703694307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703694307, "uuid": "9740b24b-1bed-4352-bf68-aa1adb95f27f", "comment": "Malware payload (Stealc)", "value": "b9e52db8c2b32fe642e7044591872c03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703694307, "uuid": "0806f365-64e5-4a04-beab-e053225447fe", "comment": "Malware payload (Stealc)", "value": "1c0008391ca8fa90f4609c97b81dddfa7b0d9587c5a480b836040f4ad796bc11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703694307, "uuid": "dd7134fd-42fa-4672-bbd7-2595d90dcea3", "comment": "Malware payload (Stealc)", "value": "dd03c8bb8afd68816b9346cbb1c0493342bf8182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703694307, "uuid": "b86273e5-1904-4090-87e3-288cb990de7c", "comment": "Malware payload (Stealc)", "value": "f88d823cf91d32f28a4926375f78f79054b4d755595fbb2e073f984ab0867c771a6761c4396905ff6282a6b12df33d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703694307, "uuid": "b464fa5b-f850-47c7-b3bc-2e92c53ed8c6", "value": "T1A4D53313E9F90233DDAA27760DF61253132ABED1AA58569B11DCEF2E1CB42943431B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703694307, "uuid": "702744f1-08a8-4643-a196-540b08662be7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703694307, "uuid": "5323013f-309d-450c-a699-741f42599fd7", "value": "49152:3NlbKBQUzBwEp8Ps2eTrqoAb83Df4klSABQ0yEyPLXKG1DcoGHVEeEo4f:7K5zBwEp8Ps2eyoJTQT0Q0HyzXK4DcoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703694307, "uuid": "4ff70403-6d6c-41b0-8d88-15c1414a2372", "value": 2761216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703694307, "uuid": "5456df65-6fc5-4386-b001-186d5f29b661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703694307, "uuid": "b82ab0e6-f228-4301-948e-45ca06981e3c", "value": "b9e52db8c2b32fe642e7044591872c03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a1ae96-a470-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1703651394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651394, "uuid": "197fc42e-a424-4a45-b901-df3a271d7d2e", "comment": "Malware payload (Stop)", "value": "f645b68f97b49c8d120158e7fd7f1460", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651394, "uuid": "90fe48b3-3ca0-49d6-b892-6055abe1a916", "comment": "Malware payload (Stop)", "value": "1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651394, "uuid": "66696b3a-82d2-473f-ab6e-de8c52a2a660", "comment": "Malware payload (Stop)", "value": "b8673e2041966ace9d643106ba2aa1e69c3b9cd7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651394, "uuid": "d18c129d-9045-408c-9ad0-90bdc91631ce", "comment": "Malware payload (Stop)", "value": "35418c62f8de7bd689134b340621c8b23abe3af20fef3a4b3abf38299a21c92094acec9ae0138788e9b33af5a4d5934a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651394, "uuid": "4764d355-d113-4fa3-aec8-f160cc6d7e37", "value": "T1A445AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651394, "uuid": "1b1ce41f-77e9-4c84-a9e6-31b41051f401", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/BRPOO8xGKUq7:F0dwAYZt6C31WeT5RPOhxzUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703651394, "uuid": "23027e72-d1ff-4f3c-a4dc-e39d1ccacfdb", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703651394, "uuid": "b0c03c68-b71b-45fc-a71c-22be18c66574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651394, "uuid": "ab2c1707-12d1-4375-a731-50e1e20f9518", "value": "DRA64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df35c9c0-a4bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703685448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685448, "uuid": "91290c0b-5f57-487d-afda-487a59d40a95", "comment": "Malware payload", "value": "9a0b90b39ac631d4cebf9d02fdc0c158", "object_relation": "md5", "Tag": [ { "name": "87.vbe", "colour": "#522321", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685448, "uuid": "eb07eb9e-57cc-45bd-a78d-022cdc949bde", "comment": "Malware payload", "value": "1e6d75f505a8c7763f44494fad90ac6ebfc410e72eab5eb4c6a7eadb597e64be", "object_relation": "sha256", "Tag": [ { "name": "87.vbe", "colour": "#522321", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685448, "uuid": "948776ca-fe1d-4e9b-a4a3-7170d7c0ecf4", "comment": "Malware payload", "value": "630117db7ca7e249b81f7059b72b5569260bcf53", "object_relation": "sha1", "Tag": [ { "name": "87.vbe", "colour": "#522321", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685448, "uuid": "183d0b7c-88b2-4f9e-961b-88e4dd831cc3", "comment": "Malware payload", "value": "f7bf68ea775dc287b6936fa43a8f5e220febaf9aa57cf49f77d80548167e4c72d453e2573352eb1d59a277aac98fc228", "object_relation": "sha3-384", "Tag": [ { "name": "87.vbe", "colour": "#522321", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685448, "uuid": "d277e0f9-12c3-4705-b2ff-9b95424835c0", "value": "T128559DEEB749D3238175D3F3CFC58D0DC5934F0B7B059859E4A6C6E14B0AA40ABB6292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685448, "uuid": "fc4a28bf-076e-4377-b86b-994e550bc2bb", "value": "24576:HAu/jkXxIlhvCKL7eS5+SKbClNceSbxE8MSeFXHUOEWlNLATP:H7WIPvLiSkXbCHSbxEqOXU+f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703685448, "uuid": "85729013-181b-497e-9187-e03d82cd737e", "value": 1388673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703685448, "uuid": "be70f0b6-52a8-46bf-85bb-a957d96cc2a4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685448, "uuid": "6822054a-843b-4040-8742-c3159cf12099", "value": "87.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924e4b98-a454-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703639363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639363, "uuid": "070b6b63-e13e-4c4d-bc71-c8f06dfd30fb", "comment": "Malware payload (Mirai)", "value": "0079e54f69c6907d0d2eab34ae52ee5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639363, "uuid": "5528529d-1810-4ac5-8bf1-9c71318675ca", "comment": "Malware payload (Mirai)", "value": "1ee3a83bce51c45d6994f9109d872c50a6bec8fa9cb50d5f1d0dee54ec4cc03f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639363, "uuid": "b21d9192-e369-45c2-a546-199dced79842", "comment": "Malware payload (Mirai)", "value": "7350508349bf584d71b9a1e72fd6b51408b93c79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639363, "uuid": "ca147982-101a-4e34-86dd-5dd2f68d65c4", "comment": "Malware payload (Mirai)", "value": "e19ee7670d501c25396e3a6f4ed11a61e9463f697cf5b7f5cd57830ba396941ba65fc648441905f078cd8314b0f0e666", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639363, "uuid": "37bc50eb-392d-48f6-ab63-326bfb8930e8", "value": "T1786339C0A193ECF4DD1507B43177EB374A77F136612AE9C7D3A8A923BC82A41950B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639363, "uuid": "cf046bcf-e52f-4df8-9604-23779fbcec22", "value": "1536:h4uwwSB8qv117K/Mn9O/Eb/vRkWNZLF/EfNatGWkffal6t3zzcS5KfXQE:hBxEV3Db/vRkWNZLF/EVatGW6aolcSQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703639363, "uuid": "d2ea03e6-49f3-486a-b9a1-eb3519b143f1", "value": 70672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703639363, "uuid": "6bc1e38d-da6d-461f-abb1-8f02c583c646", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639363, "uuid": "dbd0a29a-3736-4538-ba30-9bf720cf1f7e", "value": "0079e54f69c6907d0d2eab34ae52ee5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38df16d1-a4a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adwind)", "timestamp": 1703674432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674432, "uuid": "38a69e65-911c-4cf0-afb0-b6e5f0a3d068", "comment": "Malware payload (Adwind)", "value": "f41bda59913b7e6b0c5e34f54643b35e", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674432, "uuid": "3652f46a-ad87-4c2e-9651-bd03b2fb835c", "comment": "Malware payload (Adwind)", "value": "20f72ce775db50cc8af8eeffb04b93c1e44ae31f28419bc1b75b24e348e3597f", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674432, "uuid": "e83d7446-377f-4942-85be-2dbe4272e92c", "comment": "Malware payload (Adwind)", "value": "012dd538d18a7877bf4531464a820304b92d54b1", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674432, "uuid": "32e0925b-04f3-4817-9f42-16e43c433c79", "comment": "Malware payload (Adwind)", "value": "d65ee2f2c5ef5e9f93e77ab7c5bccca3d68b80c73644cdf56cf699f3a3f47cafc71ae16b1a74e8976530797d804babc4", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674432, "uuid": "de188a1b-4e30-4eea-8384-a59f78f71466", "value": "T111F313A9CF269349C053D2B571388B3DADABC64A3469835FE47E209C27889FDBD105F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674432, "uuid": "1701a9be-ec30-482a-a0b0-fd1113931c88", "value": "3072:Ac11JCMC+NqxCAl8aN0e7B0XqVFX7QX+F4JQl4uTLLEiDqY8DrsCNy:Acwz+NOeaZ7eX8UX+F/4uvh5WX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674432, "uuid": "37bba79e-421e-4c9f-830c-8d6a6a7e3d14", "value": 165022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674432, "uuid": "531fea48-a88d-41d2-8c0d-b3bd226ef7e3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674432, "uuid": "41d7124f-fa69-45c5-a479-e895679047f7", "value": "f41bda59913b7e6b0c5e34f54643b35e.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd47df4-a500-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703713340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703713340, "uuid": "eb68bceb-28bd-4dca-b0fd-9af03835908c", "comment": "Malware payload", "value": "703005f6b8799439fc3ec4e09a40e62b", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703713340, "uuid": "dbe70cbe-87aa-4b4f-8d8e-abeb9edeef50", "comment": "Malware payload", "value": "22d54a239233059e6bd785ac7ba43d081c1acb6f3eeeb8a20f7a6f79f6f7db34", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703713340, "uuid": "dbfee1f5-7a50-4a32-abd4-6b5d46e10848", "comment": "Malware payload", "value": "fca2dfae2cc90d2c8fb658efb40ff954a4017598", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703713340, "uuid": "acb688e2-cb7d-4937-825c-3175c9959af9", "comment": "Malware payload", "value": "e84cc84cf9fea2cdc427f74d95f7826063b457023ef51a2e2cba79ae83cc92cb7e081ce6fbc1226d9be7358368cabb32", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703713340, "uuid": "eccc4ab1-3b4d-4a5e-a794-9abdf9c87f5e", "value": "T14B16E1AFEDEE81DC9E23FD9F22469282842D0600D69F0819D536ABFF5742B7495F8434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703713340, "uuid": "e03002aa-822c-4bfe-9176-45711fefa6ca", "value": "49152:5+/z8QD4QypE5AiEcukXHciX4VSiWFbW1rAFw:5dc4QypvzcuK5OSiWM1r5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703713340, "uuid": "5204bad3-f3d9-4df8-bef4-c2edd53fa39b", "value": 4031217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703713340, "uuid": "e7151b65-de2f-4837-bb6e-4833eba358db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703713340, "uuid": "8ca9a30c-165c-4b3d-bd41-dea1ff39bbf7", "value": "installer-x64.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5f67d0-a46e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703650684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650684, "uuid": "17a010a2-c3ea-4795-878f-5c23155bcc40", "comment": "Malware payload (Stealc)", "value": "444ef12c9c65d13a3ecb84588f25d884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650684, "uuid": "c87e36c1-fa70-4356-b2bb-1df5eb4b89a6", "comment": "Malware payload (Stealc)", "value": "2628201fa47cb015f5cc8ed60f7495ee3897a5b361971f82a7ebc2cd24cace46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650684, "uuid": "2b44142b-888f-4357-9bff-ee5b0d70f403", "comment": "Malware payload (Stealc)", "value": "747acb8560b53a1217ddf65f315307119dcc6a1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650684, "uuid": "a74a9bb6-1f4d-4c31-9f06-f14743e9f563", "comment": "Malware payload (Stealc)", "value": "d3ccb32ceeda9f4d697a970071b0fd419ed27015e7434d5bb67177d6f005ac6300292ab6e8e4e94e5c65417541dfed39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650684, "uuid": "747de7ac-9f1d-4786-b073-8bc4ca563c04", "value": "T1E3548D3172E0DC32E2E319358674C7F54E7BB8726825A58FABD02A794F217D1EA1530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650684, "uuid": "d2f84e1a-8548-4bb5-ad73-75256ae12d67", "value": "1a755a7760c13e9f9910148d88732e21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650684, "uuid": "e2b7396b-9295-4edc-8017-97ca23ac8c6c", "value": "3072:bxW0wACiOu/LQ5E2eqFuZJiju1Yx0RhC3pbrbg+n//aIZZ1Mg4y7xveB5Jy+Lddt:dWOCiOu/LQw6u8ueVHh//hV9P7xg5fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703650684, "uuid": "e379e2c6-7454-4aa4-94f5-9a7bf3d7726c", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703650684, "uuid": "a47fa565-4188-435c-802f-9fc4c7587dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650684, "uuid": "3cf67e04-4d9b-496f-ab1b-ccd80834001c", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.35279.1356.9470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4430ba8c-a4e6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703701938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703701938, "uuid": "80565323-a674-47cf-be14-3d2ae11c1e86", "comment": "Malware payload", "value": "66f5f2edbd70030763f4d19266889288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703701938, "uuid": "166a8808-1f0d-442d-934f-934d3fc04f1e", "comment": "Malware payload", "value": "26aaf6a94a74bc1d1dc451de24a9a4a5c3ae62039f4dde1d8cc7fa558bbfa4b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703701938, "uuid": "5fe2c7fd-4a90-4e22-a2f6-cd68d7396be2", "comment": "Malware payload", "value": "37c170e5ef971fdf2387f56432c279a05f288caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703701938, "uuid": "3ab36f6d-7a08-4ff3-b7b6-4dbe6cb24626", "comment": "Malware payload", "value": "bf32b99756f3f959e91382ab713dd4a444631e8c4aebf943a248499d60dd011df9b8a12ffa3da0afbd0ae7199aec8b95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703701938, "uuid": "84ac3b3b-9939-4af2-aa2b-eb5d4cc936a6", "value": "T133B6339A259F40F4DEC11B34D22F7F8B63F147B68D84C83CBEC969CA9861E726027456", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703701938, "uuid": "88474909-d4fd-4cc5-8c9a-6b7fa7f0a2ae", "value": "7d01a99a35752b346817beebaeedac59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703701938, "uuid": "a6c91e02-98d6-4554-9aa9-433229fc55f2", "value": "196608:YOcO6+JRMOTqIodNqzt/xn4Su6Ce5K7hCx1C8gkMKV3pI4zMmf4xTGGoN575ItI:YOcO6iMSlzt1u6CeRCBkNzHzd41GGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703701938, "uuid": "fa5e3a2f-a3ac-42bf-8718-2873aac23157", "value": 10777600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703701938, "uuid": "2e1aad4a-ded6-4ea1-a295-b3713a08c85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703701938, "uuid": "6dd85df5-1382-4092-8584-e1f10fc48523", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419d90e9-a4fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1703712242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712242, "uuid": "39d4e885-8252-4b73-bfb4-9ca61c1ae905", "comment": "Malware payload (AsyncRAT)", "value": "d9c8921735003dab5b42b42d987af99d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712242, "uuid": "a8f94f5b-eed0-4ffe-aab4-0335fe40c9db", "comment": "Malware payload (AsyncRAT)", "value": "27f90ebad78d46db0fa59eaadcffe4e10821a016e043a5c862520485db74d87d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712242, "uuid": "02db615c-d61d-4873-a134-2adeae57fe7c", "comment": "Malware payload (AsyncRAT)", "value": "fea2c7257f766ee4e539b59b76e718519f5b3afe", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712242, "uuid": "c874c96f-a471-4820-8998-52871d487176", "comment": "Malware payload (AsyncRAT)", "value": "6c07b0154fcb1d319b540f8c4c09fe0c00f23fd9220e779088356d0708a8849087000700a4a85d076f0fff1ff914c8c6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712242, "uuid": "3cbc9698-b09b-4f97-b5b9-3ab237c9d6e4", "value": "T1A4F6332114ECA6798B06FCF4D9F013DB108D2816540A9A6B27EFA5B51EF88DD06D9CCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712242, "uuid": "3be96edf-aedd-4fed-9db7-7901902ca6c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712242, "uuid": "fd9417d0-7e38-4164-9ef3-448e589b032c", "value": "393216:jORLawFvGDrUrD8ba6vg9co2fHS/asi9r1/9K63vtPyw:jO0ySpgt0L/Mot6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703712242, "uuid": "56eb3874-f44d-4453-8192-0b25a623200e", "value": 16179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703712242, "uuid": "50664629-1658-4ae0-b1e6-b625f1c5649e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712242, "uuid": "09541669-52d6-4521-bcd6-ab52188f4153", "value": "sdfscvxsdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f63c641-a47c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656565, "uuid": "dc38cc57-442d-40d1-913a-4f055634bac8", "comment": "Malware payload (Mirai)", "value": "65abb625f50fcbccd7418a2c0f07ea70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656565, "uuid": "e20599fc-7432-4fbd-8be0-ec1e3e676dfc", "comment": "Malware payload (Mirai)", "value": "2a88881ea67cbd23f4efefc2324e7ce361f76877f4dd6fbe9cb2145a9c69eb37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656565, "uuid": "ebf3e593-f8db-4e83-9830-cdf6927ac5e6", "comment": "Malware payload (Mirai)", "value": "f1368872f742c4da8582679793edecde09258128", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656565, "uuid": "33b7dc20-7a8a-4371-b6b2-7e83c74cb1b7", "comment": "Malware payload (Mirai)", "value": "e32e08c2b0613efc20570b79af76e7cdc2e2d2e9284f3170b91437147628580547f331cc5691f6a78123a15a7669f66e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656565, "uuid": "a817e7eb-45e0-4dc9-8451-58c5ff371f4a", "value": "T125536DCAB8119E7DF5CBE77E84220D0EB821726150931B27BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656565, "uuid": "7237a252-65ec-4e18-bb4b-37be1e7c90f2", "value": "1536:AXyRgQF4TbSX5lxLepSGY5cFnehON2PPB+qG76E8B:N1TjJ8EVGOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656565, "uuid": "6fa29b38-b37e-4dc8-8760-31540248faab", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656565, "uuid": "c761627d-ab35-4238-a51f-1fad2b3abb50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656565, "uuid": "082c98b4-f329-42df-b4b1-2df801379883", "value": "65abb625f50fcbccd7418a2c0f07ea70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef903b04-a46e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703650686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650686, "uuid": "bea3b8c1-120b-41d9-8cec-3dbc0b5f869b", "comment": "Malware payload", "value": "e7071dae36aa4bd84e8276380ee38ec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650686, "uuid": "df75c1b5-7194-41f0-98cb-e4b098ab2ee5", "comment": "Malware payload", "value": "2ac84ebd999296ee1736b96222fb81c559bcfcc56666d1270582d4bc1d381eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650686, "uuid": "033ec202-90ca-4d10-bcb6-77823053c087", "comment": "Malware payload", "value": "96b1b33a3801b8d314d80b214f4f7fba90f606b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650686, "uuid": "ec02159e-2a37-4532-afbe-988e5f1d4374", "comment": "Malware payload", "value": "aa2e980de23ab51a4d4e579a24252d52c8cf4354cc1f552668560f7084b7ac0b0a9a3e4818352dbbf7e8e222a16fe91b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650686, "uuid": "e996ca0c-ad52-4ad2-a7b8-222956365913", "value": "T1AB063341BB8159B6C4532E321F64BB146A3FF9300F459ACFD38156CC6A70EC25B3AB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650686, "uuid": "6799464a-e7d4-4292-8116-5f3a4bba7be2", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650686, "uuid": "d0b6792d-fadd-4e78-b51d-3e79925ecc74", "value": "98304:xWhl0BfKESWSAvwY+3G48WnbcxC7OS0tgkBGVC:AfWdWbKyO5t5GVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703650686, "uuid": "a4f248f0-1dea-4e00-aaad-63d3f86d7a6c", "value": 3790375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703650686, "uuid": "ecbbe27c-eb3b-4342-9f6e-a84c684c2021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650686, "uuid": "ef8fb10f-2d68-4c3f-b970-1a3489dd7075", "value": "SecuriteInfo.com.FileRepMalware.21188.16534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c72719b-a4a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703674062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674062, "uuid": "ee914a58-2b76-4ada-8b67-42f94faca6e9", "comment": "Malware payload (RedLineStealer)", "value": "5ecd33dc583836d5dd7fbbdb7665478d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674062, "uuid": "6f939f51-fbe4-454b-b57a-c2444bf31fbe", "comment": "Malware payload (RedLineStealer)", "value": "2bf3abafd3c5119d54aa9033d393851d3d9c90505d78e3ef62cffbd62c11e135", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674062, "uuid": "ff06cc10-85a3-4daa-95ac-ab72f49cf812", "comment": "Malware payload (RedLineStealer)", "value": "c935793bd3186f1ffb1bb38b782d1ff311dce641", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674062, "uuid": "7d1e3d5f-b149-4389-af65-a9882aa54b03", "comment": "Malware payload (RedLineStealer)", "value": "4a647825c9abd15916701d21571c00999550c9d61a34d847e3d10e2186eec6b0ab2793c79d50d01dfaf38a767b9211d8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674062, "uuid": "180ee781-ed1a-48ef-bd4b-18cf8d39ff9a", "value": "T144B10B1076FB910C7173BF961BD576F68E9FFF726E16909E2140030B4B62A44CDA2A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674062, "uuid": "6f583e28-c6bb-4f72-8aad-c64487f88f05", "value": "96:whSJx5I9dcw0aNcja7fhSJxxw0aNBme4ame4ga7yme45GVGdGme4WGVGd5:8ShIwaNzpS3aNQJjJBrJaEJDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674062, "uuid": "650739dc-d26f-4c92-a801-1500f9557e5e", "value": 5334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674062, "uuid": "f3187506-cbf0-47c8-8298-a9e5167e1716", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674062, "uuid": "894729d8-7a5d-4ad7-bbdc-9c477eb6603b", "value": "paymentconfirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9c3e54-a47c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656560, "uuid": "077e9368-cb38-48c5-bde3-9e66430c38ad", "comment": "Malware payload (Mirai)", "value": "0ab04f21af5ed4d33faba499204ae39a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656560, "uuid": "3ed11ae5-98e1-4ec7-b135-df5bebea8151", "comment": "Malware payload (Mirai)", "value": "2cf3f537d819a888dde3df4d564f14e1f6a735d4c717663e11683b3eebad58b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656560, "uuid": "d70f5534-238e-423e-a421-05ef7996e05f", "comment": "Malware payload (Mirai)", "value": "00bc061fca0ca206152deb936521f62a943616cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656560, "uuid": "fad89914-9a53-4fa8-b787-d4f0b9fc3dfc", "comment": "Malware payload (Mirai)", "value": "ec9ddbf0c1183a509a1f702e967caa5a5848e52c55c32dd4d3815928a1d1d6dd0a8b07b5c233620db0366dbe34857d3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656560, "uuid": "13a8c6a8-57f9-443a-9d4e-4fabb34aa5e7", "value": "T130B2D0E48BE05706C2707439A37C8F625B3B16F4C6F62926272092BCD59585633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656560, "uuid": "9d5c09ec-b482-4437-8a56-29f72834c0a2", "value": "384:4CQKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BZyXhymdGUop5hu7I:4CQKQFH0rs3zWoDDRsjt7LB9U+BgXs3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656560, "uuid": "017a63f0-b1ac-4b31-bf9a-924d278f801e", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656560, "uuid": "07e86efb-c1d8-4d4b-93e0-520585445cc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656560, "uuid": "9e9cca38-22e9-4291-b49e-ffff923c8afb", "value": "0ab04f21af5ed4d33faba499204ae39a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67416ce2-a470-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1703651317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651317, "uuid": "6e1ba0e4-3a04-4fbc-b7cd-82c74d974b0d", "comment": "Malware payload (Stop)", "value": "8815964ed6c37a423f6019b2b69e7967", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651317, "uuid": "026e6d58-1155-4f22-9b14-1bd48f4c64f1", "comment": "Malware payload (Stop)", "value": "2d301697ff72986171c0b2ccc979ab8e93671d640de6abad57de7d4e146b70f4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651317, "uuid": "eb64116c-a2d5-4f8b-8446-e407f165e174", "comment": "Malware payload (Stop)", "value": "2565eefb2c6b04f20cc89e4008e910cc5b71efe9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651317, "uuid": "dde9d5c6-f727-41d3-b042-3ba7a04887f5", "comment": "Malware payload (Stop)", "value": "1747f515043a36e07048a9f046564f16557b94dae27c5135a8f2566e821a6f3981ec71d1f06fec80bb0ca0c07d4556c9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651317, "uuid": "051fa836-bfb3-4bcc-9b36-682baa1c3959", "value": "T19945AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651317, "uuid": "e0dff152-da0e-4d38-9b9c-61f631a1e230", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/WRPOO8xojUq7:F0dwAYZt6C31WeTuRPOhx8Uq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703651317, "uuid": "7369f62f-fac0-4afa-a26c-a4c5483a6745", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703651317, "uuid": "a8f47eaf-7fe7-4769-8756-b3c8a3bce7f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651317, "uuid": "67f1cf9f-ccc7-4530-ad5f-81996a1dfce4", "value": "DROPB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8348b28a-a46f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GandCrab)", "timestamp": 1703650934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650934, "uuid": "1f083216-9906-48c7-9d26-90d87196028f", "comment": "Malware payload (GandCrab)", "value": "60b7a880df0285381487cd741ee18fa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650934, "uuid": "71894115-749e-4f41-8200-277caf4e721d", "comment": "Malware payload (GandCrab)", "value": "2e1646e5bcff7912bdb34118fdd625c6b858b0a13c8ad01e38e457cb3673176e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650934, "uuid": "df6c4fa5-aa6e-44aa-86cf-59181640c797", "comment": "Malware payload (GandCrab)", "value": "23ec8758fc06a46d258aab54e6fd264031e537f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650934, "uuid": "3557aa11-4338-41f4-b661-c7eb11c2c0b4", "comment": "Malware payload (GandCrab)", "value": "9f9ef0ef45ab65e00cc015ae94d146b5f6d805175efa91592cfe198b8b9b389944da0c5a19b0e12fd3682b88587bbef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650934, "uuid": "056b10cf-b217-46aa-bc7a-1eb06bec2ffa", "value": "T1F7E34E182A88B7D2DD9A6B37D2A278C87C343584568E605FCA531CF538783B57B2361F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650934, "uuid": "a33fea7c-43a0-4cd8-a51a-f947bfc90a84", "value": "40306b615af659fc1f93cfb121cc38d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650934, "uuid": "e0cf7422-9d92-4843-9a19-c3c61b4dc79b", "value": "3072:WYHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:WyOqqDL64vdGREz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703650934, "uuid": "bfbeefa7-6ac5-41f6-9528-9648e68ff4f6", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703650934, "uuid": "12ee45e3-79e4-4fb9-841a-af93b7c74640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650934, "uuid": "842ea1de-4ba2-457e-9708-4dc0bbd85ad9", "value": "CRAVE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970c2fd5-a4a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1703674160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674160, "uuid": "87905e5c-5ff0-4692-a3b9-097a524bd685", "comment": "Malware payload (AveMariaRAT)", "value": "8b655d5a59c5253873d4b50cc5cd85d4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674160, "uuid": "c30a2569-4d8a-4d2b-9624-602d4d26f3a7", "comment": "Malware payload (AveMariaRAT)", "value": "2ed4d311cd26536a281cc96dfa12fa78abec12b56c802978408ee82739daa756", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674160, "uuid": "9f9b1b6d-4cb9-4c3c-9506-323610ad2c35", "comment": "Malware payload (AveMariaRAT)", "value": "06b61c357acfc0380c9481922891615ea8dec998", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674160, "uuid": "9db158fd-2552-47dc-8d3f-9c9c63fa1d03", "comment": "Malware payload (AveMariaRAT)", "value": "4c52a2b0a823853a1d18a5bb6565860e84461c50dcc7117a4d9d63e8a22548074bf6c5b2d0bcc28c9a6f47237b6098ac", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674160, "uuid": "42e1c11a-a54f-4032-a9c2-0bdcef671863", "value": "T16135E157F6D3B679E6BFC2BAC6B0DD2C65B334920370938E778125892912391593CB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674160, "uuid": "3ffe140c-4f6d-497d-ba7f-b329bbb67189", "value": "d4c9759f791ea559bbad095fb49820d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674160, "uuid": "17b4f2a2-0260-4249-ae05-faca3e0daac7", "value": "12288:UG1N4HkcgMsiOd58bzbBSrezQ0uqZzD1reWabd/JsvgcwwmxA8yoMbs1dDxl9jDE:UoOOMX1D+QHT+dBs4TWoMbozBF63hGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674160, "uuid": "54fa6906-37cb-49bc-9ca2-26d269e8d096", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674160, "uuid": "7496d359-b824-4e0f-a86c-8bd60f1a4123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674160, "uuid": "f78b9637-a428-47bd-89a8-2c8f8fad82a7", "value": "Comprobante_Estado_de_cuenta.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b921e13b-a464-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703646300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646300, "uuid": "c6cb549c-dd2f-4650-ad6b-2f5edd188ca2", "comment": "Malware payload (RiseProStealer)", "value": "e8552c9017df835a2454a9bfaf6d3ae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646300, "uuid": "ee7c2c7e-a70a-4c2b-80dd-f463eb93f604", "comment": "Malware payload (RiseProStealer)", "value": "2f5c4132fe18979d958ecf8833e8f3497f4a8f290820d1dc7f4c41e66bd13214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646300, "uuid": "674e8cf3-bd7f-425e-a0c5-9c1ed906a946", "comment": "Malware payload (RiseProStealer)", "value": "0dfda39d08e164d6ab569387bcab1bba61e21ddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646300, "uuid": "ba777d2a-2df1-4002-be1b-cacab950518a", "comment": "Malware payload (RiseProStealer)", "value": "fcce1a6c72159b4ef3dd00e4de622619c54467b441e543a1f69ec75996eb30926ec1151694208f465c9a2a52bb30a4cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646300, "uuid": "98d3af45-8032-4f71-bc05-ed221f47ae20", "value": "T1199523D3E2C66437C8B5AF700CB626E356397D928838971B2F51790A19634E4DE3273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646300, "uuid": "ba6987e2-f845-4e17-84ee-40cf3b8d65b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646300, "uuid": "2b994653-1505-4079-af5f-191fc1b3a644", "value": "49152:rZAqnjC2FKN2PNK8XJ/+2wiEeLyxS9gOsGuefn:9AqnZ3lh+G7L6MgOsGuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703646300, "uuid": "91d0c72f-45dc-4cb1-8c19-8c12ba21e3f9", "value": 1990656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703646300, "uuid": "3ed68b29-9757-43b8-bec1-d9ab36bb8ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646300, "uuid": "6d42ec0a-050f-4331-8648-9243c2bc6800", "value": "Sr1OM60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f74484-a46d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703649966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703649966, "uuid": "88d97c44-844d-4432-afed-6a6ced4599e6", "comment": "Malware payload (RiseProStealer)", "value": "b570a3f7282abb67aef2b64ff66268ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703649966, "uuid": "b86fcf00-3665-47dc-bc1d-e014bc016c22", "comment": "Malware payload (RiseProStealer)", "value": "2fe1c7f6fd2a372cbee37cea22872936df4fe02d94cbf75f0115167b2ee14982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703649966, "uuid": "64786cc8-6900-4c29-8d2d-174cec8039f0", "comment": "Malware payload (RiseProStealer)", "value": "78f64caaeae2dfc1ba249b8b4a76d4b83018733d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703649966, "uuid": "ccac7225-100f-477b-ab5e-3a9c64b39c59", "comment": "Malware payload (RiseProStealer)", "value": "d6ccf9b78d51726eab1d9aad7851ad84102d6daf527400de686fdc68741bc54cef11f6bd3d77124062412399119acd00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703649966, "uuid": "29778498-0d9a-4195-8576-0e8908733edd", "value": "T1A2552326B6E95173DC72137004F72293163A3DA2DA78538B36582DAF0C735D0A63677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703649966, "uuid": "7afcc0da-1175-4595-b6f3-3fdffe917d3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703649966, "uuid": "f66246d8-6875-4a95-bbfe-af4b15fef06b", "value": "24576:ZyJsblF5RtKGW5chOOr5SwjABuZdrJkW635ATye9eJXoVh85t:MJertKd5chzrEwjAMZLq5ATyekJYVh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703649966, "uuid": "372bd67e-5548-475d-b994-c053d4218df8", "value": 1388544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703649966, "uuid": "37171855-d2f3-4a76-b449-0be6c370efd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703649966, "uuid": "4c7ba206-aa2b-4b83-9ad3-7c984b778b31", "value": "WEXCAMP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15764d6d-a4da-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1703696706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696706, "uuid": "4a91164b-055a-45c0-a971-8c111702a10d", "comment": "Malware payload (njrat)", "value": "c827f874ac51abd1b5c1993fed809338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696706, "uuid": "976bbb1f-756e-4df0-8988-ecc48bfe27c8", "comment": "Malware payload (njrat)", "value": "318fd4ebbec2e57253e8ecae49ab37af027d66c8e5f05b8737191566e3ce1e91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696706, "uuid": "56036561-8e62-49c3-b54b-c7d417aa23bd", "comment": "Malware payload (njrat)", "value": "6faeaeb38ce37d9781fcc125cd3352244d7cbcd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696706, "uuid": "6fc6e1ab-7c9a-4f92-826d-d956173abc49", "comment": "Malware payload (njrat)", "value": "5ee37b56ea32a554d9e24890b3088f9ca0267287a0383e93403301a77f8c22c9a537a880527e1f347e15c4d0bc243570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696706, "uuid": "9f408211-9614-4bf4-8dd6-3a89bf5f9829", "value": "T1D6B35A2629FF209DF3B2AEB12FD9F5FFC96AE973150A70BA2181070287369419C41775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696706, "uuid": "bd10a0a8-e8e8-47ec-ad3f-56643fc1e9ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696706, "uuid": "7523ebd1-9beb-433c-960c-7a22b5cc407e", "value": "1536:Zyu4iy6mRNhtLfxuwnlPYzcqhaSLJ7sloVCZNSZc2rxysJtIaT6l9gBa:Zn41rh/Av3rF96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703696706, "uuid": "3b21c341-24da-4e88-b85f-fd98dc0294f1", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703696706, "uuid": "8a149000-a3d9-4905-8947-7a9d0f0b8f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696706, "uuid": "4371ed70-6691-4da4-90ad-84e80c85427f", "value": "c827f874ac51abd1b5c1993fed809338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ea3ef0-a455-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703639933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639933, "uuid": "74c5dbf6-0951-4c23-91d9-e9eea84eb038", "comment": "Malware payload", "value": "cb779b445a6767630b166808963241d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639933, "uuid": "519acc15-3618-41cf-a0ff-5cf20b46ea94", "comment": "Malware payload", "value": "32037cd2d4bdeee34e2193a0fb50fa1aa8cc4fbe769ba055af5cf60571a60333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639933, "uuid": "ae66c5d6-2b26-4b87-bb43-d181ef8116b9", "comment": "Malware payload", "value": "c4d757d207a956f95e874a4350f5310ff534f0f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639933, "uuid": "3d3906f7-15df-4a10-b04c-f1244e187645", "comment": "Malware payload", "value": "e27a751a8f44ecd489562e74b172d6a477733131d9b5d3f7c5faa0614ebdaf4a738dd14be1864b6d7edbd0394fada50f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639933, "uuid": "3eee3822-7d07-4060-aeed-3f4654c9f058", "value": "T174F4A282BEC9CF26F36860308972C6ED26657CF1DAD516473274612E6A37331F62A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639933, "uuid": "d42cf7ec-2648-4e12-932f-92844406ed36", "value": "b8cb43a1bc3d52ca872c18d4e0429415", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639933, "uuid": "e37794ed-30b0-4c5d-8366-93e9422d1bc4", "value": "6144:lwOTxk6LUpL+s/ICudICpXdfbQHNTvJk8wHfgB6KXfg5RT8ofq6:lZFk6YpL+7ICpXdfURlB6HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703639933, "uuid": "cf46e70c-ca9c-4368-a7de-bfeb70fa48d1", "value": 751952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703639933, "uuid": "349f913c-0943-4c15-8c1f-637efaba4ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639933, "uuid": "688d9a5e-a4de-4b39-8c97-732b5d308365", "value": "SecuriteInfo.com.AdWare.Win32.MasterKeystrokeLogger.20619.9044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7266dbf-a456-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1703640284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640284, "uuid": "7141ec78-c787-47ee-80cf-e4f96eb0e761", "comment": "Malware payload (QuasarRAT)", "value": "83ab6775cf9cc1d55bbb189854699c8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640284, "uuid": "71ddb550-3169-4157-8ddb-cd2f7735efa0", "comment": "Malware payload (QuasarRAT)", "value": "3301b53caeb2482dda0672a4f99b1032a76cb3393407a39017a4bc8e3069fd75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640284, "uuid": "f84a62ce-368c-4f01-bc72-52516bc6e5fc", "comment": "Malware payload (QuasarRAT)", "value": "018fdb1d80de9493d17a3225d242ee9fc3e6728e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640284, "uuid": "310b8af0-0f6a-43b2-aa95-513051c3cc01", "comment": "Malware payload (QuasarRAT)", "value": "7083039300f60fa7637e06db414d4c736ef8884d247dd9ebc70b9e23e246f0a66c136bd65a9ff3829bd7c221cb6c4096", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640284, "uuid": "8755cfb3-6d77-4546-bc31-670114ebe4fe", "value": "T18AE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640284, "uuid": "92a08f25-ad42-4de4-8900-111e9236fced", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640284, "uuid": "700a89c4-7035-4052-91e8-5cb3a2814be1", "value": "49152:evkt62XlaSFNWPjljiFa2RoUYIRTRJ6UbR3LoGdiTHHB72eh2NT:ev462XlaSFNWPjljiFXRoUYIRTRJ6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703640284, "uuid": "445b3b73-1ba6-4e6d-beda-a1f470602df3", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703640284, "uuid": "921bacdd-980b-465d-ae54-ffc1427833c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640284, "uuid": "ead9ae7c-2514-4762-8854-1c81f9fc7ef3", "value": "Windows Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5741200c-a4a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703674053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674053, "uuid": "dbc08e3d-1604-4477-acbd-bff221841c9a", "comment": "Malware payload", "value": "0b8368b4a2826409b502b9df00096b21", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674053, "uuid": "d132e4da-90d2-4eaa-9436-b55551ed6b2a", "comment": "Malware payload", "value": "36d4cd22f8764714393db2a16e8f1ad11144d5715d960b458cf93a18fb15e7be", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674053, "uuid": "7698dc35-9926-43f5-9741-193351ef740e", "comment": "Malware payload", "value": "101617de4aa3c316665d9bc01d65b971844c59eb", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674053, "uuid": "caf83bc5-c551-4bfd-8a92-c07540b2c313", "comment": "Malware payload", "value": "d9df221cf1a05a7f005e19a848160a4e2d54e1bbcfb5f3eb4323dead215d4d61ae50524d766dddbe6bf5ba5f3bd46981", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674053, "uuid": "2acd69a2-7bce-4a27-8e3a-2f9103850225", "value": "T159450100FA91CA67D7AAC9364CE6D2E96734FE029F55865B7748732F3C32B509A0724C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674053, "uuid": "342d065b-ba13-4aba-b3e8-e7e5afb6fab5", "value": "24576:az5GIHrYfLqEWBm8da/l+F/l9YvU25RuvctEUzf69PgTUxafL:az5GIHrYOEWBmMaN+Fd1eu8dfKKAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674053, "uuid": "3a42a246-133c-4399-bced-4800ed901d1c", "value": 1267712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674053, "uuid": "165544a3-5d89-43f9-a6ca-2269d121e5de", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674053, "uuid": "b012865c-923a-4d7f-afcb-8cc4ef467310", "value": "171223KB.XLS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53a635b-a455-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703639932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639932, "uuid": "6337f792-e632-4497-bba1-59867ac9e552", "comment": "Malware payload", "value": "591c6df8af8ea350a75dbe0977cd8ca6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639932, "uuid": "14d4dac8-aa16-4810-818f-7c83a25f2894", "comment": "Malware payload", "value": "3764a50b7d850b1e62b655e561f51ac08c0a02bffd9c695ef338259108afd740", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639932, "uuid": "b4560a55-ad69-452b-a085-1e16da7de9f5", "comment": "Malware payload", "value": "8e240be39eb282792a8dc95d099cff5a9a64e7e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639932, "uuid": "d08e1bdb-9b4c-4b8f-8330-fa2cfbce6f71", "comment": "Malware payload", "value": "469e89bec2506b8fb8c8455189acc21f17c4a486222b01a4434d81d68217eee9fd29baefaacc6b79a19f3e8e48477ac7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639932, "uuid": "6d4dad7f-bb91-4451-bfb8-f1dd288e6c33", "value": "T120A44A1ABE8AEA27C0790A34489783B5EF75AC216E51974F37587B1C2C3A344CF136E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639932, "uuid": "147c658f-93f7-4016-8305-79497586b2fa", "value": "ec1482b4d13dfed889670f7a32de4066", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639932, "uuid": "45d27d8a-eac8-44a6-a54a-beece5b933b3", "value": "6144:+W6xx/RKToSOprQoWG8vwK+VVxjyaMxaEDFrp3f:R6xx/EoSOP8vgjFCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703639932, "uuid": "19d0798f-45fa-4052-b784-1c32841947ed", "value": 451806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703639932, "uuid": "8bb028a9-6281-4d98-b744-a8526b758a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639932, "uuid": "be89eea3-225d-4fc6-b58f-5ce8050ae552", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.25670.6372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9da925a-a48b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703663132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663132, "uuid": "4151b7c8-5f8f-4b70-8e73-c9ac08b70ef8", "comment": "Malware payload (Mirai)", "value": "e957181751021f181527150928f6d8da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663132, "uuid": "38302ffe-aea9-457f-b4d1-c63a4d68abc4", "comment": "Malware payload (Mirai)", "value": "3862f155c1e2b28cfc55df40e69e80864be39d4e01f673c172e1361eb5166402", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663132, "uuid": "92536569-1284-447d-be11-be7f9082ec2b", "comment": "Malware payload (Mirai)", "value": "90bb7eec4b91aa979eec216e86314d4d83229967", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663132, "uuid": "31ee7e73-8938-4fd1-86f6-41e4f0df93a5", "comment": "Malware payload (Mirai)", "value": "aca1694f95fddba85c11d5d7f7966af654757675e2fbfb516edf44ab370c6769a8b352611b0d92752226df8e64896e9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663132, "uuid": "fbb418c8-51c7-413f-b6b4-cd1d8caae86e", "value": "T1BA732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663132, "uuid": "197a4d04-a496-4a6a-818d-958edb9e76c4", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WQ:927jqCt8v3GI/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703663132, "uuid": "571bcd22-3e47-4fee-a993-40e771ba9307", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703663132, "uuid": "e87ea7b7-b19b-4839-b19f-6eeee319152b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663132, "uuid": "408c25b4-8927-4e32-b0ea-9708fc1cf3d4", "value": "e957181751021f181527150928f6d8da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a06763-a47c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1703656575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656575, "uuid": "14bc7cbb-6004-4d0e-a74b-c9817a648509", "comment": "Malware payload (Smoke Loader)", "value": "01c376786844ddead22de9b9126280e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656575, "uuid": "f3000ec1-76f5-4fd8-9755-d2b64a7e7f30", "comment": "Malware payload (Smoke Loader)", "value": "39f7d186016fa96fbf48ae617a6c75e756fdeb9df75d8f5b573dd4ebc28ca7e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656575, "uuid": "05f27c6f-bc1f-45bf-bf65-549947abba84", "comment": "Malware payload (Smoke Loader)", "value": "adbba36d44d64b171b254c5272de3dcefd9deb2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656575, "uuid": "ccb0dc10-4276-4190-af7a-83731cc0833f", "comment": "Malware payload (Smoke Loader)", "value": "ec17e402282bbbe8e279f5b2334ce0125e3dee638eed15fb8ea6c1eac9ade3fcaa6e7969b005d1764a8ac93cfd55d730", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656575, "uuid": "a9077209-7f16-456f-91ca-19c6b241a6af", "value": "T13804BE6239F0C4BBE6F35A3549F496A06ABFB82267B981CF2314076E0F216D15E75343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656575, "uuid": "1f5bb6ed-02a4-4ff3-b801-29af13d3f183", "value": "06f98f4d929a6c5ef0fb810799afdacd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656575, "uuid": "30752bf9-adc6-469b-a3c9-9882716cf35d", "value": "3072:PoPEc9KLm7AZkhCD27xrybXFYTsOvfRfg89/d+FzmREzjLAEEMRl:wPEc9KLm7AZkhnloy9nRfgK6zmgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656575, "uuid": "acb81ad2-a652-46fe-b615-684f8b2d3dfd", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656575, "uuid": "c9f6c7d6-4da0-4921-a73c-05fb6ffc53ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656575, "uuid": "1fe5bef0-1b9c-45d8-a493-7cb2f7c6e1fa", "value": "01c376786844ddead22de9b9126280e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bff1f7-a47c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656542, "uuid": "9d94d753-a6bc-4fad-a679-70f5033102fc", "comment": "Malware payload (Mirai)", "value": "5b3aa259c5ac2c6e002281ac7b060a93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656542, "uuid": "fb92cc85-bbcf-447f-a943-b3e27b050bb9", "comment": "Malware payload (Mirai)", "value": "3cab1ca67e281647d7d6ea4b62dbea4e67eb4ad9e1b90a015399e6a660c85a91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656542, "uuid": "0cdb46b0-3f57-4325-8b31-805a2de01253", "comment": "Malware payload (Mirai)", "value": "3f0268c05d52c1064ff1cb8d424606f9c16b31d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656542, "uuid": "672ed200-f823-4c58-a5d9-764237a72fcb", "comment": "Malware payload (Mirai)", "value": "6ae1aed4151760c43d35d084116cc0773f97db29f63a1496f075af43a2b42aa0bf060ea64dd0a7fd0c31e170f84c089c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656542, "uuid": "78c40c7c-0f22-4acd-b93b-106e33b4174f", "value": "T1BDC2C044F045DE41DFEA29F42E84DADAFBE06F5EA9628E8166A452C29F1C3734305DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656542, "uuid": "f442546a-4d8d-46a1-9af6-3a867f4bcd55", "value": "768:IVdafO76jpmNJJKehmA7trpfIX9KeA7PuMy4uVcqgw09x:4am+AnKehPRa9aa4u+qgw09x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656542, "uuid": "3ccbbfd3-1a64-48f6-9ac1-731fcb7f3276", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656542, "uuid": "2b725e36-491d-4598-b732-56b30795d201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656542, "uuid": "27edd80c-7547-44fe-a48c-f69f1c55c109", "value": "5b3aa259c5ac2c6e002281ac7b060a93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f300d48-a4bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703685287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685287, "uuid": "c59c400c-8c72-4ec6-b2c8-81799bcaa325", "comment": "Malware payload", "value": "e69a5aa2bfaaf807cc067acaaa1be462", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685287, "uuid": "58f2877d-b531-4086-8777-32a4ccd12372", "comment": "Malware payload", "value": "3edadb6cb947b3e8be528a9461b7fe61722699c83051ee6e9f2c189815dd21e8", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685287, "uuid": "2936c5ed-b2da-43d8-8362-cd641a5b5d73", "comment": "Malware payload", "value": "b2190e43e1a153379fee7053dcf369cc12e635dc", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685287, "uuid": "16abfc0b-a616-4d9a-a0cf-82833c7be7bc", "comment": "Malware payload", "value": "8ebed1de91f4993528e9660e5ba4abe7b278db16d7e3d834c50e7e3111d0bd4b6dd02d35af9eb32d2481264be9f4dae4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685287, "uuid": "af2f298b-7dd4-4bf8-bd7a-93451db03286", "value": "T1D3050E5A6B41259EE1306A30099337A43372F94CBADCEB137EAC5B5C1F5E6E90E305C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685287, "uuid": "3c0bd18a-eeca-4ce2-a49c-d0a06974169b", "value": "96:5l7RwhTfwh0BGEJHcum4yum49um4P68tum4yum49um4C:/yW6GEVp7L7I7P6p7L7I7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703685287, "uuid": "c448cd5b-fe06-4fcb-9c01-a71f8b0362d6", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703685287, "uuid": "7ca69957-a170-4db7-beb3-1684519db71d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685287, "uuid": "a2d5a41e-b257-48e8-bce6-c16a336dcf49", "value": "z38Form-1490-3-S2-pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff465a0c-a465-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SpyNote)", "timestamp": 1703646847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646847, "uuid": "341b7bcf-4175-4572-ba7f-f5b7d1e9e718", "comment": "Malware payload (SpyNote)", "value": "2185bfd3cf80e739848fce67d57ad32e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646847, "uuid": "c02c8e6b-301f-4886-b408-91034042c3c8", "comment": "Malware payload (SpyNote)", "value": "3ff998d884cda14fed17a012c566fe04e9607889945b713ea526f3323e95e401", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646847, "uuid": "36597076-8db0-4fdc-9cf1-7637a4b053fb", "comment": "Malware payload (SpyNote)", "value": "cfe20a14288b268aa8aaaee1464d2e37a775a240", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646847, "uuid": "1b8bb806-93ee-4a06-9e63-4addfef19835", "comment": "Malware payload (SpyNote)", "value": "609a1f511eaeb3901b6d545f3a0d58f832b492739d681f2d562ff2670729d3ad3f1aafd871afcc7f0cd720f9e40097ef", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646847, "uuid": "fd9b1355-e6c1-485b-a72e-8af2c2f6fbcd", "value": "T1FB66C04BB7B1C353D4B9DABE6A5373755117EC298EA1415BF8AC322C2C331E18AD28D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646847, "uuid": "29db86b5-6216-44d5-bd71-58eb308c2d1e", "value": "24576:nkhC+7MBQqPXhuN/7WaJM/0N/7WaJ53s1Fuz3xZtwr2rGl4ghM:koS7Wa/7Wa/c1qZtw94t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703646847, "uuid": "17c01cbb-c99a-46d4-832b-8fcebb4b4ef8", "value": 6643768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703646847, "uuid": "9a9183ad-3b64-40fa-b489-8309a7f0784c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646847, "uuid": "af09b06a-d7ab-40c5-8f80-c49679ffaf3c", "value": "Google.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e30028-a4e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1703700844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703700844, "uuid": "1ef52b30-c52f-4f72-a649-e68d3ca65e2c", "comment": "Malware payload (SnakeKeylogger)", "value": "9a9333410d635839092a959d333f7006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703700844, "uuid": "b0813afb-3c42-419f-a1d5-6a54b67d0454", "comment": "Malware payload (SnakeKeylogger)", "value": "409d94e57204697832d22d8ffd248a5425b7fc95146ff0e1fe8355235e672fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703700844, "uuid": "e7b01f62-ff1b-4026-9784-c7e97f7451ad", "comment": "Malware payload (SnakeKeylogger)", "value": "51c5ee0e97dfef30820a4fd5ccadf1e156763f2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703700844, "uuid": "ad0e3a05-3bd0-4c9f-8440-3fd85cb863b4", "comment": "Malware payload (SnakeKeylogger)", "value": "b35197daf7475db8ed09861302d18b9563db4c4b3d0d3cbd1e98e371323b5b63004798915c1a3237034b1e6971c96b37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703700844, "uuid": "4db8acce-f539-4f20-9ca7-044348a1b545", "value": "T147B4E009ABD845ECCDEEC5741DFE2AAC23F6C18AC9468F1F1104B5792C6F366215E398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703700844, "uuid": "825679cf-419f-417e-a809-af39487bb984", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703700844, "uuid": "bb8e1cf8-91a2-4343-b221-aa6724c2f7ad", "value": "6144:qftBXrQwh2qszMOWGoAnfDqvARWvCgsEKPNDyFepTWDvPuAP1OM+TeFUxjkk:wtBEwh2DP7hnfDQBKgQ1eFTDBeTe5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703700844, "uuid": "38e446d7-cbaa-4b92-a2d0-92cabdd375c1", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703700844, "uuid": "9a9f5c86-be00-4a1f-b8d0-f5e2aef34c83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703700844, "uuid": "2aace99d-448b-4ba1-b72c-1d625483a8c2", "value": "SecuriteInfo.com.Win32.TrojanX-gen.830.16107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845a87ac-a4bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703685296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685296, "uuid": "beac4829-816d-4a5c-a0cf-3bea7d77f26b", "comment": "Malware payload", "value": "293bd0d2668b06072873d3d8cdd7f03c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685296, "uuid": "b5577504-3560-46b5-a300-beb0ab113998", "comment": "Malware payload", "value": "4820db304555d09180c0008995a00e27bb1159e950f08098ab7f90d9e6c2621a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685296, "uuid": "f3da826d-3efd-45d8-9498-4958e878d8e8", "comment": "Malware payload", "value": "59cc7e7a044d51908aee14202dc3a64372308bbe", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685296, "uuid": "9a564c23-758e-4e23-bcb3-dbd963b8f9ab", "comment": "Malware payload", "value": "f2eea25529b8cb30e294687412f9b011382bd57bcc517f055e877c7a4a429e3d4aece9e60caad2694fbc7d07983520de", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685296, "uuid": "d77e7197-06bd-40f3-836d-f8c3fddd1900", "value": "T105332B6C6F8479EFF47A743451EB76BC26A4F124C5C58E03307CA5255B862F13F14290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685296, "uuid": "68234327-26d7-4f45-a03a-4d41867bc7b7", "value": "24:5/losw/vl2sv0sOHWgsvisg7gZ7Yy8NrizTSD:5/e/vD62/+sj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703685296, "uuid": "1680e14f-cb49-418b-8aa7-39b3c342ccad", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703685296, "uuid": "f6c5ad47-7120-465c-adbc-b4e557f3715f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685296, "uuid": "5fd549e6-f1ff-49c2-8260-96bc1cdc0fc9", "value": "z40Form-1490-3-S1-pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2506601d-a4b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703678693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678693, "uuid": "ccbb041d-9902-4c79-a40b-6fd229849cd0", "comment": "Malware payload (AgentTesla)", "value": "771564865dcffe44c27984c9f3775d4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678693, "uuid": "66f30372-266d-459d-97b4-ecd20ed8e18e", "comment": "Malware payload (AgentTesla)", "value": "54dda76802271a993825f3143838e7b5dc4469eff17430071012d17a8c64b363", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678693, "uuid": "29d57093-c6ae-49a5-b969-7afbc16924f5", "comment": "Malware payload (AgentTesla)", "value": "121d13ef936941c44fcf47863d7d76b5a07f920a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678693, "uuid": "23c9cebe-e315-4ac8-958b-eaf683981807", "comment": "Malware payload (AgentTesla)", "value": "d920915c14474475ce0bf2f0caf219dd4a824709d7a60a3e2f86eb1ebe51c8fd3e9f4549d82f2ee106499635a8937aeb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678693, "uuid": "bc40ba25-cc81-4051-9990-44a6132f15c8", "value": "T197C423D27B1396B8D9D314EC92F28FC2B1F5683D483A5612D381F659478DEF80F1892A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678693, "uuid": "094a65dc-65a2-4e1f-89a9-c7e5ed4a93b5", "value": "12288:s6GTsZPdrNsTJdtWcTBvjqT9av+6j7er2OrxrWu58edOynV:7PdrNsTJdoQBvRv+e8r58hmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703678693, "uuid": "552c3f74-fb87-4a69-abf6-8ac6b0f07e29", "value": 568161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703678693, "uuid": "673ddd43-88d0-4e50-afbc-cfd204731f92", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678693, "uuid": "059afcc1-2406-492b-a879-3ff497e8bf8f", "value": "nPO OAU_DECQTRFA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7b0fb8-a4b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Hydra)", "timestamp": 1703679298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703679298, "uuid": "2b569668-89c7-4ebc-a83d-5c3f98dde179", "comment": "Malware payload (Hydra)", "value": "64e733110f9dce588b5ecff0a4018c25", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703679298, "uuid": "94305814-4237-4d00-9cdf-537f3debb6fb", "comment": "Malware payload (Hydra)", "value": "5621f9263ad2d69b2b2a8bbf1aa3268ba83fd8c3bb2443005072d2c0f2fe11e7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703679298, "uuid": "3c8a5914-2128-45a1-b7de-f33d0401b2dc", "comment": "Malware payload (Hydra)", "value": "e19c121635ce7fcaaa3e63322961462d7db0309e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703679298, "uuid": "e8f86d09-e000-4b5a-bea6-769b62babfea", "comment": "Malware payload (Hydra)", "value": "075d6c951ef8e13a82e38c8271b3cf73f25640f535f81c19d5aa09639941ef6b168fbe2735dfcee54732d2b263b82f57", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703679298, "uuid": "cb66546a-25b8-48da-a101-cecbbb7e83ee", "value": "T14135238A3A41DAA7DC7C41BC7EA6D0CD51623F10CF4A56873526B76C2A733C90F9E290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703679298, "uuid": "da26a87a-a1de-40d9-a71f-e00c29aa0a91", "value": "24576:LKd9Mavw3MbzCpTfM0XScS80kpW7Z+ch5LC1zEfggEjN:GxvR+pTfLXScprpQ+ch5qEDEjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703679298, "uuid": "125aec1b-02d8-48f4-8fbb-e34468a54409", "value": 1125582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703679298, "uuid": "62cf71ff-9caa-4c0b-9b4d-243dd84126b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703679298, "uuid": "b22a516a-fee5-42f3-8f5b-46281c45ef85", "value": "dl.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45acc685-a4de-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703698505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703698505, "uuid": "bf074a08-56ef-4bc2-aed5-e467b3477837", "comment": "Malware payload (RedLineStealer)", "value": "c8594c47f49fc081117a9d8c2e26054e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703698505, "uuid": "7d5def1f-ff25-49bb-9e1a-afcc46e9d3ca", "comment": "Malware payload (RedLineStealer)", "value": "5782b9f0b8ced65f3f1458eb7e6d57a8e462607e917e54e9aad8e47312808cbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703698505, "uuid": "5059d58a-7284-465c-b17d-1d850897c702", "comment": "Malware payload (RedLineStealer)", "value": "7b6c80b50b384e8e5dcc23dd6be791fb4720a3b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703698505, "uuid": "7151be9b-3029-4649-ade4-e8471878213c", "comment": "Malware payload (RedLineStealer)", "value": "37c41115410318bbd6b6e91204dc2f1ef84363b41ae37cc370c2419c5298158e3ee5d662863df51499d508050e781ee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703698505, "uuid": "f04abea6-aafd-43d9-882a-fbc7b165d106", "value": "T182051220F6C084B2E9E618341EE1B372BB7C78701B359E9B4B444E6D5F705C19A36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703698505, "uuid": "a7f20947-28fb-421e-88e0-79b4e56ccc27", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703698505, "uuid": "56425a2b-c8ed-4bea-912b-eab500b85cbd", "value": "24576:/DkUNi1EvGdWWHJwKlIX8bUv4018nsr+hCGsW:/DkUrOdWWtICY4K8lAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703698505, "uuid": "4a806b01-5775-43ff-9100-8a611075db24", "value": 843249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703698505, "uuid": "195f7a52-ad3b-4f4e-bf18-b555443b37b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703698505, "uuid": "c30a08e5-4457-4834-9ea0-dc3a884bd928", "value": "c8594c47f49fc081117a9d8c2e26054e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf7a8ba-a510-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703719911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703719911, "uuid": "55424c9e-dd8c-4c01-bcbc-8f4228c0ade8", "comment": "Malware payload", "value": "7f5d66666298f35932a3eeb3a127fb1a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703719911, "uuid": "40c54891-92ac-471a-b17c-c1b355010900", "comment": "Malware payload", "value": "57954ec0b9069cd82265d6d6dfa8da87cb5c96190ae9f7074d6f7a598fc4131c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703719911, "uuid": "14f92bb3-5278-4ccb-8514-52d6560e589d", "comment": "Malware payload", "value": "8d4b37a3baf4fed49b92fda2ce846ea3082e74f1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703719911, "uuid": "0721c8bd-60a8-40c5-b87e-b8d9da19d39b", "comment": "Malware payload", "value": "7a9691ec93272a7497dc6de4375ad9c363aca1cae0882443b87f636eb79d54b7d8315168b661698f11b6cad30539e439", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703719911, "uuid": "f00b5681-b30a-49b1-bcef-6e7e94db1af0", "value": "T1DC43D2E30E44AAE477D59B2EF65CA93937B11DBB143BEB546092D90E1312404C9EECF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703719911, "uuid": "4df7e30b-2fde-41bb-91ea-00b5df6d698e", "value": "768:nZqhxJZ184gQiB2N9H5VTO0qt7/ibub6PmY20lH0FwHYM:nZAZ18/QiENliHtqub6PWOUGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703719911, "uuid": "353b6be6-4f39-4a21-8acb-a709cde26f10", "value": 56754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703719911, "uuid": "7ba5cb11-edea-41a6-97d2-9deeba1cd7f4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703719911, "uuid": "6ed49dc0-effc-44f5-8029-acf3dfd60faa", "value": "algo.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78bcb34-a4b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1703682026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703682026, "uuid": "7c507c8e-b08f-413f-9c33-553bf1d00e1e", "comment": "Malware payload (CoinMiner)", "value": "6e86221500c9d4792e7a54bbf90680c8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703682026, "uuid": "eedcd269-24e5-4ee8-a08a-9b7425e98a07", "comment": "Malware payload (CoinMiner)", "value": "590cc44b56ccd0a67707459ba2ff9ee6da08e553b63fc4f090b1bd121453cbad", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703682026, "uuid": "7234ca38-2d2a-41ce-b6fc-7e1f17768a4c", "comment": "Malware payload (CoinMiner)", "value": "b8ed03dae69576e8042d8fdc933a9ec4c2eb088a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703682026, "uuid": "b6d7e46a-d40f-496e-9a8e-cca08be23de0", "comment": "Malware payload (CoinMiner)", "value": "8804a6f6de14e9b3cf388e2624bec9a76187ab6fc68fdd72a85361133664cc18c228725651888111b253e5c801f9ce95", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703682026, "uuid": "fb85790e-3dc6-4f7e-b943-6410cab1ba81", "value": "T1DAA5331681C5BB4FC5E6467E4709D6634DFFBC6BA8EE3151A0B610AF82B6D438813D70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703682026, "uuid": "77e4fc3b-b53f-49f7-9698-733c77fb83d4", "value": "b8d7fbc8e8d9ed529d0d2fe31995f25b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703682026, "uuid": "a618e254-a56e-4407-a1ec-b0ec957018d8", "value": "49152:BBganIlSe33qU/Gcd3B9yI0dWPJbIxSlpikcFifAkjeoT:BBx0H3aeGbI0gJbCSFfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703682026, "uuid": "1a13ce02-21a0-442b-b3dd-2f96ded37c9b", "value": 2265440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703682026, "uuid": "6e433d7d-ed5a-4531-b412-1c91238e6577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703682026, "uuid": "a3a4aae3-d12e-4231-8eaf-f480511ade0b", "value": "6e86221500c9d4792e7a54bbf90680c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af068620-a464-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703646283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646283, "uuid": "27919ca4-be91-42c3-b2cf-13b3ee3ad069", "comment": "Malware payload (RedLineStealer)", "value": "8a0e245b156029f6bc0b4a83083994ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646283, "uuid": "0911c560-0efd-413e-8eb3-504b5f80ac1f", "comment": "Malware payload (RedLineStealer)", "value": "590e301b985df9c03af090bc24779a1844d93a92cae1a5a8e1b05c3802e6234f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646283, "uuid": "75229e3c-1a9c-4905-903b-a562b8206990", "comment": "Malware payload (RedLineStealer)", "value": "f9a58d31d16c7aad059b88164c8df378772c49be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646283, "uuid": "58fcfe56-8476-4e99-a8d5-7d521c470854", "comment": "Malware payload (RedLineStealer)", "value": "e3e11b3b891c9d7d2de3087abdd8e9b58d5bb37ba3e09ca3f9633d8f7de73efcc82717e69c6eab28f9390a1f2f2c3802", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646283, "uuid": "38118fcf-a953-42fe-8be2-98a8b0cbac08", "value": "T18803D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646283, "uuid": "407af2b7-f1a5-4ac7-84e5-e4d3d3720a14", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703646283, "uuid": "b7d877ed-6648-4ad4-8ac2-c918947fc7bc", "value": 39168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703646283, "uuid": "2616e9ec-82b5-4e76-aa38-9344d04fffd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646283, "uuid": "76966bdc-cd70-4a4c-82ab-d40cdcf8c5b5", "value": "7uu2Bn48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409d3aa7-a456-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1703640085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640085, "uuid": "2347c82d-1d88-4a4c-850f-c001bd841a83", "comment": "Malware payload (QuasarRAT)", "value": "4c5a3b1fac7cf7a048c6e37557f85b84", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640085, "uuid": "eacffd75-6efe-441d-8b42-b4645e75fe7d", "comment": "Malware payload (QuasarRAT)", "value": "5e21bf63908488590a3adb6984e8238904aeec2996be107983288bfa4da34e51", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640085, "uuid": "3a188011-84df-4f40-b52a-ac6ff280d39b", "comment": "Malware payload (QuasarRAT)", "value": "3fb2a8fa9b249686c6d06c71f3e7f1c9c0985654", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640085, "uuid": "1f4af5d9-48ef-438f-bb4a-edb036c5516b", "comment": "Malware payload (QuasarRAT)", "value": "6210dd18d39b18a83bced5be1b13981e56e3a1a49bb3db182d06a0e5d44a8b1c77c7ee8d48691f8341a1887a2fe82cec", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640085, "uuid": "261e97b4-7ddb-41c4-9709-324343771303", "value": "T1A7752312DE5C2C7D07BC877CF18F0E582FA08AA36CDC69E65389589763BFE24421B464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640085, "uuid": "58e28192-3dbc-4310-9625-bbc6a5f0a7e4", "value": "24576:jQxzPzKBRG7Adi+ruyLWogiP7hu6BbChx1S10qYpp+DcsYU:jQxzP80pSVpbBpYpsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703640085, "uuid": "00d63f67-ae0c-4178-972c-2ab2adf146c3", "value": 1638688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703640085, "uuid": "fc9df2cf-46ac-4257-9719-0dfc4e95cf31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640085, "uuid": "a686e13a-0b26-46e4-97b1-cd0cdaf71515", "value": "31337.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138e39ae-a466-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SpyNote)", "timestamp": 1703646881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646881, "uuid": "6ed135f8-c383-4e4c-afbc-b0a182fca09b", "comment": "Malware payload (SpyNote)", "value": "0b92a0b3f26b58bcfbc5b02401ece603", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646881, "uuid": "1edf5239-1c68-4711-b21f-b686f0d92b61", "comment": "Malware payload (SpyNote)", "value": "5f0b5ab42b6a890f3cbe662bd0060a1c81fe9056fd3a1a8ce5d485d2fe391faa", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646881, "uuid": "ddda48c4-29c2-4032-9056-cb09706aa7fb", "comment": "Malware payload (SpyNote)", "value": "1649a994504e088a866268b9232d7375b0aaf31a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646881, "uuid": "cd9f4dfd-c135-46ec-a781-aa0422e01646", "comment": "Malware payload (SpyNote)", "value": "7e51bb39f339604a05f6a0359e5e19c628601d77d96f650691948803af9d99a854418ed3defdf40b2517f2ba07d71b2a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646881, "uuid": "23933ab1-e161-4585-aebb-d5de27607876", "value": "T178C6F14BE7407ADACCFA8775D4362620115B5C20BFB3815BA9383A7CE4F75E84F85988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646881, "uuid": "12ca3d65-4951-48f4-acf9-601aeba79af6", "value": "196608:9zExZE1ghLt0OfAbeV/eSu/WALr3vVU36k0tynckd41jg2x5MonkcHvZrGSR:2Zigh50Ol2SKP32KAcfg25hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703646881, "uuid": "1a3eb0eb-6563-43d9-a472-6451ce680250", "value": 11736468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703646881, "uuid": "fd45878e-6c77-447b-9c1d-87c94ce21abe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646881, "uuid": "e5299763-b0f5-465c-b409-1c67a230333c", "value": "Kaspersky-Antivirus.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4437721-a464-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703646265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646265, "uuid": "a8f9599d-e819-4126-a29f-8bb8d524af05", "comment": "Malware payload (RiseProStealer)", "value": "c2111e61e7ba399ef043c265c4215de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646265, "uuid": "c0835f0e-ba21-4a72-bfa4-aa4d01945b0c", "comment": "Malware payload (RiseProStealer)", "value": "606bc55fad2b4b1ec117c8df11571f153ac95736e6fcfa8dd8874d88eaa1a48b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646265, "uuid": "230969bd-bacc-4458-8e01-317877190fb7", "comment": "Malware payload (RiseProStealer)", "value": "a7c1289cf1e2ae758d8c1ef409a9b4b8a468da1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703646265, "uuid": "ce3f241a-cad4-455e-bb57-dba41b47134e", "comment": "Malware payload (RiseProStealer)", "value": "486de28a9e44a740cfc8cf43c7ffb4420c4e088de0e12914e360169cfced2fea23e6cf455b3ceca4a82e08493f711a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646265, "uuid": "cc0a7591-e011-4984-b0e5-12461b60f865", "value": "T15F6533FB90D14879F155BF7C0DF96A9096B0568390306A130D442B230E677FA6DB2A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646265, "uuid": "bf105d22-1773-45de-bc80-f954560c3685", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646265, "uuid": "0ca4d634-01f4-4c2c-a733-9dad7b70e49e", "value": "24576:CDbFcjYvZFMgVVyEl1/g9rmqezyyVgTN9OVPuSWb4gchWQuUZj+:CPFcjYvZ2cVNNtqFySTCVPl+bcAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703646265, "uuid": "d1e95890-775d-4f6e-adc6-221cd3395612", "value": 1526272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703646265, "uuid": "a0c3b3ca-a084-45b4-ac73-ae74fbc4b8bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703646265, "uuid": "2b10c505-01e6-4fef-b1e4-8160c721a202", "value": "4qL162Qw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1052932-a475-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1703653695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703653695, "uuid": "a6382217-5ff2-4f2c-bb0f-d2565e4d4c84", "comment": "Malware payload (Smoke Loader)", "value": "94c9c928366193a7f9412d550e20f6bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703653695, "uuid": "dc7efa59-071f-4d39-b87b-4ff5b1e1414c", "comment": "Malware payload (Smoke Loader)", "value": "63b91b11bd0c8e3e659232e5eae8e369a9070da6c4ebb15fe8165f0f124e3e18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703653695, "uuid": "14172021-fd3e-43c3-8ae0-692cad026038", "comment": "Malware payload (Smoke Loader)", "value": "fb3a9476882c1802741032b12f34bab555bd1b73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703653695, "uuid": "ab3a66c1-b8fe-4483-8c11-088d15822ab0", "comment": "Malware payload (Smoke Loader)", "value": "98be7a15dba36f48738a4769ac7993440d87654f6db6e3a6ee20e812d9a06f0fff4e1acb09de0a1425163844dd178be3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703653695, "uuid": "e8164e3a-453d-4b06-9945-5090db33f341", "value": "T187548D2136E0EC32E1E319358A34C7B50E7BB8766835998FABD02B795E307D1DA25707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703653695, "uuid": "4535454c-b84d-4145-9f3b-273ff877615b", "value": "c89cd92ac8dbdacf8b4528a8c3d9cec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703653695, "uuid": "87435304-e31b-466b-a3ad-911fabaa344f", "value": "6144:UqFTLy4LLr246ylXxa7EOByo4FfsP0O1Kl:UqdLyeX246AXxX2yo4w0Ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703653695, "uuid": "f5268ca2-3fae-4462-8f0e-e041c016cf7a", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703653695, "uuid": "3f88a3d2-285d-48af-a31f-e66cf1e39e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703653695, "uuid": "cfd55222-8ffd-419b-8d85-701ec96b14aa", "value": "94c9c928366193a7f9412d550e20f6bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963a726d-a460-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703644523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703644523, "uuid": "8306ce0c-d6d5-4b70-88b1-7b50d5872fcf", "comment": "Malware payload (RiseProStealer)", "value": "62b4482d4455d774b035764e18b013e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703644523, "uuid": "cc12fb09-8d40-4201-9a7d-deecf9a72be3", "comment": "Malware payload (RiseProStealer)", "value": "661d34fb7c075a8f527343b6fb0623fa2d89d377ab0f075e25d495ba4f464477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703644523, "uuid": "7188aa2e-abb1-401f-af79-8ed7dcd400b3", "comment": "Malware payload (RiseProStealer)", "value": "867b1cb7f3a9ecb8925dcc8fae510a073eb5dbec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703644523, "uuid": "daf16f66-9a42-4acb-ba27-689b363982ed", "comment": "Malware payload (RiseProStealer)", "value": "7db030f12e1aadc418f17ffe7823cf5047206d07d47934b3bafde85a7484bbd50bc2f3432e94a7be64f9c8570959f8e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703644523, "uuid": "69c26e51-df9c-497a-b063-a9af916d58f5", "value": "T120548D2176E0EC32E1E319358634C7F51A7B78726835998FABD02BB94E207D1EA25707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703644523, "uuid": "de2cb9b2-e3e7-4bd9-9eaf-d0d21ff4ae3a", "value": "1a755a7760c13e9f9910148d88732e21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703644523, "uuid": "1aa6a74a-fa79-458b-98f6-02915e56b2d6", "value": "3072:sVW0wwySOUP/LAZUWu6Vu5Jij+FoPv50xbGDlGlqEVi7rfm/XUgCRskbhxPfB5Se:UWeySOO/LAwau8+6NGlor+XVhkbhIKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703644523, "uuid": "3bbeecfb-820e-4ba3-9188-1df387132c9c", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703644523, "uuid": "857e66e6-cf15-4c52-9dec-0b2341aa77c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703644523, "uuid": "38da5fb0-e55e-4ca8-8f48-37a481a029bf", "value": "62b4482d4455d774b035764e18b013e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52db20bf-a45b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703642263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642263, "uuid": "3b581a9b-b8b3-4afb-9f3b-e62c4444b2da", "comment": "Malware payload (Mirai)", "value": "709f06660c4dc2e50f8ab3d241b3623d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642263, "uuid": "72e8ef77-2d31-4f9c-bd9a-f891bd1e5f76", "comment": "Malware payload (Mirai)", "value": "6716538a1205f829b974d03543397dbb2f09b188b80aff82e0a2249484ec568c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642263, "uuid": "61c0cc7c-3292-499b-9740-e2bbae101781", "comment": "Malware payload (Mirai)", "value": "9283db82758187e7691e105982861e9b345bc051", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642263, "uuid": "d03aa4a7-596e-43c8-ba79-af316fdc61c8", "comment": "Malware payload (Mirai)", "value": "4b1cfc3a5fe4c61285d7fe3aee0e9fd4f45c9d5ac3e4c77e4d18331ffdc1aede1be409fb2f1b649526874106122465d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642263, "uuid": "223a7216-f77b-43b0-a064-8a1df654121f", "value": "T18A734CD9A8025E3CF95BE6BD94220F09F920231557D30F2BA5AAFDD3BD731549E02D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642263, "uuid": "e5e91b58-fc39-4b17-ac73-0220b5f356b2", "value": "768:beV8Rybk/IC0kYqyZb5KwXpTjeqFkeQPP2oUX2AvUqhud4amJsSrjPKP88gd/K8C:bv7Gqyl5KwGAZXYqwWaQrjPKE8gdS88x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703642263, "uuid": "39611192-15ff-4aea-8e69-aaa95015a400", "value": 78804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703642263, "uuid": "f980a0f6-e4e9-4085-a96b-11a99a19ef9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642263, "uuid": "6969352c-392f-4f11-8f7b-8b2a34f1aa0c", "value": "709f06660c4dc2e50f8ab3d241b3623d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412a6469-a4a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1703674445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674445, "uuid": "362f2b39-5906-477b-9d88-37af7ed05ae1", "comment": "Malware payload (Vidar)", "value": "a187125322e7072de3196b7ae5684f65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674445, "uuid": "1cfcf437-75b9-4706-88ba-6f9c8e2c8c1c", "comment": "Malware payload (Vidar)", "value": "69941676bb04f17207d351806d67e888a0b0e064624dd4b72330d81726ef31e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674445, "uuid": "ed9711a7-1217-4b52-b5f2-cfad3b87fb70", "comment": "Malware payload (Vidar)", "value": "c2563b181c8d7a84bb9a758994d4b5fe644315ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674445, "uuid": "dee4c087-7bed-43bd-ab07-40a766aae84e", "comment": "Malware payload (Vidar)", "value": "900224df89625f67e9d158e3baf2bca0fe65393f376cc3af8b1641e1b383fffe42c5d3dd6f49433a325d8371631d369a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674445, "uuid": "877f2306-d6a5-4f80-89b4-f9ee600b087d", "value": "T1FC248D1262E0AC61E9774A328E7DC6E8766FF6D14F59679B13180AEF4D701F2C232712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674445, "uuid": "c5eba6e7-61bd-4925-a306-e4a85df4101e", "value": "ea183dffdf44ba25a8bf1bd3c29672ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674445, "uuid": "8cdde6dd-c775-45d0-b92f-9b869d5d0a2a", "value": "3072:VtZmVLdxvoqyufPRY6MNALXgi1XX3JFKf+gHRtN84fo:VULjvoqy0PRY6MNGv1XpUf+QN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674445, "uuid": "f93e3752-e3d9-434d-8516-418021d698b2", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674445, "uuid": "13210ad4-29eb-490f-8859-dc93b79e70a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674445, "uuid": "2d70de23-cb87-4af7-b0ce-f0cc1d09ab28", "value": "a187125322e7072de3196b7ae5684f65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f213f38-a4fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1703712265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712265, "uuid": "7271dd96-1a15-4020-bbfa-7ad38382cfe0", "comment": "Malware payload (AsyncRAT)", "value": "28b70eb9e22d27202d89dafb391aa0eb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712265, "uuid": "bed4997e-8f64-45cb-b6c7-c730384ff4f7", "comment": "Malware payload (AsyncRAT)", "value": "6b7c518e5ffa0f2392de3d5fe66049d230195a53993a73bab8fffae3cb4e17dc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712265, "uuid": "9706943d-936b-4a74-bcef-3e15212f1a60", "comment": "Malware payload (AsyncRAT)", "value": "7d01485c7d78c7e5799c87b8441244dfed84c0af", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712265, "uuid": "2facc28a-e306-46f8-b00f-5a1d289d60e9", "comment": "Malware payload (AsyncRAT)", "value": "21e992d7f02338264734593fc56e42a68cb06664d95dab8cd4f5732bc31a0f9452c5c5d953688425a4c4736366d26cfb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712265, "uuid": "0359c9ec-046d-4f6d-91f1-b299a3c6e0fb", "value": "T15AF6337218477DBEC2A372B72929D1225F6E860CB4793D59D58361481F60A8FBC0CFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712265, "uuid": "4073c1c1-d098-469c-8bcc-b36451a825c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712265, "uuid": "921e1757-3e3b-46b5-8993-15356d9b4e0a", "value": "393216:34bT1UQ3DvfXGD1X14lTQXD4HnpoLeTT/gJyz1C:61U6L2hoQXcYaTIJyzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703712265, "uuid": "ff172a74-aea9-4134-ab1a-6c09dff91989", "value": 16185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703712265, "uuid": "ab9167d9-160f-4e5a-9bc5-c48a2d1b9676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712265, "uuid": "d8bdd046-b300-4710-9162-c27d9a658530", "value": "forcephilosophy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1444ad3-a4a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1703674177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674177, "uuid": "f1a6c5eb-0e24-4b67-8915-c613c6d62f64", "comment": "Malware payload (RemcosRAT)", "value": "1eac408f61ea7a336c934476f8597c58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674177, "uuid": "b2e7800e-e9a4-40b5-8967-174cfd8c6898", "comment": "Malware payload (RemcosRAT)", "value": "6c040340e398600d3f192f83b9cdb219171108c5d7d8ca14813fa48d326d1a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674177, "uuid": "a900e447-f8cd-452f-a6a6-5e35fa459900", "comment": "Malware payload (RemcosRAT)", "value": "336fc5bc0da79cdad2076ebb55393e3fb7456ac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674177, "uuid": "9715b179-2c48-4aa8-89f5-ee574c4218a7", "comment": "Malware payload (RemcosRAT)", "value": "b2fef8395d400a382a2c784b648b89492970e731cda1d4d85ff131ed240e291b25e521b47b590c2ab8d34a3da10d946b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674177, "uuid": "5cbfcf93-2642-4aab-81b8-65593856b538", "value": "T137A4129277874743D628253661CB592107E137FA29B3EB1C3FC67B5D2E22222EE5061E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674177, "uuid": "48f253f7-9e72-49f7-8210-6056fb3e5c4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674177, "uuid": "350d6bee-96a2-4ddd-bb1d-0d88f5420f0c", "value": "12288:wE2H7+ET2tX5zOanbtcoaagdAyar2Jc3gdFyW49ptwlSHo:52H7+y2bHhvgdAya2fFyW49pY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674177, "uuid": "738b2420-a59d-415e-901a-01825743584c", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674177, "uuid": "cf2951d9-5be0-4873-860e-a765debc0b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674177, "uuid": "25453c66-a4ed-44cd-acae-6a1a2dc2e1f5", "value": "Dekont_00924889_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a75394-a4a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adwind)", "timestamp": 1703674448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674448, "uuid": "7ed131d4-4251-4ba6-84b8-0d9c91a471f7", "comment": "Malware payload (Adwind)", "value": "f66d37265a3a2115c2810af869b9023f", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674448, "uuid": "18cd504e-a525-4bca-8798-dc3a16f3d14d", "comment": "Malware payload (Adwind)", "value": "6dc2f36af3e4103543da7c8f04b821b73e2b22698eab4312cc622f8e71270d68", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674448, "uuid": "76f71e09-25a0-4c17-953c-1d259c093445", "comment": "Malware payload (Adwind)", "value": "4a78e249e7efccf0440e4306b8650304dc6a1e8b", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674448, "uuid": "739704eb-96f3-47b1-a229-0a373d41e871", "comment": "Malware payload (Adwind)", "value": "a924c5e1a02d9316dfcbb38af6d1762fa67b69d1952309cdaa9d1d15b10c8b99bd82148ea97a1616ad850067a6b393a7", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674448, "uuid": "119f391c-4db9-456f-a466-a7d9071f56a7", "value": "T19D04133CFDD15A44C763C57DA21FB435C081C98CB8185D39036A2EB596BEE2E36B4AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674448, "uuid": "56c0d140-088d-471c-b63e-4275fbdcb3fd", "value": "3072:MeSCP+uLKYts/5ezGYqLi8hTtoNe2B7SlOgxhkEdJUEkMfqCyfP:r1dQQMi/eu7SlOgoKR5eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674448, "uuid": "849058da-8020-40bf-9f3a-cd54864fc1c1", "value": 188911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674448, "uuid": "e826d46c-1362-4c51-ad20-75ba228c59c3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674448, "uuid": "e4182190-2f4e-4b5c-84f3-b6d538fd380f", "value": "f66d37265a3a2115c2810af869b9023f.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b159cf1e-a4d8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703696109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696109, "uuid": "7da0fae5-f38a-4a28-81b4-9661f5240958", "comment": "Malware payload (RiseProStealer)", "value": "90e4f3e987b46e399ef467ab23c89885", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696109, "uuid": "4d693488-6472-4b72-9885-7bcab1f18d06", "comment": "Malware payload (RiseProStealer)", "value": "6f490f3430e51eabccc5ae73df35e0d2193da083f1760b562fa2ed7309a30490", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696109, "uuid": "22f23831-fc87-46fd-b47d-9ded2ff64b94", "comment": "Malware payload (RiseProStealer)", "value": "27f0683a0e3255a0c692c194c54652a107b6b05d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696109, "uuid": "6581b939-17a4-4f31-81da-79717c6afe7a", "comment": "Malware payload (RiseProStealer)", "value": "486bafea8458599622a81d775734606c927626bd8a615bd65c46b0e2872097c2b1b16c7b88dc0b3d635e9976e8564ef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696109, "uuid": "07e9b51c-ad6b-4959-b818-7e5d54d861d3", "value": "T112D5330266F87472CCE82B758CFA07431B3E79F0975C265BB6A9FE690971E801434B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696109, "uuid": "e165b334-5480-4034-90b2-8054f9e2a1ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696109, "uuid": "ddaf9875-db12-4669-8373-fa0dc9f9dbef", "value": "49152:R0NS01ZhiEMVPvhexiU8N0h4+7w++4ESKyytXsglDvyTKfQT:ibhiEMVPvheFM0mfqBKyusgl7yT+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703696109, "uuid": "122a0c03-534d-4dbc-b710-c9084d53e3ac", "value": 2762240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703696109, "uuid": "deb243d6-b36c-4b52-b165-f4246623fc4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696109, "uuid": "df860c67-ee8c-44cf-b555-f690e165319e", "value": "90e4f3e987b46e399ef467ab23c89885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c766c6-a45b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703642236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642236, "uuid": "88ad47c8-3854-4e37-8c9e-e263bab89168", "comment": "Malware payload (Mirai)", "value": "f44e2c6be2672136fecc438e4581c838", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642236, "uuid": "5d53bb74-2aa7-422e-be5c-a109ce989ade", "comment": "Malware payload (Mirai)", "value": "6f4b59299aa23342a3389352ae43752f7c7ddaa0271e144ae44d40f4c143326b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642236, "uuid": "6352d07c-2ee9-4a7f-969a-5c1868178f28", "comment": "Malware payload (Mirai)", "value": "2be3b4be3d67f3bfdaa80d6010871a934acf3067", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642236, "uuid": "65f42ff9-307b-487d-b46a-c8056e891625", "comment": "Malware payload (Mirai)", "value": "d20b98bd8b7c54d38d1b0adc0c36992665bf76cb3a74ff8c465e60539329f1fa23b8af468049b0abf8030e35cb57a5e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642236, "uuid": "150ca627-9c08-40b3-9992-50b78f5ae7f6", "value": "T1C883F79278C29A16C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F0DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642236, "uuid": "2166a12a-3963-433e-8767-0c3b1a9a1b1a", "value": "1536:MsCvlPf6NDyL9Jb0+pHXlzPhha0xT45An6ahWNr9UKW5fnHM35XzC:MsCvlPCuTxCAn1hiXWO3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703642236, "uuid": "dd3310fd-e140-46f0-81ac-985006ba7feb", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703642236, "uuid": "e1394866-01f7-44be-943e-a197a02b6d87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642236, "uuid": "7f08c26e-53e9-4827-b915-9ed61891790d", "value": "f44e2c6be2672136fecc438e4581c838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f181154b-a48b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703663145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663145, "uuid": "ea36debb-0cfa-4d36-b409-54bc5a2bf2ae", "comment": "Malware payload (Mirai)", "value": "c8748a08736797fa2f41a6e3ac5a2603", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663145, "uuid": "63492fd8-424e-4906-aa9f-ccdedd4567b5", "comment": "Malware payload (Mirai)", "value": "7336e56bb174b353b12be79e279cbc2af444a83612dd6c501d8e4742cbabb6c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663145, "uuid": "31e5c15a-7dc6-4ef8-8e24-d55968756a81", "comment": "Malware payload (Mirai)", "value": "a921248c40cc33d41d5b23a9684b0f0e5500d82c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663145, "uuid": "36141e27-8a73-4bdd-a7d4-97aea641ef6f", "comment": "Malware payload (Mirai)", "value": "6fff21eb63ab7385321781fd2ef54803160d96cf51e6abd5e9290c4757a642c3d936d23194b66bb156118796a26c0597", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663145, "uuid": "6743cdc4-736a-45fa-b6f2-f8894bbaaf44", "value": "T161D2D06EE57441C9FD4E1C3E808C3FA10E1AE581331BDB9667228C4D5B36C5BF26A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663145, "uuid": "22d1861e-2413-4872-8149-98f27a8be725", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjaz9RWGVCz0Nv1:jMYHb62x4ahQ3CfdwLjNWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703663145, "uuid": "bdac5daa-42ce-4eda-8c62-49029fa35ca8", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703663145, "uuid": "8e4ea7ac-001f-4d1c-bece-a6985d0cdb2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663145, "uuid": "fcdb0db6-3310-43e7-8a62-adba553c3f9a", "value": "c8748a08736797fa2f41a6e3ac5a2603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b63b5c-a47c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656572, "uuid": "be86a904-e2e3-48a2-909e-a3250d006fbf", "comment": "Malware payload (Mirai)", "value": "f7f586e1a809db6b18fefbaedfb0bc58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656572, "uuid": "70a356df-85bc-448d-bcbc-276f405195a1", "comment": "Malware payload (Mirai)", "value": "736098e0b614718c1fa87c8f396cab142a3d9280bb2998348d41a342f033778f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656572, "uuid": "c0d1f923-46ff-4412-a789-af616f8ce192", "comment": "Malware payload (Mirai)", "value": "8cbc3432f884b1396fdbead1a69b03a15ab7a3b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656572, "uuid": "df12085b-e5d3-4cc8-9b2c-061f23918908", "comment": "Malware payload (Mirai)", "value": "f573fa5bd0765b11461110e9f4b7633f989674343784af1681e6b481d09018b972259c3a91d493c3393f6c227a8829b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656572, "uuid": "35a463ec-2be2-4d5c-8980-739f4d819c40", "value": "T15ED2E12CD55D7D05CA9D3EB955CE56F6398C70C0635DFA8E1B228408F617A8BBC071E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656572, "uuid": "e68eba77-f0cb-4e3d-b3cc-0d572b17148d", "value": "768:C1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNFpXJJb8WUK:CbDs06t4BEub4sU/MbUFpXJAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656572, "uuid": "fdaea32a-a94a-4b8a-ab6f-07ff747043ef", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656572, "uuid": "00629953-6ce6-43cb-bc6d-9c832edd4cd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656572, "uuid": "a9128fa6-8d10-450b-8c1d-2dcbc0f3f220", "value": "f7f586e1a809db6b18fefbaedfb0bc58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93f4b4d-a48b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703663158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663158, "uuid": "528b2980-0905-4864-a47f-f36107e09c9c", "comment": "Malware payload (Mirai)", "value": "0eca5629e9fe929ddeb8569c1d82372b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663158, "uuid": "aff554a9-415b-4765-90ec-c58b5c6d579a", "comment": "Malware payload (Mirai)", "value": "763e1b16e9e61b172cfef2d0a84069e613e706b5d91b72a7bde1199f210be30d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663158, "uuid": "aa476089-591f-4301-a1b6-869c45cfa46d", "comment": "Malware payload (Mirai)", "value": "b2cd33230f80ccb4dbd45ce2e3b6d0b3f16e9863", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663158, "uuid": "d31c6a26-9f7e-45cd-a2e1-13ada040e0a2", "comment": "Malware payload (Mirai)", "value": "fc073c985dcd88f7042ecfad6dc7f2815625ba947b036c18be9a38239a94870af3e691374709196ad0008dc33bd2ab5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663158, "uuid": "437f822e-8edf-44ae-b66a-7c05af6c9661", "value": "T182C2D193A4E98E05C87282376E1F159B21386439134DEE2A363AEBDC63464B4A175DD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663158, "uuid": "e3134434-4ee9-40c4-b99f-e91737ea610e", "value": "384:MRSx9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/LlT0:t5+Kcrb9VDJe5FLTYTlPFnz/sPzeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703663158, "uuid": "7e190e1d-6a51-4baf-9080-e0110467cef5", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703663158, "uuid": "43d6b7e8-75b0-4536-a5ec-4e12c32d5c4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663158, "uuid": "93326fba-8e7b-40fb-afd6-01535d60f64a", "value": "0eca5629e9fe929ddeb8569c1d82372b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc515e23-a45d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703643326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703643326, "uuid": "52c57a99-bc6e-40ad-ad25-3b5d7e5a5e55", "comment": "Malware payload (RedLineStealer)", "value": "48a13899c77af72e85c70e8b7750a6cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703643326, "uuid": "865f2e34-825c-41f1-98d5-b0b2f9af6448", "comment": "Malware payload (RedLineStealer)", "value": "782f86bf443f1fa483250087a4176655b46e1404d3b970e64270a0d9c9c55a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703643326, "uuid": "55e7d6e4-bd09-47fa-9a2f-9cac1a3b7892", "comment": "Malware payload (RedLineStealer)", "value": "d6663a2484eea1c487e60beb2bb3b35279d2ba5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703643326, "uuid": "ffc2957c-382f-48f1-b12a-85839835c7e1", "comment": "Malware payload (RedLineStealer)", "value": "c93f7c462a33575f2eaecaed29236a8bf449cbfcc267078aa7118b4b79da63621fd5cac8866051f92d21ab72e17e8130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703643326, "uuid": "03b54c1e-0f20-4ef4-8f8c-2ea6db235d35", "value": "T1CCA523D3E2D1583BD8B5AF7008B62AE3163978D24874975B1F12791B1D634E09E32B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703643326, "uuid": "cb6cfaa6-5382-4b27-88db-66ee1bf008f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703643326, "uuid": "108a72c2-2761-4a3e-91ee-91e6fec3fb4a", "value": "49152:/EnajpeejdfGbHoOAKdNH/KEIGuez6x7DFOAxPMfcx:H9eekMhqKoNzC/FOAxPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703643326, "uuid": "cbeb3054-d29f-48db-bea1-68ab4b497465", "value": 2118656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703643326, "uuid": "118e015e-2b6e-4e42-83cb-51f7ad4913a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703643326, "uuid": "a2f08a01-0c03-4cdc-8a3e-f4ef85dc9936", "value": "48a13899c77af72e85c70e8b7750a6cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f81b58-a45b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703642270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642270, "uuid": "0047411c-5c6b-4f16-b9cb-f7310b8bc71e", "comment": "Malware payload (Mirai)", "value": "df0a4dbd7b2b2451386019a7911f5e91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642270, "uuid": "5c1d009d-f9dc-43ee-81f0-23bfbe593a17", "comment": "Malware payload (Mirai)", "value": "7906e949a85af37e99df495b3a4b80c1baba2a9381a70ed880ddcb8cc404753c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642270, "uuid": "8df3e1e0-7d69-42fc-b7d4-77861446a11d", "comment": "Malware payload (Mirai)", "value": "2185ea4e98eaad24ac23baaefb695fac514a9885", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642270, "uuid": "8e0efc9d-a59d-43f2-9613-384fb5434b3b", "comment": "Malware payload (Mirai)", "value": "c093b73e55bf08bd689f29009de2e8431258ff8433e5602179002aaf6854c406d4a220724c9ab2412af2ff98cb151e56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642270, "uuid": "320a9c57-6858-4e2c-8323-7c0ed9980180", "value": "T1B6638E66D419AC94C4844338D4E68B792B63F808C3772DB6AED585BA4043EFCF9193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642270, "uuid": "7e5c8c0b-fb5d-420f-b184-960c45d61941", "value": "1536:Wap3r4p2SFaRRFzwtkLWAMVvQn/NzHBwuhvjj2CT6:Wg8kSsRRFzUF2wMvjj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703642270, "uuid": "88a36044-4fd2-4466-bc18-b4e7ca2c5abd", "value": 72256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703642270, "uuid": "e639443a-96da-40d7-b638-f6d7351dae79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642270, "uuid": "35fd3466-99fd-4bac-bcf4-52b561b907e6", "value": "df0a4dbd7b2b2451386019a7911f5e91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8df265e-a46f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1703651131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651131, "uuid": "7832d11d-7d71-412d-8e32-512ce97dfb66", "comment": "Malware payload (AsyncRAT)", "value": "5881be68f33622af78c1c502b2ce745e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651131, "uuid": "6760a2d8-2084-4c1c-b9ea-119575021852", "comment": "Malware payload (AsyncRAT)", "value": "79441ccc55fb23cfc741d846f439bb876d92f512a92e4a540f4994bf6135c058", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651131, "uuid": "c27bd6cc-8eea-453e-9c7d-c03be0f01750", "comment": "Malware payload (AsyncRAT)", "value": "37a754c7e563528773388e9ae9786db1d616e34e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651131, "uuid": "efc2bfb0-26b3-41e3-876d-2c8475bc580a", "comment": "Malware payload (AsyncRAT)", "value": "0368cde6c04db249c838f6e4265223cd159820e852f41198d8345e990ce8b088d002cea934e59e4866b361e36b2ff6c9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651131, "uuid": "8efb9137-7e2c-4e95-a456-09a572abf7c3", "value": "T149232A003BE98127F2BE4F78A9F26145467AB1633603D64E1CC451DB5B13FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651131, "uuid": "9f7aaef1-a5c1-4623-bc60-9aeba1ca5be1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651131, "uuid": "cecfdba2-d6a8-48f7-85d8-4100c64878c5", "value": "768:ouOKtTbjsCscWUC44CGmo2qRCDrLNztvYnP5ZPIuzjbAgX3iojPjtCRJmOBDZUc:ouOKtTbj1Xo2zxxmRWu3bnXSYjtYJmAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703651131, "uuid": "c041f42b-9cac-4b09-9965-1829dc7e0d9c", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703651131, "uuid": "bca6d6ad-12c2-404c-ac35-4e228df55356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651131, "uuid": "322dafbf-93f2-4138-8154-fb840dd2f9f2", "value": "Satan5 Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb6e067-a48b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703663139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663139, "uuid": "250c918e-bfcf-4cd4-b021-f05ec54057d7", "comment": "Malware payload (Mirai)", "value": "a1237e1ef59d7bfc4117002485b2b58d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663139, "uuid": "65640f2c-5e48-497a-9137-b3e148990fd8", "comment": "Malware payload (Mirai)", "value": "7a4f4dffeb9d2d5774f870a8a536cbbfa1ea0091f78a5b2b70bf2b2c870a930c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663139, "uuid": "dd06737a-d1aa-43b3-83f2-314219bb327f", "comment": "Malware payload (Mirai)", "value": "c09eb3523d5ec5fd021da9a949879330882bac22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663139, "uuid": "1725dc63-a989-4c5d-973a-07d08519a32b", "comment": "Malware payload (Mirai)", "value": "b63233c8db8a3973d913aa8257401d6a3fd0bdebd2df8423b64192d58b6ee6a18cf614cfd53ff42d2ed7f511d36a5256", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663139, "uuid": "3276ee8a-0aa0-41ee-b7b6-095ab64778c6", "value": "T13AC2F0A55228C471F0B4493AFEBF4103573ACEF8D6EF352A62148735E087D2696B4B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663139, "uuid": "83a56618-3950-45fa-a009-704eeda9e035", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNeJrhymdGc:byNUQUfhQllxlaH0MFjlOnGsms3UozS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703663139, "uuid": "5b84bf1f-4cea-4f91-863e-d66f3ffca7a8", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703663139, "uuid": "f2b02ea1-8f4d-4e88-9906-024a371d1e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663139, "uuid": "3dca5bfd-a19a-48d9-96a5-4705b5e22aae", "value": "a1237e1ef59d7bfc4117002485b2b58d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8d0308-a47c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656536, "uuid": "2b9e009b-28dc-4ea7-97a8-04022edd6d87", "comment": "Malware payload (Mirai)", "value": "32774153c4ffe42a80d77f3a89775c8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656536, "uuid": "e433dffd-cafa-459b-a811-c5ad53d54f36", "comment": "Malware payload (Mirai)", "value": "7b3bab5d6932bd69ba449279a0734a6ac89a4b6f6cc04d89124bcfe9f3fb8f40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656536, "uuid": "973268da-f694-4697-a55e-851213e756d4", "comment": "Malware payload (Mirai)", "value": "6a402eb5b5b4fe5d6b265436d64900623ae03b97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656536, "uuid": "cf836de9-d0c6-4959-8193-8a5aefc74c15", "comment": "Malware payload (Mirai)", "value": "4c842c43e98f3cf014634cd3623ce87c58578000ecd883bbcac445e19ac8feb15c902347abf42ccf52a5b640d21097d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656536, "uuid": "c0325dba-aabc-48ad-9728-17d2847d1305", "value": "T1F4E2F157D371A452DD782AB2F96E85CF2BBD4BACC27730E31A0556242D9B0535B3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656536, "uuid": "066e2c33-5101-4658-b836-e05a1dc9ebb9", "value": "768:koiWiO031vpAPbrVWZK3XVGxm9XmQQuN9q3UEL5IH:korm1vpALgUJzVgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656536, "uuid": "5272e61e-7860-43b4-8602-c03e9e8d7bb1", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656536, "uuid": "08706a1e-a444-4d3e-8ff8-d6a0d31db036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656536, "uuid": "f84dc2da-1f6a-45dc-9d6e-e66eaf2fbe60", "value": "32774153c4ffe42a80d77f3a89775c8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8874b43-a4a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703674189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674189, "uuid": "29fc6116-7499-4543-976c-e1bd52085f07", "comment": "Malware payload", "value": "efbe1c2eb5b4a0b25bf0d27ade940b03", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674189, "uuid": "968cce81-347b-4c16-8df9-5e39552471e4", "comment": "Malware payload", "value": "7c26b8a4f515165993dd025e48fb640d4de602582f1bc6253d87f30b85b094c6", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674189, "uuid": "d1944428-4525-41f6-b071-4134c06a400e", "comment": "Malware payload", "value": "cad44853818b6ed8b855c9bd48bb0eca59ee909c", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674189, "uuid": "4993d634-0784-4582-8324-c8e3cd934b67", "comment": "Malware payload", "value": "22ea529f3a96e032729826c092415abad785ef6e6d20c9815945f75d461bcda739f1785a767e56d9ed6ad992ceee23b8", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674189, "uuid": "7fd6989f-e922-48d7-96dd-d5fd5a268133", "value": "T149238644B055CB2AD38D56310DEFF6FAA7BB3C509E2B429B3D06B71E3CBA6048916311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674189, "uuid": "92797b93-de92-47fa-8f01-d6140950863f", "value": "768:CMK0s9AMjkYY7mwKT51YjseQMx0gMaiQvfUa+wXb3WCx0easOa:k9AOmKT51YjseQMx0gMaiQvfpXHxXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674189, "uuid": "7e088b79-b235-4b7e-a95c-d198d4596f92", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674189, "uuid": "a137f8e3-6cb4-4722-bd1c-74606d9db46d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674189, "uuid": "a54343df-e902-4681-9c05-d07adab0da33", "value": "NumeroLetras.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1a5f2b-a48b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703663107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663107, "uuid": "3bb96367-0549-49db-aedc-e86fa85c2e98", "comment": "Malware payload (Mirai)", "value": "4cc323f01d7f6fab2edac3f546a312d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663107, "uuid": "63314bf1-d50b-4322-b636-6c7714ce708f", "comment": "Malware payload (Mirai)", "value": "7e36f731eabce86618e2138b8f8d522fee5f2631c5d80e8ee16700667d253d8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663107, "uuid": "a633b8f8-85b2-4491-aea1-292ca905c25f", "comment": "Malware payload (Mirai)", "value": "ec6eb5d3879b18c3067c5666d09bdc379f77fa27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663107, "uuid": "969d3175-13e7-45f0-87b6-e7db40715119", "comment": "Malware payload (Mirai)", "value": "8e2f6e2cc9c27e54590fa78d724e23bb46ec4cd7d5b45707ea4388c3ef8826aba069fd9974b9d4e5a612ff33f557febf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663107, "uuid": "3d493db7-ff2f-4939-b62a-5f89c8185735", "value": "T181534B99F4029E3DF88FE9B984160E05B93023D212931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663107, "uuid": "6240ed03-7fa6-4df8-9243-573681f1e46b", "value": "768:me4gpsM204GEkRbj3eXmonQiuQttd3gFHy1eu48B8vB6J7EzNfXQuJpozME36w:mo3EkRbrdDiDaFy1X48B2SEzNfAuJKqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703663107, "uuid": "fbd3beba-dfe3-445f-9040-46436ffedfdc", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703663107, "uuid": "0e7c1d29-8811-4ce7-ac20-4d2b3aad6547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663107, "uuid": "257f1298-c3f5-4934-baaf-48bb5c3f12aa", "value": "4cc323f01d7f6fab2edac3f546a312d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9faef4d9-a470-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1703651411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651411, "uuid": "45c7811a-7f34-4715-8475-e8a981989e0a", "comment": "Malware payload (Stop)", "value": "ef7fb8e5c9ad45e5a5fbc088f2d0b35d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651411, "uuid": "287bfa12-c482-4a32-9917-16e5030de656", "comment": "Malware payload (Stop)", "value": "7f0c0a7c06251229a384eb10fb50e69b7ff5aa85ad138de70a5525882f95a695", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651411, "uuid": "ffabf2f6-1449-40be-8c52-01c9876b6370", "comment": "Malware payload (Stop)", "value": "012722084ce557ba358dcedb1d5c6ff724de0d04", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651411, "uuid": "3545c729-cd4a-42c4-a7c3-15977860daa5", "comment": "Malware payload (Stop)", "value": "092093b4cb8230aafd85e8b4991247f85ed12a8852efe57b2e341d474b9c106323c26a401b3d58e1881f48f483d8d338", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651411, "uuid": "11a14b30-6150-4447-bb22-135f31b220a1", "value": "T19045AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651411, "uuid": "74145a28-f609-495c-abae-e4351c0e7f6c", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8dWQHUq7:F0dwAYZt6C31WeTVRPOhd7Uq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703651411, "uuid": "cc67bb41-4d83-48be-a1b1-c679b1027b2c", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703651411, "uuid": "3a2e7dfd-f7f9-4710-896a-437a14ecd22d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651411, "uuid": "cf83e118-10b9-482e-8ee8-c1352ec19d50", "value": "FJD64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89adb28b-a47c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703656528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656528, "uuid": "aedac985-4398-4d74-967b-fab26938de0f", "comment": "Malware payload (Stealc)", "value": "a2e34d5b194a4fe390c0af184a51b4b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656528, "uuid": "b2256183-5226-436b-b183-387984209813", "comment": "Malware payload (Stealc)", "value": "7f60782c01aa624be6cd210afd00ec3a566c2efbffc659e9cf524ad01114343b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656528, "uuid": "01477b53-c357-4093-9ec2-4eafeaaf58e1", "comment": "Malware payload (Stealc)", "value": "0ccfc18397730e8ecf67e483155dd6a852ffdb6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656528, "uuid": "9e3c2016-ff14-4e98-bdc0-78183b2d3507", "comment": "Malware payload (Stealc)", "value": "e0dc2666802cfad4c1963402941a8502d82efe5a438c23e2ea55882c03a363d99c834ba66b4dd57686c00dc05b16677f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656528, "uuid": "d6e8f830-9d08-441f-a4f2-94389a3098e6", "value": "T18B548C3172E1DC32E2E31975CA34C7F54E7BB8766835958FABE02A794E213D1E624306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656528, "uuid": "11c17d09-db0b-4d1d-91bd-4e67142085da", "value": "c89cd92ac8dbdacf8b4528a8c3d9cec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656528, "uuid": "f0390c92-7026-46f1-bdf3-8a6b01e58e65", "value": "6144:prJFSbC47LLWI6iFXBA0kJ80UMU1TybPEw05Kl:prJ4bCuXWI6wXBUdE5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656528, "uuid": "e9505f93-0fbe-4c75-ad49-6f892d730671", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656528, "uuid": "2829ec8b-2cf1-4819-a2b3-b3079da5f7bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656528, "uuid": "40e16f0e-c9ef-4859-8802-cc8b0e8de5c2", "value": "a2e34d5b194a4fe390c0af184a51b4b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7530ee76-a457-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703640603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640603, "uuid": "9c152510-1644-405d-b078-7d20fe118d8c", "comment": "Malware payload", "value": "98a39f6a7e98362d2c115c710f1554b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640603, "uuid": "5c2cea50-5cc8-46cb-b9b0-630bd9c49c01", "comment": "Malware payload", "value": "7fedb1ac0a52533ec1013f08648fb630556232f5160fd5330f6acb8388768efd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640603, "uuid": "639c2c9b-a692-4f17-9883-74072034cc27", "comment": "Malware payload", "value": "1b815918df538c07c0acfafcdbc4265062539a2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640603, "uuid": "43dc5b33-6555-44da-b48a-e37df888f880", "comment": "Malware payload", "value": "f105d43c5390b923af23161dbdb76456207194529f63b25d68277eb8b674885b2e09649f8e95ba55618d9e8fe2fb9610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640603, "uuid": "720164dd-6ce1-4c59-8744-4c18cfb34778", "value": "T176C633C672C201A2E226CBB4970CBF7E70647FA55D29AEA637DD5400CF37429A67C817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640603, "uuid": "6f60b90f-cf27-433d-ad83-e7850f648e39", "value": "ccac04ec44fc7d0b08134bd75e436ac5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640603, "uuid": "37e2311f-572c-4da3-850b-1215dc30ecaa", "value": "196608:SIeLrTHbLBjaWCwELUzE0BCqXt4yF4qmp/MunbvEf5/gmJJP5:tm7LRazYziSnF4qGLYf5/gg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703640603, "uuid": "8d1c0398-6544-49a4-87ce-88f93c504798", "value": 11842560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703640603, "uuid": "a9488407-73fc-413b-a3d2-33ffe514bba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640603, "uuid": "a0a9cd12-6bb6-46c7-9fe6-3474689e442a", "value": "S75fDBeEFPB91wHA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5070850-a46e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RisePro)", "timestamp": 1703650615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650615, "uuid": "535a8452-729f-408f-a55d-1c689d9097c9", "comment": "Malware payload (RisePro)", "value": "76b729cabb52860da66dee89c8029c41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650615, "uuid": "61f86011-d0af-43fa-97a7-5667d4daa7f2", "comment": "Malware payload (RisePro)", "value": "83f8d129b909966c527c938be83d9c8c20903adea7cf8c2d3a251ae8982a9389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650615, "uuid": "a5384b3e-345f-40e2-953e-f49377b3ab49", "comment": "Malware payload (RisePro)", "value": "21affa5b35b83353a095f9d00f0689eb75417adf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650615, "uuid": "1430d874-3282-4a0c-b742-e3064bfe5b35", "comment": "Malware payload (RisePro)", "value": "19c5d848c6eba457f4a23c0a8c827330fbd290703561fbfb623ca127361e231b4728f414566303855dcb0aeb4eb0877c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650615, "uuid": "a7d7b577-23e3-40ce-8a76-7a9a686a3502", "value": "T10C06334787E91137C8B827B451FE1AAB22543C910871C19BBA96D7DE1CB3844BC763AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650615, "uuid": "d8187f95-42be-46ee-a65b-e4a4f5f2d8d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650615, "uuid": "7cdf4631-3cba-46f9-af52-9cf23800ad55", "value": "98304:HPGEnGIrceykTzQDPBeEK8EXyGQhgCqxgh+kidyjL:vGLIAedCeEhEXyfhgTmz6yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703650615, "uuid": "1013c6b1-ffee-45f1-9b29-1c85ef0078b2", "value": 3781120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703650615, "uuid": "e5ad852d-8872-403a-b284-0c12f3e63baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650615, "uuid": "3957aa68-f381-496d-a476-b65de0ef602b", "value": "MEXTRAXT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fd8e55-a4af-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703678619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678619, "uuid": "f7a70626-d011-4177-a5ff-e0d2f66c3a9e", "comment": "Malware payload (Formbook)", "value": "3880d927019bebe5e59b02ea6ea0f1e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678619, "uuid": "4eae5bfe-93c2-4432-bf20-823aadfea53d", "comment": "Malware payload (Formbook)", "value": "849ff9a40f9baf27f720a7fd7d4f19e749f055627abd2c2bf5f7cd0629a06ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678619, "uuid": "40214ad2-a06d-470f-a899-3657e250bb62", "comment": "Malware payload (Formbook)", "value": "9531759cf9eca23c4ee8094d24dc3d2b9da581bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678619, "uuid": "0f17d86a-33de-453b-805b-99019ce74f46", "comment": "Malware payload (Formbook)", "value": "1e19ded9c9a2730a4b6c64f6584f67519da14e1db979fb9efe2f8ae72291dd357643f54049a646c6ab7a369561728233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678619, "uuid": "ba87d4d9-c7e9-4aa6-9107-cc481ee356fa", "value": "T11505B0FD48BD12EB80ADF6A58BD98B27B054987B31116C6794C34397430AA9235F31FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678619, "uuid": "de59a1fd-ca69-40ab-a86c-9371f486eb53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678619, "uuid": "85605497-95e7-4625-b430-d7ec5500fd94", "value": "12288:XrMoA4FxNQ+YNNkeOtj2f+8V6391O/Dm/:QoxiXPOtjI21O/Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703678619, "uuid": "9406335e-2bee-4d9f-a9f0-bca610b580b5", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703678619, "uuid": "1bc4be6e-f764-4ece-bfa3-c321b761d0c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678619, "uuid": "2f513157-9991-4730-a59e-1ac6624a510b", "value": "z26PAGE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22602a5c-a4b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703678689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678689, "uuid": "5026feaf-058c-49f5-829f-b47ff3111363", "comment": "Malware payload", "value": "cb3b782f4ba56a4654f6018ffd709948", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678689, "uuid": "3b396fee-923f-4df8-9748-95b736663b4e", "comment": "Malware payload", "value": "8752073d116d46b0e2aa2ffb4357edf52a9a47c6eb22336ba619e41e21474890", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678689, "uuid": "2920ed3c-1d13-412c-aa79-625b9fbbe674", "comment": "Malware payload", "value": "3cc37131b62b2d7806547de0ee1461245d48dec0", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703678689, "uuid": "42343aee-fb0a-42ab-837f-c55e037b63ef", "comment": "Malware payload", "value": "88031ff2cbc921ab8c90ba760f764dcba69b1a561fb0189de81ca4064af1b0cd95c489f844c7c30cbf232f83a741fd8c", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678689, "uuid": "7a755698-78bb-476b-973c-aa54c94b211a", "value": "T13A45136833A85643EC7D03FD1459560997BAB01B2962D2CA3DCE31DE0FB8F85C251B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678689, "uuid": "76fdd015-1a58-4fcf-be27-44c8fd705ac6", "value": "12288:tK6momWOHSR+MSaaICgYeem6OvbVXgX/8hHVbzvzg0WOvnbp9:hb/BR+Mtz0m6QVX0Y1U0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703678689, "uuid": "66ee4d4c-5713-42ce-932e-5d77d014f3f9", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703678689, "uuid": "994d5093-a3ed-4655-89ee-83f9ddab48f4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703678689, "uuid": "5ae52257-8063-4418-b580-5715d22077e9", "value": "nInvoice_0150853.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9572b9cc-a4a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1703674157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674157, "uuid": "23fd10fc-c41c-4ef6-b19b-e69a3c717c63", "comment": "Malware payload (AveMariaRAT)", "value": "b4f19fd92c3cded5291ec851521d1203", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674157, "uuid": "dca8dccd-12b2-4c0f-8a1e-e4e9c8361f5b", "comment": "Malware payload (AveMariaRAT)", "value": "87d3aab8ae71b1b257894a033477d1c1d48c162d76086558d2f0f3080024b522", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674157, "uuid": "f201c30b-3f01-4fd9-9ec0-7fbeea7d5d34", "comment": "Malware payload (AveMariaRAT)", "value": "b4c209c49486f3c8576b7b6e1c2f5946f1265651", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674157, "uuid": "959c9f87-cc4c-4195-a126-f5405fe36bc4", "comment": "Malware payload (AveMariaRAT)", "value": "2d36b7d246e475f0ae798a70d34a1f9b2613fccbe989178173f2958c6ebbc3fe7112964c2139d6313faa338f40a2da1b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674157, "uuid": "ebb44c63-1081-4ee6-959a-4480ba477272", "value": "T10135E153F6E3BAB5F6BFC2BAC6B1D92C61B3349603B0938E774165492912351493CB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674157, "uuid": "38a5a1f5-1df5-4e65-9dff-ae5e8d4d86b0", "value": "d4c9759f791ea559bbad095fb49820d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674157, "uuid": "aa39bfbb-9205-4f11-8c7a-6e382988dd82", "value": "24576:WoOOMX17+QHT+dEhvaIrvanZpIG1mxo5wmYzoy:WoOOO+QHsdnkGgxo5Aoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674157, "uuid": "903e6706-5fad-4b6a-b476-879b4e30c858", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674157, "uuid": "b20c2dff-d220-4d68-b31b-0a4fdf70c567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674157, "uuid": "1ce66d19-4c48-4385-94a3-56ab26766a96", "value": "Comprobante_Estado_de_cuenta.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718643ab-a468-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703647898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647898, "uuid": "790f2860-9701-493d-a276-2b56df621ee8", "comment": "Malware payload (Mirai)", "value": "31a93cc1dfd6284acad8fd707823d1e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647898, "uuid": "096ac5a0-8102-41a5-9b9e-0a34373073ff", "comment": "Malware payload (Mirai)", "value": "8af303f4ee6302a3e288069d2441428c8f3bba2ed91ca1f69b3cbe7e6230fa40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647898, "uuid": "41573f5c-53af-48af-96a8-acdd8452311f", "comment": "Malware payload (Mirai)", "value": "bc30e51e16769e5044648d305a24efa9cc1007fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647898, "uuid": "0a1fffde-3152-4040-b3f3-41b5b79890c1", "comment": "Malware payload (Mirai)", "value": "4d240c47477d6493b9e14044cab1788404a335e31bf4806686312c7353e5ff6d6b02e8d085c27fb98deab7019894c1e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703647898, "uuid": "d0b72b31-ee77-4552-9eb6-cc948d552914", "value": "T1F4835C31693D2A17C1D0A47E12F74758B2E22B8E25E8CA5E7D720E0FFF50A5064136F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703647898, "uuid": "b45af66f-917e-4925-8e55-64b5e93ab46c", "value": "1536:/AYX5uNKUq1et03jRI5AnZPrqPSj/sYxJmsRE3udoScta5ZN:/pRFJDsYHjK3ud8aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703647898, "uuid": "d73d5738-ca25-4a0b-95a2-8b34dba77c98", "value": 80864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703647898, "uuid": "ad912d08-5b50-4894-8149-f7493a045913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703647898, "uuid": "e738478e-0178-43b8-a375-b344244a55fb", "value": "31a93cc1dfd6284acad8fd707823d1e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770e349e-a46e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703650484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650484, "uuid": "8eac16c6-2d57-4496-afa4-30c212fcf603", "comment": "Malware payload (RiseProStealer)", "value": "a4d97f5231b19039c60624459107e6e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650484, "uuid": "d3e6ca7e-97d7-45fe-a1d2-d8632368210c", "comment": "Malware payload (RiseProStealer)", "value": "9020efd577ed68d3a981b95cde3f6a5d10709832714e7007130ec4cd908898c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650484, "uuid": "220e90c4-e2a5-4158-bc6f-1225b47d0e00", "comment": "Malware payload (RiseProStealer)", "value": "9a50166d49d1758c7a534cfad7914876f1f61023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650484, "uuid": "2b86bae3-1bc2-413e-bea2-aeb70adafb00", "comment": "Malware payload (RiseProStealer)", "value": "6cc76ce005c43ff4dfb0d96b8f8fc17b264df259b2aa0a1c09046ddcd2869ef93126c18b0c04435ef9d29890ed71995b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650484, "uuid": "4ee43884-a7fd-4928-8065-f735f5aa3edd", "value": "T1F10523476BE89473E8F42B7498F715D30A3ABCB24978436B6B44A54F48B23C4767072E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650484, "uuid": "960ad222-b6f0-429e-98b7-451298530d82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650484, "uuid": "bf0fa59d-8758-4f83-8db9-3f732afdfe6e", "value": "24576:yyhnyk5HhvbbZuwX9DEi6o8+/pebbx1P54N:ZphSwZt6o8+/pktFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703650484, "uuid": "a63fe7eb-0c06-408f-ba30-0e446b5e69d4", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703650484, "uuid": "003fcea1-ce12-47b0-b16f-30e12cfe6139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650484, "uuid": "4f82bcc6-212b-4634-90ea-b8a5fe80b7fc", "value": "1WExtract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84eef1b5-a450-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703637622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703637622, "uuid": "c9bf0e4c-ff69-4293-8534-31b31ab08dda", "comment": "Malware payload (Stealc)", "value": "599bee563e7949a9ea4c049f3714a255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703637622, "uuid": "03295854-33de-44ea-b796-dbf774c983d2", "comment": "Malware payload (Stealc)", "value": "9129162e186b998b974d815f1887d60168afa67c6e48e464b14380163a70eddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703637622, "uuid": "e1783306-d224-4d72-b406-ade2f2a72f58", "comment": "Malware payload (Stealc)", "value": "bb985f611e26c2759f488978068648e6fe1faf20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703637622, "uuid": "18ed08fb-a698-4a24-9b41-8f5f7439c21e", "comment": "Malware payload (Stealc)", "value": "7d8fedb1b339a0a6cb0f6f8c2fc5129121f40bb36f1ac626dce5ec723c072f60abd8a5fdb632d6e6a268b6421030822d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703637622, "uuid": "9e0873ff-3cba-4cb2-b83f-b5c7b012c538", "value": "T1B9548C2176E0DC32E2E319358634C7F54E7BB8726825958FABD02B794F217D1EA29307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703637622, "uuid": "78a396f2-456b-4026-8ef4-4dc2a2e5a088", "value": "1a755a7760c13e9f9910148d88732e21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703637622, "uuid": "e753c640-6050-4744-af57-62d42ab3eb2e", "value": "3072:x8W0wACiOu/LQ5E2eqFuZJiju1Yx0Rh1WNqxHBCMk6COnwgNn7xt9B5JvLdQe6qy:eWOCiOu/LQw6u8uINohpJ57xlvKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703637622, "uuid": "932041d5-c3fc-43c8-aab6-5427995b9ceb", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703637622, "uuid": "ac642950-cc63-433d-8815-d64642a86e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703637622, "uuid": "57e19956-d694-402c-8946-329ea8146a91", "value": "599bee563e7949a9ea4c049f3714a255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7f9fcc-a4d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703693367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703693367, "uuid": "4c55f90b-fb47-433d-9b08-5b4ddca5dfdd", "comment": "Malware payload", "value": "dc4d45c2bdf0e3dbdfa2385c84ecf4ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703693367, "uuid": "f7557464-1212-4f97-a251-ac03df62864d", "comment": "Malware payload", "value": "918c9eee0e6ce5d5a6044e3ba81a6fc78e08deb2fc9bd88765d48e7aeeee7625", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703693367, "uuid": "26de9eb2-1686-4ae2-8b80-807cc98277ca", "comment": "Malware payload", "value": "3d222adc73538da2c1f73a043a073e3aa29804ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703693367, "uuid": "f9db6b5f-e246-45c8-8233-f9df13eb598d", "comment": "Malware payload", "value": "fd400409f649fac5196873ea41573846c84119fd0505d32dea2d54e0ea5aae5c7f76fc719edc05fdfce79a0ff0b363ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703693367, "uuid": "4a9c4a05-488d-45e2-be84-4779a0cc516a", "value": "T1B04633146DF1600DE993E5784E42FE2EBCB56B2610804E1ED0B863EBE473D5260F76E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703693367, "uuid": "fb6b5f38-55ee-44df-ba9c-4e9a07723695", "value": "7106f7f21b5a6e69fd7cbbc19f3ecd14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703693367, "uuid": "ab0a3d3b-ab89-458d-b536-3b0bdab32fe8", "value": "98304:3nt+cdYFxItbwkRB2SseYOd49Co9nn1TqnukXCKx5ZXfw2LJ:dskX/se1fo9n1TZknrG2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703693367, "uuid": "3861d402-d8c9-4c3e-a19a-75482f495bfc", "value": 5646176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703693367, "uuid": "9493e4a2-f3ff-4e86-8ea2-c97d5d493ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703693367, "uuid": "f3f35285-7eb8-403b-a8f8-cedd31cc55a5", "value": "dc4d45c2bdf0e3dbdfa2385c84ecf4ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9640f07-a4fa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703710805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710805, "uuid": "f8f82ecc-1a72-4581-8068-259bced1b0f9", "comment": "Malware payload (Mirai)", "value": "cb11f06cd4585b46d2e661685735d07a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710805, "uuid": "5fd498ac-acaf-491c-b02f-0ca68beab97c", "comment": "Malware payload (Mirai)", "value": "94111e84952d94cc65241768f4d5cda1b395524af6766feca01dd59b9d8a7bcc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710805, "uuid": "ce687b06-be6f-4886-afce-1d4dafe96164", "comment": "Malware payload (Mirai)", "value": "c187c07299f5a0eb396a6c7564224a434f880318", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710805, "uuid": "e77d598f-3b29-460e-a692-d8e6367cbbb2", "comment": "Malware payload (Mirai)", "value": "6087510143d6773e5e39f2a5e72977239435d778450ccefacff90ab9d7400b6347bf562377cad894c2303bea597c4d3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703710805, "uuid": "7febc7e6-0ab3-4342-9385-78cf0813a17b", "value": "T143C33B46EA818E03C4D61776BAAF42493323E754E3DB730699186FB43F86B5E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703710805, "uuid": "5a2457fa-6931-48cf-b7df-e474409cbfce", "value": "3072:Fv4D3QbzSuNWh0DkJd9OL/k9Z+2jvM/9mTg0OApJO/:14D3QbznrDkJd9k/2+2TM/9UO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703710805, "uuid": "e3add2b8-0b3a-486b-b16e-bb0c336fa466", "value": 121958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703710805, "uuid": "9911eb08-9791-4bb4-bb38-0d4c86dd913a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703710805, "uuid": "8afd07d3-1211-43a5-b306-83e77dbbd2e1", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6b861b-a4bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703685284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685284, "uuid": "fc7730ea-a8a9-4f48-b244-dae3cae88fe8", "comment": "Malware payload", "value": "34347e997a7e7a17148a3a550827d354", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685284, "uuid": "7e3824a6-e15e-4672-b4bf-0204dbdc2ab7", "comment": "Malware payload", "value": "94ece5a7d0c2fd5d90185356145b00e9ffa4f7b595ee02ae4b3771c0462c3bee", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685284, "uuid": "3f0c3bae-c830-43ba-9ff0-4e320a11b39c", "comment": "Malware payload", "value": "8429431e3eaccbffcd4f4a67971618d69374e6a3", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685284, "uuid": "c18282c1-aaa7-4ebc-b769-421505741768", "comment": "Malware payload", "value": "9461aba681ed4e1f13a34bd92fb29112eb0ac192cbe32ff86f8949828fbbd0e94517ae86d4ac4f9c3993908c107c0060", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685284, "uuid": "9352211e-077d-4ed1-991e-d0d70a9b6a65", "value": "T1C911BDBD9CD9BAEFF0338034A6DC387435D0B91099D0A80B6970D21A92068F33E853A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685284, "uuid": "d36c2303-0f74-4eb0-bac7-70b1fa45c59e", "value": "6:jYyI3w4headTereMvSzcereveYeUt3VzTvVcV3hVdStctctPHeneadqet4n:jYyz4hetSrizTSDUSSwOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703685284, "uuid": "0b535ded-d4a2-40ea-80d7-b240ac90cb94", "value": 869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703685284, "uuid": "7c47c14a-41d6-48ff-a150-22df449a3135", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685284, "uuid": "8236575e-0de2-4631-b978-f95d0ce39f23", "value": "rForm1490-3-S_pdf.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c28cd9e-a503-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703714407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703714407, "uuid": "2224fcfa-0fd9-417c-93ff-2dc6a39687c7", "comment": "Malware payload (RedLineStealer)", "value": "a1449bfe93a90aa0d874d39c89752f21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703714407, "uuid": "1c26167d-04a5-4065-99c1-8a8baa044535", "comment": "Malware payload (RedLineStealer)", "value": "96b498423163369457a75d8749ca599c761a6cdc413bcc20fe42888e9d636435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703714407, "uuid": "9e65d969-50ad-4c47-b20a-980c48991f6c", "comment": "Malware payload (RedLineStealer)", "value": "f687364a49742c6f3236a59ed71e74dd3bf6f20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703714407, "uuid": "486b66b7-fb44-4f90-97cd-a3b2f40bb783", "comment": "Malware payload (RedLineStealer)", "value": "8ebd99e1195a20d46165cdf911a779d7ba5216ceb9d5d0e97cde7cab55073b67ef6f796c4f152e60999ff95a4078b475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703714407, "uuid": "295657f5-817f-4ebd-908a-c4e755487179", "value": "T1BC03D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703714407, "uuid": "34151b16-826c-49bf-b94b-7911d9d7196a", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703714407, "uuid": "51e3d60b-611e-4b01-aace-4347efaecf4f", "value": 38959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703714407, "uuid": "f800b55d-62da-42fd-be1a-a3fe960d4447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703714407, "uuid": "b249d227-5ef8-413c-89da-c3a4f19777d3", "value": "a1449bfe93a90aa0d874d39c89752f21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc7788f-a4ce-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703691536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703691536, "uuid": "8f73a384-193e-4327-9076-29e85f70ea43", "comment": "Malware payload", "value": "6f0e4841bf0940b293f43455de4e08ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703691536, "uuid": "9a6a1715-a1a8-4365-ad66-9c6580ede865", "comment": "Malware payload", "value": "98df535576faab0405a2eabcd1aac2c827a750d6d4c3d76a716c24353bedf0b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703691536, "uuid": "e9cfadfb-8429-4008-822b-7406694082ed", "comment": "Malware payload", "value": "1e2cd23fa83a420d1239ec7c9015b6a04bc22e10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703691536, "uuid": "e221b50b-ab23-4260-91c0-bea3c536a492", "comment": "Malware payload", "value": "e31fc448c090bd35bd8b21c7f50c03d3ce8d451832b60d91bee1a0e18aefa21828da54e3370770c1d88b1c1616d11175", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703691536, "uuid": "9ec2fe7a-c50e-4a7b-826f-49902cc03a1f", "value": "T1BEF62A03F8D510D4C4E9D1B48A214262B9707C6C0B7933DB6B65F7B82B327E49EBA791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703691536, "uuid": "ffb48463-06f0-4db2-b7b7-84c2022c967c", "value": "98304:WiXVx6d85wIF0t4V2rq2ivFYMlPws/+GknMnup8esbUEFTViSrh:WiXVxHdFWivFnlPws/+GKMnup8btTrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703691536, "uuid": "863e804a-ddb1-42f5-8728-10b9744f52e2", "value": 15376384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703691536, "uuid": "7d6d2bfc-f8c1-4c07-a863-444c7e5e8b7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703691536, "uuid": "b82260a5-bf5a-4565-8f01-e7d53357928e", "value": "SOLID_CONTRACT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6940d3-a468-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703647891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647891, "uuid": "ed82f193-5e2d-4fb6-befa-31a533ebdd47", "comment": "Malware payload (Mirai)", "value": "15fcac08dd4ad0e10f597a0cc24016bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647891, "uuid": "597d310a-a550-4dd1-9111-d2b47f3e0f7d", "comment": "Malware payload (Mirai)", "value": "9988af7e8bbb91c321f25b42962ee1362ee6464612e27dde2e60ced6c84de478", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647891, "uuid": "1fdf1f64-18fe-444b-b964-33565fefa7ac", "comment": "Malware payload (Mirai)", "value": "11ef8a8f15878a0b03de79281356da8f13c7e094", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647891, "uuid": "dcef9a24-f198-4ee9-8fd9-e48858e8860b", "comment": "Malware payload (Mirai)", "value": "a33f4151e659dc68aa29a0420c29dd846b337a8571adaac1056ed43b51c202b3fef2a8319f0cc86026a85b69f31c6efa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703647891, "uuid": "3ffe405e-6ba1-48b8-ab00-fb413b80d874", "value": "T129A3C616BF350FF7E8ABCC3719A51705198C650A22F97B35BA34D818F64B25F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703647891, "uuid": "1651b2de-09d9-4f8d-aa82-c5ee373384fd", "value": "1536:RvMKs9oRHbfZT7EQYEWi6lCv+Ge1Cs2ooKfALVZPpzKAB:RvMKs9oRHbfJ7fWFls+rVILV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703647891, "uuid": "64c7dd85-0594-4aa4-baff-fb7463aea5d1", "value": 105116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703647891, "uuid": "9cddb695-2a2f-492e-978c-811f22309f35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703647891, "uuid": "cd756052-3ead-44fb-a8f7-4a365174df04", "value": "15fcac08dd4ad0e10f597a0cc24016bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab9e142-a490-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1703664959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703664959, "uuid": "e5979244-ce08-4f64-ac23-3cba761e8885", "comment": "Malware payload (Smoke Loader)", "value": "bcff3a426e95806c82b960e80bc7e4cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703664959, "uuid": "38e3c4a0-7938-4c84-9208-b2494b5109d2", "comment": "Malware payload (Smoke Loader)", "value": "9ad2bc67f0a6f5d8cb810461cc3ea25bd5f118ca0c34466451f239a5a3f058e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703664959, "uuid": "1cd92412-243b-4f48-9f2c-f0248f24f29a", "comment": "Malware payload (Smoke Loader)", "value": "29747cc77a599df317c8e7dc37ece8c12531ab19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703664959, "uuid": "d7ed583b-8ab9-4c07-b359-10589271ee26", "comment": "Malware payload (Smoke Loader)", "value": "b68834b148a405247ae46da7ad0560f6580b9c251c8a22ce91db1ffdaa9fd35352b839bf8c66027a7478602d4c9c020e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703664959, "uuid": "b81c1ae7-3874-4982-810e-b589801522f0", "value": "T15304BF2279F180B7E6B7167158F4A6AC693FB8226B7580CB2358036E1F323D15A3535F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703664959, "uuid": "924b9ae4-cae3-4bbf-aaeb-cce39f22a71e", "value": "06f98f4d929a6c5ef0fb810799afdacd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703664959, "uuid": "ea30f457-e44a-4b55-ac12-df535e5e2b50", "value": "3072:MoP7c9KLr7AN0alEDob/vzo0nW5iCLhdcSLLAEEo60l:/P7c9KLr7A78obk08ig3d76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703664959, "uuid": "106771f6-6172-4f86-83d9-88f0e4d4c294", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703664959, "uuid": "51aee580-ce8e-49d1-bfac-c184f5cb3285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703664959, "uuid": "a6af2b15-51cb-4de6-b9bc-c54c0bf845cc", "value": "bcff3a426e95806c82b960e80bc7e4cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5d2287-a456-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703640024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640024, "uuid": "6ca29236-fe4e-4343-8623-47b0b2c2eca3", "comment": "Malware payload (Socks5Systemz)", "value": "f5d97d7ef43e1acf5df20fde40a068f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640024, "uuid": "83de8624-68be-4709-a254-d3e6ebcbefbf", "comment": "Malware payload (Socks5Systemz)", "value": "9e330c6bd0976028c8c3ea76445357f181ac1003a2c05fec354e630fe4e225f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640024, "uuid": "852aa730-862f-48b2-b56d-f939be28b44a", "comment": "Malware payload (Socks5Systemz)", "value": "e31fa6cbcb440a1489a080a68f596b49f7a972a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640024, "uuid": "23975e6b-74e6-41ea-8c90-5d47edd785ef", "comment": "Malware payload (Socks5Systemz)", "value": "670056a05575f68eea5b4d7858f51cf8078d39c247d6393f69b60a800a8535941e0ff69b555886cfd65872fc42428a77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640024, "uuid": "3dbcaec6-0f6e-4ce4-8f9e-ee9a838f56ae", "value": "T18F548D2136E0EC32E2E319758634C7F54A7B78726835998FABD02B794F207D1EA25707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640024, "uuid": "d9204a8c-1d4d-4ab5-838f-764369f00457", "value": "1a755a7760c13e9f9910148d88732e21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640024, "uuid": "dfbe47b6-5a40-406d-ae2d-7d34d9f8696a", "value": "6144:5WeySOO/LAwau8+6mAAl0EW++lT6hbhATFKl:59ySOW6J+8weEhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703640024, "uuid": "43664cd2-11fa-4f8f-be6a-92b5330790f7", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703640024, "uuid": "05a3c305-b2da-4ce9-953a-b767d2058257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640024, "uuid": "9b32da7f-9fdb-48ac-acaf-12690cc377ab", "value": "f5d97d7ef43e1acf5df20fde40a068f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a301b8f4-a4a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1703674180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674180, "uuid": "7b78118b-59b7-44cf-9ae5-018b04481c02", "comment": "Malware payload (RemcosRAT)", "value": "6158e12a373856931a3fd880211fbf14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674180, "uuid": "967f7f9a-44a4-47e8-a6c8-0281a90541db", "comment": "Malware payload (RemcosRAT)", "value": "a1d31e78ec31ebd8728ff0a689bb396b93781f8cb548cac639019531db2adb36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674180, "uuid": "fc833fb9-87fc-4188-95d5-d476570de946", "comment": "Malware payload (RemcosRAT)", "value": "fb53e1a830ac8b8d32afe1c59a1d5665af3c89ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674180, "uuid": "9b37475e-6b49-499c-82b6-4daea9c5cdbb", "comment": "Malware payload (RemcosRAT)", "value": "42c247caa6d5b1fa7579356b410927c13b37fea721173823a0dbc5ab5a772926fed0e4c41ffcbddc5bb87cda27670213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674180, "uuid": "6c118881-5640-496c-9c53-086049b77294", "value": "T1FFA4124173CB4391D8AC253192FB062603F22FC766B3B62A3E84769D0A53763F995D8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674180, "uuid": "940214cb-6a8c-41b6-a2b7-ec966198cfb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674180, "uuid": "66e1028b-eedd-445b-a78b-a1d7be5643c8", "value": "12288:gzcmj4lUTOzLsNg8vth6+nvEthM42vsw5b12uQ/7i1OK:O4lUTO8Nc+nOhMdvVgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674180, "uuid": "bd734dea-d00d-4198-b20f-e725b8d7c752", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674180, "uuid": "a96c43d1-d92b-4c2a-8401-a0144df3fab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674180, "uuid": "13868b7d-e68f-4a57-800f-ed2d072b9250", "value": "dekont_0092488_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a7cde4-a457-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703640623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640623, "uuid": "632ca6c6-bb37-4073-9ac0-b61e4ed4a870", "comment": "Malware payload (Stealc)", "value": "4c0909d04ca5728eb87e4c32da96c370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640623, "uuid": "70f1cb4f-3066-4667-bdbd-0b93538b7061", "comment": "Malware payload (Stealc)", "value": "a382fcb32db74d131d42ba5eed28589e66b44a873cddd1503489f128b05bb43f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640623, "uuid": "e2e0e9ac-3cc3-46df-8811-238b8d83a2b7", "comment": "Malware payload (Stealc)", "value": "f05d8848dea30383de7d22c5ccdf8dbabcce5e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640623, "uuid": "fa119729-86c3-4853-acfd-c77e9538b7b7", "comment": "Malware payload (Stealc)", "value": "47f0ded2f5f8d8e5eed248619cc5127019434a4aa38874aba12b7262392ccd62ebede71e7efb187d4372bd2f926744e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640623, "uuid": "92a3d169-2925-43e1-9813-9283cee58407", "value": "T102548C3172E0DC32E2E31935CA34C7F50E7BB8766935958FABE01A795E613D1EA24306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640623, "uuid": "d747e580-3653-4052-8b0a-9462fff34f31", "value": "c89cd92ac8dbdacf8b4528a8c3d9cec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640623, "uuid": "00b2620b-aaee-4009-bf8e-b467ce414b5d", "value": "6144:yWJFTbC47LLWI6iFXBsuRhFo/MPzVANPEaDqKl:yWJ9bCuXWI6wXBsUjT4EWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703640623, "uuid": "f41d734d-1816-4cd3-8ba6-6db1a6eff425", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703640623, "uuid": "64f4c08e-d08b-4c17-a189-abc517ccd09b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640623, "uuid": "c9972736-8511-493b-bb48-79349a133b70", "value": "4c0909d04ca5728eb87e4c32da96c370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee0e19d-a46e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703650363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650363, "uuid": "6f24f049-5fd7-416b-aa0c-69d54c1d7ecf", "comment": "Malware payload (RiseProStealer)", "value": "c55d4300dbbbe4fc2f5f18e8dbb75aa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650363, "uuid": "82772599-7cb7-4195-b046-3f1b51221c62", "comment": "Malware payload (RiseProStealer)", "value": "ac29d8bda9ae1b4a0ac054f7cbc9ef6475343d1d74e13b88b85958beb7ec8a48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650363, "uuid": "f7edf764-d120-41ff-9de2-0547e822c351", "comment": "Malware payload (RiseProStealer)", "value": "4226b07f8cf45eaf8639e7e222fc7b482ed04181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650363, "uuid": "56882687-59d4-4312-aab4-40315de9962f", "comment": "Malware payload (RiseProStealer)", "value": "5c6bcbbbaa9eef5ea5ae61afe178820a38085b6bb6d5b003ff7ceabbcb28845f3b2b3d4ff6b868cbbfe84aa1a972a918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650363, "uuid": "aadd46f5-8d76-4b4b-b6d1-cdca6354c289", "value": "T170A523D2E2D2957BC4B56F740CF22BE312387C924934971B1F61B81B59635E09E32B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650363, "uuid": "3a1c47dd-ad62-4efa-928b-e7edab810590", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650363, "uuid": "0f60b26c-2d5e-4088-b7ae-2e12a1593b30", "value": "49152:n6E3UQ5aejlPmBlO8iKfZH/msJBueVsxX8QOqxTsfp:6E3paeYS/em4NVcMQOqxTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703650363, "uuid": "c975baad-f22c-469b-afd9-60caa9016bad", "value": 2118656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703650363, "uuid": "39a44738-737f-4121-b0e6-2792ea449834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650363, "uuid": "51a71854-45ac-4433-ad70-8ba62925724d", "value": "WEXTRACTMUI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea72af4e-a4fa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703710807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710807, "uuid": "0846e611-97e2-4fb3-92f6-706c9aa18e36", "comment": "Malware payload (Mirai)", "value": "618dab3ac14303cedb3268ebb736880d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710807, "uuid": "febe20a8-cea6-443d-b5bb-82b3804e8bbc", "comment": "Malware payload (Mirai)", "value": "ad352c92f7a4f27b64d50a085f41665c097f2c728059386d65f73d9a34f19dd6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710807, "uuid": "29dd2c31-e7ef-4392-ab1f-894b4e930bd6", "comment": "Malware payload (Mirai)", "value": "2dbd457757ddd5c9e56686c438b6ecf8c5b33ef6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703710807, "uuid": "a9ef1353-0195-4f7a-99b6-e613caf30471", "comment": "Malware payload (Mirai)", "value": "3dd384d558782ab40ec192d0d86c94766afb38093c2a31f5b85f4caa9eebd3aabeb77ac6facb1ceb95c46408578bec4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703710807, "uuid": "8195a23d-9a71-4b8f-964a-334c56995bc9", "value": "T19D332A51B8919A12C5D4637BFA6E41CD332623A8D1DF33079D262F513BCA82F0EAB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703710807, "uuid": "3a248183-b30b-4ad5-9dd9-642dcff4fe40", "value": "768:omso9sEallYUxBTcJ3qbxJ3USFlvG4UbPUWTSh05anSRZvYPvT/hcB3D8nRRePNj:2ooCUxdr04UdaqZIvT5r5xT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703710807, "uuid": "f3a5cc2d-0752-4eaa-85e5-eba67a5436cd", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703710807, "uuid": "4337b53b-b25d-4e37-a18c-788ed7928f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703710807, "uuid": "6f1a7223-92c1-4f17-ab59-303fd1c28871", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdae38c-a47c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656532, "uuid": "6d20bc62-4b89-497f-a3f8-462a204a278e", "comment": "Malware payload (Mirai)", "value": "633a5e5d3e371763a17e4f66bb9b4583", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656532, "uuid": "46f037cc-9549-47f8-85f3-18653f554b0d", "comment": "Malware payload (Mirai)", "value": "adcba406ba48b0a96c60b31154a4f2030aed8f0bf95dd173d145ee286b65dbad", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656532, "uuid": "c72360b9-646e-4719-8aac-9efb0912672a", "comment": "Malware payload (Mirai)", "value": "8659690bfc56f1c4f085806967eec0e1c63474ed", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656532, "uuid": "8e9a4871-69fd-48d1-8c5f-d98d37ff09c8", "comment": "Malware payload (Mirai)", "value": "d2101098e0ac9950395989fc10315e828bec888ebc81f8705fb6c0c4caee4cfb631ea9252a2c43943f1bd982ed42c647", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656532, "uuid": "a4b826cd-f8d1-4e28-ab5b-7aa1494d7886", "value": "T1F4D2D0EB65BFF273C0367874346014D4FB383512E22D571B0CAAADA869B66D13750D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656532, "uuid": "df4a64e4-7fb1-4a43-8606-33b029e8039f", "value": "768:UYSoXdJZ5U05VxmHSSc+H2c+lPPggSx0sc:UYJdJZ5UQVH/+Kitc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656532, "uuid": "dffa5dfd-7c13-4bf3-a9a5-0156ca6a4e5f", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656532, "uuid": "1ef5cd70-542c-471a-b786-590650fc3f6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656532, "uuid": "dda5ace7-4b46-4d27-9b07-0d01071afee1", "value": "633a5e5d3e371763a17e4f66bb9b4583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a327c743-a4c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703689213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703689213, "uuid": "f6500c7f-11c0-4a43-a699-b2fc41055299", "comment": "Malware payload (RiseProStealer)", "value": "12215739230da8a13e0315ce8e95520b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703689213, "uuid": "a321c120-f472-4488-bba1-7dae3cf44083", "comment": "Malware payload (RiseProStealer)", "value": "b147e01adab38814de93411e47cf77461d9aed0e28bc92410d2aa508fe63175a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703689213, "uuid": "622dc4bd-c316-4d76-aada-bca327e8cbc5", "comment": "Malware payload (RiseProStealer)", "value": "eb6081fdbab5f4d22807d459cc28d58b41623f7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703689213, "uuid": "4f1e6dbe-e1b3-41f7-8332-bb2521b6cf1f", "comment": "Malware payload (RiseProStealer)", "value": "9399806ec067fef7dd4b0c0e11d31a2048b2027faefcb5915657a29c0c2300f30bacc5c62d93312d47cddf9a12d35eeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703689213, "uuid": "d5ae93ba-3f3a-4ae4-a038-bd63ce2ba553", "value": "T16704BE6179F080B7E7F3563548F5A6B46A7BB822EBB580CF2364072E1E222D15E35353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703689213, "uuid": "83c4ad4d-6dca-4b4e-810e-8a230920f497", "value": "b95b642310153d3ab6209ebaab8148ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703689213, "uuid": "0ceaf013-4acf-4131-a3e3-8473936cbe66", "value": "3072:dJvvAK4Lv7A7lpXJWahuHyz5m6d02kDuOcTGQVgyRDU8EEAcm:zvAK4Lv7A7lpXJWaAHyz5/aTLByUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703689213, "uuid": "c6809956-0e5b-40ad-88eb-16dfd55d2b6f", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703689213, "uuid": "1d20a8a2-3ce1-41ab-8c26-12973a6e52ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703689213, "uuid": "e2c8660a-23a9-46cb-8974-c47d85dbff65", "value": "12215739230da8a13e0315ce8e95520b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0203c26b-a4cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1703690231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703690231, "uuid": "7ec8abe7-c70e-4b08-9710-6faf19235cb3", "comment": "Malware payload (SnakeKeylogger)", "value": "9a28e7a6a166b8dce2b55e0959393b2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703690231, "uuid": "cfb4fa9f-6f26-4ee1-ac8d-2909648b6a48", "comment": "Malware payload (SnakeKeylogger)", "value": "b2ca317d8e7369cd7f839b2db7df1e53b7535ae432ce247e933e8dfa8917e3f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703690231, "uuid": "0828a636-e176-447e-ac8f-777ade8d70ee", "comment": "Malware payload (SnakeKeylogger)", "value": "af1223cdc28e4a7513bae8045095ca3d6705b0e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703690231, "uuid": "6c1ac83f-b89a-44ec-9d82-6074253c9d74", "comment": "Malware payload (SnakeKeylogger)", "value": "d3a695d9f3d21faa887ebc83b609d35d22c08b2dc3a3e422b91ed7d7debdd4d2579ff33389d8f2e80973d7838c8b41cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703690231, "uuid": "f934320d-a6bd-4370-bb09-ffc41f3364ba", "value": "T1F0B4E048ABD505ECC9AED5780EFE69AC23F7D189C64A8F0F1044B4752C6F327615E398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703690231, "uuid": "937d68c4-b109-41bf-bcb1-2aeccd92d033", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703690231, "uuid": "5bdd4a5b-d6b8-48fb-b98b-884b9f87827e", "value": "12288:wtBEwh2DPEdhnfDQBKgQ1eFP+uDKIa9B:wtBUPSnfM9Yq2waP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703690231, "uuid": "9cf15c85-731f-4907-b58b-8245f6e35e62", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703690231, "uuid": "3e8352b6-c375-4539-80c0-81af3333d557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703690231, "uuid": "86d584cb-e86d-42d5-8b83-e0463ed32174", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17400.24243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c58487-a47c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656552, "uuid": "0ecc0ddf-21c0-4601-851a-01062d975bc7", "comment": "Malware payload (Mirai)", "value": "07e18b6ecdf031d229d692bad0ed5fd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656552, "uuid": "bffe4c9c-4688-4eb0-adc2-f4f1b68f2f5c", "comment": "Malware payload (Mirai)", "value": "b4d81b12b554da908292f697bc9f07f7be0a1fe88534a21fcc735c2202898f27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656552, "uuid": "0ecb0868-1e8f-4edb-abec-7f0539088774", "comment": "Malware payload (Mirai)", "value": "5064fed2f1c81be14030893a2a31be0c970f419b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656552, "uuid": "c9188ecc-c413-4b1b-a21a-674ba7f49aba", "comment": "Malware payload (Mirai)", "value": "e67f74b4fa24cff8cdce8e358d835e65224793ed7f9760748b0cd2dc081854aec66319a672441ed7491ef1f18e594cdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656552, "uuid": "a4396271-adae-4ba3-a641-8a9f3bf2e73f", "value": "T12CD2E08C76D763FA8CCDCABD765E003A30AA74E5B2B29363B301C5534776180EA55E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656552, "uuid": "0380549c-5b65-4722-9885-0edfb5f5d303", "value": "768:blxKd21RhxEnsD16IHE4RlY990ea10BEwXY:+d21/nDdHEw0aeuMEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656552, "uuid": "ccde308b-b162-4dc9-a580-578be842bb92", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656552, "uuid": "a6945558-6010-4938-9997-11ec6a991d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656552, "uuid": "05cf135c-bf34-423c-ab66-d3c9edf20dde", "value": "07e18b6ecdf031d229d692bad0ed5fd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fb6a07-a47b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656205, "uuid": "cf79e6d7-629d-49a7-83fc-ef368eeeb9cf", "comment": "Malware payload (Mirai)", "value": "c8d9aca15b2d8bdc994eab25bb8b340b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656205, "uuid": "3a39f58e-db90-4a29-891e-3fd62a626001", "comment": "Malware payload (Mirai)", "value": "b7203adb9eca0e6b34dd796381debc5888b5f40ec6d656ddb2a17845b8c28f67", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656205, "uuid": "7974a624-20f4-44d2-b22e-f9dd1cd62826", "comment": "Malware payload (Mirai)", "value": "0a1f61ea89b88d989bd51a7eed7af094988347e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656205, "uuid": "b9d77c2c-10d7-48ba-b270-f0a0f0e023c8", "comment": "Malware payload (Mirai)", "value": "ca58ba02ab73751b09b518fe8f0c0c7bfae8af571046c8ec102a21d868d3b67b35bfe530ef5d63f716ec9714ef61c97f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656205, "uuid": "4a409fa7-d5c7-4c0e-8efa-49e707642e3d", "value": "T118C2E1BC7DEB6F87CA1A0036685CEF3782B065A5D36B7697B2444006BC131E1AE27C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656205, "uuid": "c5694b35-3ec3-4787-86a2-e348aa839e8b", "value": "384:Mp1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjhdO2:UMw4DZdFbBy6x3K/KdWnH5mEFU0NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656205, "uuid": "3fbea382-db69-4879-b500-a68cca5a1c13", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656205, "uuid": "0e5d412a-5c37-4bbe-837e-a38b9006d366", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656205, "uuid": "d864bdfe-b574-4d02-a3c3-10d7ff926760", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccd0f3b-a47d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703657124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703657124, "uuid": "223d3935-46bf-4dc9-925d-fe42bc562244", "comment": "Malware payload (Stealc)", "value": "52cebbd65b77bd04eafeaf0c1bcd46e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703657124, "uuid": "35f4cbc8-86d6-4ae6-b381-3b341b10fb27", "comment": "Malware payload (Stealc)", "value": "b770ebce28cbe46ccb12c09b252b99827e0a7fcd7f64102498cd4e18edb61a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703657124, "uuid": "701aa5f0-f269-491f-90b4-6d5bac64c229", "comment": "Malware payload (Stealc)", "value": "66ea839d5ecd97fea1548328575ed4f66a4c715d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703657124, "uuid": "b4d9a1ff-e776-472a-b389-a50d5899d898", "comment": "Malware payload (Stealc)", "value": "13f61addc36fee0e4bc20eb50ab3da9b073690da7efba80e27827332930b74ef02d711026378fbfd8475761aea5d156c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703657124, "uuid": "23cc8958-c35c-4dbb-a9aa-49130d119233", "value": "T18704BE2279F084B7E2F74A3559B496B46A7BB9629BB1C0CF2714072E4E313E05E35363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703657124, "uuid": "6d4a4557-ca5d-40fe-a89a-6de458ea2c19", "value": "06f98f4d929a6c5ef0fb810799afdacd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703657124, "uuid": "dcc6b725-4bbe-4816-921d-51c36b38e061", "value": "3072:7oPAc9KLn7AmTxqj2E9JHAxoEJpMwoadvmc0BkYLAEE1dkl:0PAc9KLn7A2oQmwXUud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703657124, "uuid": "59d5c91e-73b8-4d0a-834b-c7a0dd7af00d", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703657124, "uuid": "3a6882a8-2288-4b1f-bed6-39637628fb29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703657124, "uuid": "fbc010ab-df62-40cf-a932-70e1451821b0", "value": "52cebbd65b77bd04eafeaf0c1bcd46e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0dc3d1-a495-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1703667139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703667139, "uuid": "ad3632d1-2859-4f53-bdab-88d3c12d5012", "comment": "Malware payload (DCRat)", "value": "5f346ed15bc5b46e0b5152d98012db89", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703667139, "uuid": "637d1dc0-eb4b-421b-9857-2b32a7fadeab", "comment": "Malware payload (DCRat)", "value": "b776c29795ad7f879bd4bc08ab63373d81b69a647870fd63d3ba8bb055c33ce4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703667139, "uuid": "e8003766-bfdf-4d0d-9026-1ecc11b47530", "comment": "Malware payload (DCRat)", "value": "e7f4f6902fa9a5e97375bef8b4e9700998647ff0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703667139, "uuid": "95ced881-faa6-4c93-a04a-595203d354d2", "comment": "Malware payload (DCRat)", "value": "2c01025696efa500617b439033c09cb0c30c04a883705fecf532cb157557aff906b7dbde19c2c71f733399379910f3e7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703667139, "uuid": "a7c7e3b8-e74b-4b75-9144-b1aa23485f7b", "value": "T1C8C5331072D82567E2A94F350DB77BBA26D1AACE9B482E7CC30701F14BDAC2D9D41B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703667139, "uuid": "94c7083a-7122-4c5e-9051-625989b32597", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703667139, "uuid": "72d03a8d-a6dc-46bb-a774-cd7a5809b913", "value": "49152:qQdNyvJnI5hxwCekbTGShMT7bM6K3aJqLwBptvZSGTk2t3:qQ3yv4QCRTkb7YaJI2jv4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703667139, "uuid": "6a0ad4e7-ba1c-4e04-9ba0-c1fe4f94144d", "value": 2533376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703667139, "uuid": "b35dc0c2-50e6-477a-9e71-3dcbd463fb10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703667139, "uuid": "77977eec-6724-4755-a474-4b4fb82bd566", "value": "SLIPWARE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b90228-a455-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1703639927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639927, "uuid": "f22db3c3-61ab-4719-94be-4db651f8073d", "comment": "Malware payload (QuasarRAT)", "value": "d7682d84f7324c7d04247dc89ff5e6b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639927, "uuid": "38b4475e-8840-457f-8209-13073275e2c9", "comment": "Malware payload (QuasarRAT)", "value": "bb0030bf3e5850081e20a97c2c720cf5904252a3f535591db9c95a9ac2d3cbd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639927, "uuid": "caf67b40-ff42-4d39-b852-461876e28205", "comment": "Malware payload (QuasarRAT)", "value": "135c9e5797f4222f22d8dbb26a91a124d17320f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639927, "uuid": "50d89d65-d563-4a55-9a72-b8e830a70ead", "comment": "Malware payload (QuasarRAT)", "value": "11f966f031c952e30bedc09ecf31228a0d485c2699e0e6de46135b377b77b3866eaf3a47ba6ee1e3b17d987c39d3ac1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639927, "uuid": "b52a92e7-ecd7-4fa3-abf2-9f5204111d03", "value": "T138E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639927, "uuid": "4fa10f6c-0c2d-45f3-807b-2a3b597b36e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639927, "uuid": "6e4eef2f-8d67-4861-8689-7e0de35487a2", "value": "49152:2vkt62XlaSFNWPjljiFa2RoUYIVLRJ6sbR3LoGdQTHHB72eh2NT:2v462XlaSFNWPjljiFXRoUYIVLRJ62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703639927, "uuid": "53283f8d-05f0-464f-bf69-a43aa6e9f820", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703639927, "uuid": "284174ae-8e2f-465e-9a49-634c787ba159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639927, "uuid": "eeeea5e1-4fc5-4c20-8100-875332801585", "value": "Windows Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0d8996-a498-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703668585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703668585, "uuid": "5c9d02fa-cf83-4a40-89ee-f21c50d96144", "comment": "Malware payload (AgentTesla)", "value": "1f7dbc20e84335e58c68205aa2d7db8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703668585, "uuid": "8ba45a76-9e11-461b-910d-5493ff039360", "comment": "Malware payload (AgentTesla)", "value": "bdcf891f483abf731c4d428bc1cc7a82dc9d4d5e585c0082ab5a3031a2297f73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703668585, "uuid": "d2f30346-4a66-4914-a74f-c06aae638447", "comment": "Malware payload (AgentTesla)", "value": "9182c963a28ddf153901a501778f3c5f36464b5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703668585, "uuid": "22a1c854-66ec-48b4-ab8e-40634b011c76", "comment": "Malware payload (AgentTesla)", "value": "f8d406bcdbba5befe796577d20712d9e0e8500b4037ba66357a20d564bf71069ec3af4fb228fd470b5bec0e3f1e1b358", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703668585, "uuid": "6d1ec01a-bac5-4256-988f-eb7a3c29af44", "value": "T19815C1FD08BD12EB81ADF6958BD89B27B018987B31116D6794C343974306A9239F31FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703668585, "uuid": "6f13103e-6e95-4893-9594-c36d4c9089d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703668585, "uuid": "ac174885-e3b6-498d-a2ff-4f82b9fa78dc", "value": "12288:wH1O4dnheXhEzw4F6iLTRHr8I9Nc1xkxla6oqCJSV+8E1F:KMDSs4FlRLLN0k+HqCJR1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703668585, "uuid": "da98c273-f41f-454f-a520-8c0e613930cf", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703668585, "uuid": "03a60d2d-261b-4d60-b219-70b052b72371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703668585, "uuid": "cce7525a-5637-4e66-9626-5565b3d8bf0d", "value": "SecuriteInfo.com.W32.MSIL_Agent.FPI.gen.Eldorado.20244.18739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b043e9b3-a4d8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703696107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696107, "uuid": "13db4f12-4a85-4b51-8801-45612429b97d", "comment": "Malware payload (RedLineStealer)", "value": "c8159fa89113ec6fc180ccb76ff3bdc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696107, "uuid": "0fcfe4ac-8a47-4d41-80bf-da742f29fe9b", "comment": "Malware payload (RedLineStealer)", "value": "bdf0d0149ee88a4b66f6535e6049fa2faf1351a69c7df0146b1fe6964e9c4ad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696107, "uuid": "a9264787-189d-4fe3-919a-83eead4ae3fe", "comment": "Malware payload (RedLineStealer)", "value": "b7790fa8855c67a1b441b964910e2f1857a79c78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703696107, "uuid": "2e462140-e09a-4137-8c19-d74a68416aad", "comment": "Malware payload (RedLineStealer)", "value": "8793d0f9169cbdc132f55207c71e344474ce3e8f09e4123bd69d5c84f087c6fc85e7ff7dc9ceacf5269939cdde382379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696107, "uuid": "70dd68c7-7fb1-42ee-8046-50f87acb6ccf", "value": "T13D03D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696107, "uuid": "b25d0c1f-613a-4514-82f4-47ca5e2b23aa", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703696107, "uuid": "29abaee0-2d38-4bb3-8600-b88109609392", "value": 38227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703696107, "uuid": "3d04cd4d-b13f-4df7-a468-d27639d4bd49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703696107, "uuid": "34ea34a4-06cb-4164-9017-68a23ac07b3e", "value": "c8159fa89113ec6fc180ccb76ff3bdc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52bbde2-a48b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703663151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663151, "uuid": "befd3ac5-d499-404a-b072-a3f7e1df81fc", "comment": "Malware payload (Mirai)", "value": "3d162b5ef10d5d7f0f7c833086cfdba2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663151, "uuid": "d37b7f8b-8ae3-484a-96cf-8e3e34ce25c1", "comment": "Malware payload (Mirai)", "value": "c04c94a57d2a9ec5a123fd761f5317dceeff08a66c8db98ebe81ab0a3385e356", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663151, "uuid": "3ad11524-8415-4081-9784-38cf5c8b0a39", "comment": "Malware payload (Mirai)", "value": "01514ea3ae47f45b18036b1b9c8df03541c24392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663151, "uuid": "8c246f4f-5a9d-4522-9b7d-fd47d27b5e7f", "comment": "Malware payload (Mirai)", "value": "d76afddd3699f77c4929778fe56f8549238e2f697c97ea9da0862a7bc3ec9b812e126c2d969094532886ede7e78ab0e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663151, "uuid": "7bf8aa31-a902-4d67-8ab1-7b3df2876982", "value": "T1C533F1B692ABAD71C17056F7152A549D64092338E3F6F00366610470E6CB1F35AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663151, "uuid": "9e9784ea-4e31-455f-a9bb-7c165c1e66b7", "value": "1536:uCoqsGR4eB3g0Vmh1IxIpC8JVL9VE8amFZP7R3q:Xoqs2Twh6P8JVLJ9ZP7R3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703663151, "uuid": "1d1747f2-d1fe-4ba2-a411-afa9096c7336", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703663151, "uuid": "4cc5aafe-57d3-489d-8bdb-cf82a64b4d4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663151, "uuid": "d7b65381-2baa-4889-aef3-211d8e04b90f", "value": "3d162b5ef10d5d7f0f7c833086cfdba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948ed071-a47c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703656547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656547, "uuid": "9f07fb9d-1949-43ba-9a8f-232c33436a97", "comment": "Malware payload (Mirai)", "value": "658a6f3083e9f864998057a0c7e3497f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656547, "uuid": "27f04eed-7ec3-4841-a190-0d3c96b8b1eb", "comment": "Malware payload (Mirai)", "value": "c4c644e95658db2e558f21bd8af30ce0dc6971ff617e4a7a2e087c43076da4c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656547, "uuid": "3776c622-1408-4beb-b2a6-05f31824101d", "comment": "Malware payload (Mirai)", "value": "68f202972767f4cae4654246a1bcd51728eb453e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703656547, "uuid": "adfe2b1a-7846-4df7-b150-7f4e947c7c98", "comment": "Malware payload (Mirai)", "value": "599495ddd4b3f2357bab4d005618bc4da4035eb1018d5b99ae8f6783590de8af295225108aa679d9a787c0265af6eb37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656547, "uuid": "19f033ab-1d28-4949-90c4-b48ec4fc5e4a", "value": "T1D1539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656547, "uuid": "dcc60f8d-5fde-4766-81de-ed18667c651e", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703656547, "uuid": "4ef2b539-cff6-47ae-bfeb-c0a6d20bd973", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703656547, "uuid": "459ca948-1523-4de5-9118-1a942bccc99e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703656547, "uuid": "027a16a1-8500-4d4f-8671-fafef0523840", "value": "658a6f3083e9f864998057a0c7e3497f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6afcc37-a4a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703674186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674186, "uuid": "6c020b87-c312-4589-b0ee-568e80bafce6", "comment": "Malware payload (AgentTesla)", "value": "c2b14ec64f8acdf4c5beaac964a811a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674186, "uuid": "bcafdc95-e035-45b7-a0da-734b4f998fff", "comment": "Malware payload (AgentTesla)", "value": "c586688bf218a4ecf68f20f9511a1c40eb804bcdf9649d9811cc0302fffe6eef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674186, "uuid": "29c58b8b-e0f0-4c6f-a75c-b60d658ca0af", "comment": "Malware payload (AgentTesla)", "value": "0ef147e595db9033ee0efa573a1efbb33ed2a6bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674186, "uuid": "04e4bd83-1fc9-4245-8171-ddf6ed10a6c8", "comment": "Malware payload (AgentTesla)", "value": "cfa7e4e804f87ff8339127e5f6d4fe63322dd08e4486fedc5c2dd89633d63967e33937a9e20b862b35346b4c5ef21931", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674186, "uuid": "55f790bd-d08e-48c3-a0ad-d1b26a1d9e72", "value": "T12315E33D1BBF1227CC67CAABCBE8DC27B15194AB3C11DA6445C3439D53B6A4225C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674186, "uuid": "4a765823-6a16-4d30-82c7-bf906fef6252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674186, "uuid": "54cee989-2de4-4321-b9eb-4730dce3c1d4", "value": "12288:kU6h7XUVU1qqoECo2zkchwiSc0ZNgyCu8IT8X3FARIOIaPy02Sj3GK9AupG4gFcQ:Tqsokqj8u8IqrOIaPHj3GK9AtrcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674186, "uuid": "6d5f2108-e73d-488a-8a70-580d77fc0426", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674186, "uuid": "1263e387-0f26-4b38-96d7-8954f08487ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674186, "uuid": "bf6bd81c-09dd-4d1d-bd31-7ee8863656dd", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32798245-a470-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703651228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651228, "uuid": "237c7bba-83e6-41d6-b3b0-0b8d04702990", "comment": "Malware payload (RiseProStealer)", "value": "901bb7cdf6777fa6661a8230aac4ce43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651228, "uuid": "82fb206f-1682-487f-b3e2-ddae618d038a", "comment": "Malware payload (RiseProStealer)", "value": "ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651228, "uuid": "7ac8fbfd-29b8-4319-8a75-21071b2e5579", "comment": "Malware payload (RiseProStealer)", "value": "cbe3cb1fe5e90feb741d25da587223478efd1ea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703651228, "uuid": "225e04cc-aacf-4e57-89f6-56546b6615ba", "comment": "Malware payload (RiseProStealer)", "value": "1bed9c341712b7c900839e683a2d61dfe04cd0b0cceb57d2ebd8884f3d5bef024b9dc501d90a8b6ffe15dfcf12ebc57e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651228, "uuid": "f488e8ca-3639-41db-971b-4705e5e29e47", "value": "T17CA523D3E2C15537D8B5AF700CF22BE356393D928835972B2E51795A1D630E0DE32B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651228, "uuid": "6cdce5b4-4047-4016-afe2-414440c7baef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651228, "uuid": "f32e4ab3-0092-4fe2-ac0c-209a673bd2fb", "value": "49152:arM7OejNT8b7+EQKbLH/KEUOuefPxM97O4xnQfZ:p7OemOfeK0NfZu7O4xnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703651228, "uuid": "4d8d41fe-6711-4e58-954c-434034899d5f", "value": 2118656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703651228, "uuid": "7561b8f9-d6e9-419d-88c9-5a9805bb6fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703651228, "uuid": "765afeff-6ab2-4a1b-8dcb-ce1826e5ee21", "value": "XAmen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6553fa85-a505-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703715308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703715308, "uuid": "34950ee1-914d-48e6-acf2-21482eeb065d", "comment": "Malware payload (RedLineStealer)", "value": "a8d6e729b4911e1a0e3e9053eab2392b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703715308, "uuid": "74fd737f-47a6-43ce-be6a-aa1854e041d8", "comment": "Malware payload (RedLineStealer)", "value": "cf0becb19e10b2dcd972fbe94aea00c51b8290b052263117e7ed8721d48ee104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703715308, "uuid": "0f079738-2161-4c99-a676-3f42405aa0cb", "comment": "Malware payload (RedLineStealer)", "value": "c1730126a7673bafe780d92fcca9d88707df0ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703715308, "uuid": "b31f4f15-17fe-49b7-b288-7013e503c4e9", "comment": "Malware payload (RedLineStealer)", "value": "753d115b7b5069df77c6a40dde3035dc57c79cbd8eaf2cb17b1385ae4e71d13d1e60c29ed8775dace2ea189a980d3205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703715308, "uuid": "a96dac33-c80a-4cf9-b7fb-2e45c72e8d72", "value": "T17394AE107E80E5F2CFF6F17C44D68A654A2E7C610B6785D376883EAB6E332E15231D89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703715308, "uuid": "bcdf47c3-8750-475f-91b2-8566a58fbb2d", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703715308, "uuid": "57acdb9a-dbf9-46b4-adf3-a45ac9e6b4f6", "value": "6144:tDKW1Lgbdl0TBBvjc/OjdSKnpdU1CIzJ2B+CFBKlHBBU1H206cqeeqBG:Fh1Lk70Tnvjc2xn8n+BKlHBW1QdqBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703715308, "uuid": "f96fc44b-d175-4ce8-a990-5592b8e92ec1", "value": 426832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703715308, "uuid": "13293f92-02f8-4a0e-ba67-66cbdb4c39a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703715308, "uuid": "9b86a68d-df31-4396-a7d8-60ef90774ec4", "value": "a8d6e729b4911e1a0e3e9053eab2392b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b397a744-a462-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1703645432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703645432, "uuid": "b43fb0b6-17cf-4f72-aa63-f2c6bf9d3533", "comment": "Malware payload (NanoCore)", "value": "2338cb2e22d4cb7885bc565984623a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703645432, "uuid": "14ceb2be-a94c-4dd6-a91a-e4daa1b97790", "comment": "Malware payload (NanoCore)", "value": "cfa9036ddafc227e28c20bb5d53bfc9bd5fc9f91f64203c08d25c9250cd18ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703645432, "uuid": "c6df3709-f593-43b9-a12b-b9780dec0ee1", "comment": "Malware payload (NanoCore)", "value": "1456a9c29c374b08df9b3e1d1c0d11b63c6e3e6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703645432, "uuid": "b9864405-21e6-4364-8564-d0860e09cac2", "comment": "Malware payload (NanoCore)", "value": "b28348cac1b2af162cb92d4ca5a8d7fb0e8677eaaa1040f5b20af0b1a53d59117ceba4cabd23c34da0d58825e370b102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703645432, "uuid": "3268ad0c-c2e6-431e-a390-022da22c035e", "value": "T122C412663BE6882ED29E86BDA1110742977CC2E7D8C3F3EF58C810B66A253F105571E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703645432, "uuid": "6168dc2c-f05b-4992-822a-5746e0bdd7f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703645432, "uuid": "4b50b939-9084-4cbc-9927-d89079bdfc7d", "value": "12288:GLV6Btpmkzi/o/vJHfPsiS7oErT5ohXAsQSG3c2hqEpZ0RnY6PcE07:UApfzi/o/RsDXW2hq2sxcx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703645432, "uuid": "072e3683-3723-4bb2-94e2-e8bdafa77bd2", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703645432, "uuid": "183d8564-9682-4038-a3b6-6f44cfb7bc93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703645432, "uuid": "095c723e-c1ac-46f7-ac7b-3398de9c8c72", "value": "wanmgr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eef370a-a45b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703642229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642229, "uuid": "cade2dda-3a43-4312-bfdb-b06aecb491b2", "comment": "Malware payload (Mirai)", "value": "bcd9300d8b70587a61879492230bc4e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642229, "uuid": "2d4ec685-8643-49e7-aef4-5bdd12e718e0", "comment": "Malware payload (Mirai)", "value": "d34e66a844927be9a56e16f974d33a89252c6ca67ca2fa76af48707527863aae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642229, "uuid": "f55abe0e-2298-437f-86f1-7e4abfd31ff9", "comment": "Malware payload (Mirai)", "value": "e9bbacd7cbcf21e9bb8992be0a53ec5eb567c3ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642229, "uuid": "dc43921a-ea59-461c-8201-ac2e295d8498", "comment": "Malware payload (Mirai)", "value": "1a3d869bc7f7d0cc6951574aea66d1112a7a816604c7e986495488041a17e23b7c821b6c822587135cd4295a1a7fdb61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642229, "uuid": "2c6eea92-e96e-45e0-af97-5cf016c263be", "value": "T12DA3C71E7E158F7CF79D873447B78E219688338B2AE2D141E14CDA015EB028E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642229, "uuid": "2eb8a5c5-72e5-4c42-8193-a0ee2a0522a0", "value": "3072:pqunD7x7p9V7Ebcn/kqWdH3faIfaazOBCZM:pqunHtp/pW93S8aazpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703642229, "uuid": "d40f3b55-3a46-4c0b-9984-8d67fb7d0a2c", "value": 101132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703642229, "uuid": "be5b22ab-84d9-4f70-8d80-ec872a6b6ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642229, "uuid": "4d31f913-b63e-40a1-8408-539ed5dbf229", "value": "bcd9300d8b70587a61879492230bc4e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f75d84-a4d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1703693242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703693242, "uuid": "b77f9b36-9f71-4abd-8890-e38db3ce577d", "comment": "Malware payload (njrat)", "value": "6f63ae5040ffe8045c6b3f6efbbf5c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703693242, "uuid": "b3842e7f-3898-4a11-a2c9-e0008c9c037e", "comment": "Malware payload (njrat)", "value": "d73b674e1bcd545b04f74778c20baa1e0687b1e3219efddaec0280d2b9216802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703693242, "uuid": "b0639a6b-79e4-46bf-a0af-9449a35afe79", "comment": "Malware payload (njrat)", "value": "9fdd166560d0427ef770bbfdcb4c827d77abb616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703693242, "uuid": "f4dbb93f-b791-4c63-b895-c6144b5fc5a4", "comment": "Malware payload (njrat)", "value": "81ef7174f120d39ada5ed4efa07b40a84f42d12abfc9f67a28c4c261efed0bf58ae9cce3332bc9d4475dcb148d8d6c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703693242, "uuid": "5d3a3ddc-1b70-4e45-bf4f-2dbf6749dfae", "value": "T1E2E218067BE94219C6BC1AFC8CB303214772E3838532EB6F5CDC98CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703693242, "uuid": "9bc60556-573d-41cd-958e-699b22425766", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703693242, "uuid": "d5709a5a-f1c0-4409-9267-3fe70b171363", "value": "384:t0bUe5XB4e0XWODzw0Q0mS03AWTxtTUFQqzFBMnObbV:+T9BuFY55dyjbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703693242, "uuid": "91840497-d56e-43dd-a92e-3a1015532269", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703693242, "uuid": "8712fdd6-783f-49ab-a2ba-2cf1fc7065ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703693242, "uuid": "1552abea-6f0a-4359-8327-62442bfdc881", "value": "bSB4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2246cd-a4a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1703673608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703673608, "uuid": "cb77217f-33aa-4515-8d9e-d2dc52130126", "comment": "Malware payload (Gh0stRAT)", "value": "bf898b6c42becf5ee4f7c69419d37a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703673608, "uuid": "f7aba2f1-ac70-45eb-97f4-7151f5b71d84", "comment": "Malware payload (Gh0stRAT)", "value": "d8ebd4c7733192b5844e56db100ca215583742cf5db77a2a579e934eb27160d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703673608, "uuid": "30f93771-ac5e-4f5c-b089-c26ea1300f6d", "comment": "Malware payload (Gh0stRAT)", "value": "0bf7464f6d08f7ba1a27fe372b57206865b34605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703673608, "uuid": "d77cb2db-335e-48c3-a28d-9dd8300bb8d3", "comment": "Malware payload (Gh0stRAT)", "value": "d79add23d35530279dbbd7e71edf94b3412924695a8341b893d6037eb1ab255356d0e7f3b530a8497e4f507991878bed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703673608, "uuid": "5f7e573f-7d90-4a4c-b753-9d1ec21d36b1", "value": "T196048C02BBC740FAEA68013C14BB3776963BAD986B095FD3A318EE755833151E633247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703673608, "uuid": "f3fa188b-7cdd-416b-af67-99d8ac386b24", "value": "b7f39532728ce325dc91e2c72b9d27ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703673608, "uuid": "b65be6da-4b2c-47e4-93fc-b93a8ace2817", "value": "3072:VJuGnYhTbK80khbOW1oWOQ1f9xHwm1PXBmXZFeA28pMGEdePl9dehiv80P80CnpZ:VJueTk1OwoWOQ3dwaWB28adeP/deUv8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703673608, "uuid": "3652fad3-16e7-4e01-bc91-20455c9fd9ba", "value": 179181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703673608, "uuid": "d5066b3b-3968-4890-9599-1909da8d5f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703673608, "uuid": "7f2fbd8d-ba6c-4062-baea-c67120c60a50", "value": "bf898b6c42becf5ee4f7c69419d37a80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4902684-a455-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703639930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639930, "uuid": "1ef18dc8-9e6e-4a8c-a180-1d13dc88adcd", "comment": "Malware payload", "value": "4f1acccf263d190a2e25b4df0653ab42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639930, "uuid": "19afe191-e8a3-4fe9-8371-4585b2809328", "comment": "Malware payload", "value": "d9926086b598dac8ba11c9e5c9ab38f842945598d6a01a4deb4dfe25ab9b7ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639930, "uuid": "7e9bb18d-8d0d-402c-8680-1809fe5a85e5", "comment": "Malware payload", "value": "6ea8e9ff535ef056e702976fdc46241451dcd697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703639930, "uuid": "4a7d66c6-94fe-43a4-a347-2c49dab6b97e", "comment": "Malware payload", "value": "495589f513460afbd23657cb6bfd229ff0ae7bfefc3901a2d273783b58b5bb4ccac1bdad7998bd2403dc3f25d5da1d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639930, "uuid": "0435ffa5-c5e7-44a7-8121-4a83044d4fde", "value": "T131A60233B389753EC46A193A842796589C3FBF717926CC4B5BF4684CCE35540AA3B60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639930, "uuid": "9c69aa04-7058-4d22-b3c4-9e617174a323", "value": "fda292f9efbe46ee17959fe5b7dcbfeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639930, "uuid": "24d56989-bb86-4811-b074-8530f6f4ad7e", "value": "196608:wtOjIOIlhJN6kvY3TjUfU42xzGkv0d6CzmRy:wKsJN5AvSU42xztv0bzmRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703639930, "uuid": "8e636c42-7569-4d0d-a64e-626642507130", "value": 9881548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703639930, "uuid": "7ae7096a-4481-461a-a1c2-55babbb6f866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703639930, "uuid": "028f86cd-4b8a-4d6b-b20d-8c8fc53eebba", "value": "SecuriteInfo.com.TrojanBanker.Jimmy.25226.27514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f6cdc3-a4fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1703712227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712227, "uuid": "6b662879-df1c-40b9-9bf0-0b94dc16dfe6", "comment": "Malware payload (DCRat)", "value": "c8fa0b4e728103cf1dd2f1426d388544", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712227, "uuid": "33a4e2ee-2021-40cb-932f-863d8ac161a1", "comment": "Malware payload (DCRat)", "value": "da173f5b1824a92c96b93530bfa4c5fe802c9d8bae378e0aaefc0c738b5068e2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712227, "uuid": "ea92660e-6c45-48de-a2c0-6e7aef31338e", "comment": "Malware payload (DCRat)", "value": "ea4be50caa999a5eae1941462e0f3cace08dc621", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703712227, "uuid": "5bbbd52e-836c-4680-9589-25f86bd2ed1c", "comment": "Malware payload (DCRat)", "value": "25b76c7e05b5acacc9137e0855317b07b7bcd660efe48588b3e204b11e8e9ff1df02f78b477d3b25a32e755b1cd7d83a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712227, "uuid": "6f166edc-02fe-4548-9cbe-56f73d7a79a6", "value": "T16C2733B0F5D46933946516F6497AB89E178787A67B183FDCFE6603F88E233049083927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712227, "uuid": "296ac637-4322-43e2-b973-88ba7d4bbb87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712227, "uuid": "22cbb3af-756b-453e-a6c2-fe16d4a5b596", "value": "393216:RRoePATJH+c50Fa7K39n0LHOz3tcA/YFspJfUXvakYHQFSdbhALSVQtikwtW3Jit:RnKDot3uLuz3tM6rfUXCkYgU/VQti/Wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703712227, "uuid": "130ae207-5afb-4c6a-ad47-b9467de8c181", "value": 21665280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703712227, "uuid": "3c3279ca-5d86-40ea-ba67-90abf4fa1a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703712227, "uuid": "748574ff-56d6-4eca-930c-4458ae4abf3b", "value": "slinkyloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253a7d46-a463-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1703645622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703645622, "uuid": "1526db80-03a4-455a-9f67-ef42c2d7c46a", "comment": "Malware payload (QuasarRAT)", "value": "3f1867dd89cb2e48d6725023d0691fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703645622, "uuid": "6e2ff1dd-95a0-450b-aa37-4f8e674ee38b", "comment": "Malware payload (QuasarRAT)", "value": "dad38069fb5b4df1e583b548a0ade9959885b15b95e3e2c7a916423ab6fe75f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703645622, "uuid": "95967f07-5dc6-42bd-a067-fb972540cbbd", "comment": "Malware payload (QuasarRAT)", "value": "cf4e0550e4fc389e89b60e109c975e374c4298a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703645622, "uuid": "5761d4df-4342-4829-91d0-b2d0a3394eb1", "comment": "Malware payload (QuasarRAT)", "value": "b0c2c53d4573e7ecd648ba12c8d9a398251993415aa6cfdb268f556c5aa2cb91ae824c5f45ffde4d20d50db5b0d0fb2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "kicsiwilly-ddns-net", "colour": "#351F97", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703645622, "uuid": "c12b1e7a-ed68-49d6-8e7a-2dbee57f399a", "value": "T1A2E54A143BF85E32E17AE673D5B0501667F1E82AF363EB0B6281677E1C53B409C416AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703645622, "uuid": "84dc34ff-0a47-4a6e-847b-2a75b5c2894b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703645622, "uuid": "859a7b9d-ef49-4b49-a506-fc36cb28f542", "value": "49152:Gvkt62XlaSFNWPjljiFa2RoUYIRWH6fyvjcLoGvEgSTHHB72eh2NT:Gv462XlaSFNWPjljiFXRoUYITf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703645622, "uuid": "bf7cc4c5-b0ef-4f1d-b196-7212bdf03529", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703645622, "uuid": "297a27a1-9de4-4667-997a-a290fe9511e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703645622, "uuid": "3c40dab8-5431-4b16-8dfa-1f35af5e9034", "value": "Windows Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3154e9d1-a457-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703640489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640489, "uuid": "b3452e5c-e2f4-4a58-96cd-8bd30e307c33", "comment": "Malware payload", "value": "b31e76c1c83e9fa5a58d66327e5f6a98", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640489, "uuid": "61aea82e-3e39-4b29-ba04-4b43e537eca8", "comment": "Malware payload", "value": "db0a649d1e42de999fb98079278671cc684b0b86e6485c01375b5e2eab5fbb15", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640489, "uuid": "ce16a4a9-32e3-4aa1-b4cd-cebc83421fde", "comment": "Malware payload", "value": "ca549d47ae77f1c7ab23333bd9b1cb762d0ef21e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703640489, "uuid": "45073e58-a4d3-4cd3-a9fb-eb43c88da96f", "comment": "Malware payload", "value": "598ed61b8b4e701299a67487b7556e7f83771c53eb3b8eeffab27363ebaf7badb973e2b1c3ac9c6f45e6dd5b4f52d2ce", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640489, "uuid": "3cb06c30-3c14-4341-996b-1c4d4e9cfca9", "value": "T16F163B6ADC149B2FE09A1074C0772F653359E6DE2A80872F73BA270F5DE5341ADE68C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640489, "uuid": "876ffd83-77ec-41f4-b357-92188c6dfab7", "value": "768:8VdgVRu87TVOXRFr1PNcVHSeJu87TVOXRJ:8DARucyJ1PCVDJucyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703640489, "uuid": "d6a04514-8259-4e5a-9aae-6860dc83e7e6", "value": 4131489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703640489, "uuid": "b0376689-1776-44f0-8976-b3d9b58bc7a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703640489, "uuid": "1d0378ad-0d10-4efe-a031-47cb70e3dc99", "value": "August Smart Lock _ Job Details and Salary_Marketing Budget.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810b9ac3-a4bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703685290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685290, "uuid": "b6227ccd-18e7-4873-8836-25d594b4f07a", "comment": "Malware payload", "value": "a96f687566b387b46d46abcd2712d9a2", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685290, "uuid": "69e02959-387c-44b7-a637-cbf2d4cfae1e", "comment": "Malware payload", "value": "dbda0f2a88c7a04bc42ee5c2f0aadd3b3cdddf55a770ce863cc4c1e5d7526a91", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685290, "uuid": "30343238-e6a7-45e3-a97e-9bb3c909a3ba", "comment": "Malware payload", "value": "2f3e27a9db01066778f4d23e4e0bf9f0f8c8e97f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703685290, "uuid": "e6a481bb-a7fb-4dd3-88e8-b4fe2fb0696d", "comment": "Malware payload", "value": "f2c5185c167aeebf24f9ff03c067bc3474b72492c5d101a5804a4c74f48d8ca2682ad8b854fbaaf43ff110a0e0702c06", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685290, "uuid": "2234df51-5720-45de-8731-91f0cf027715", "value": "T197053196778134C7F2B12B3005E03B2037FAF6246ADCDB236EB5194C4C6D6E99E35409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685290, "uuid": "9a6f2d08-918d-4dfb-837a-fdabd19a161c", "value": "96:bLeRNpQ8RNpQ0XG3um4BqLum49um4P6ium4BqLum49um4C:bAjlGe7B57I7P6b7B57I7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703685290, "uuid": "9922e706-bd11-4cf3-83f5-1202f237c1f6", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703685290, "uuid": "4afcede4-5fef-475b-a952-4932857f3b9a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703685290, "uuid": "6701ac86-d2cc-4e94-940d-dfaca3e0794c", "value": "z39Form-1490-3-S-pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d45e3b4-a4f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1703708020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703708020, "uuid": "e68e6f52-abdf-465e-b33f-5dcd6695212f", "comment": "Malware payload (SnakeKeylogger)", "value": "5326e3d89a61a88d121b9c3f70d110b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703708020, "uuid": "06833601-318f-4176-add8-e6f7ba97449c", "comment": "Malware payload (SnakeKeylogger)", "value": "dc13c362ff576c7b7733c08175dd2f581ffd40aeb8b090823c18f04ece12ca01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703708020, "uuid": "cd493e16-4004-4dbf-bc51-a81899d2a048", "comment": "Malware payload (SnakeKeylogger)", "value": "adbfeda00426b8cf6381c046ffe92007bb0fe3ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703708020, "uuid": "3c81714d-6d61-4dbb-9198-067d093d650f", "comment": "Malware payload (SnakeKeylogger)", "value": "0ec1904a902a64d085cdf97f6dc579b1f23dfc78e334e9ac4a8ba37332cb8b86f4e787738c1c77005016d84302e1ec7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703708020, "uuid": "0f0ced67-1283-48c9-a896-664093d5d822", "value": "T1D0B4E0196BD844ECDDEED27A1DFB59A833F2C18AC5425F0F1604B5366C2B327229939C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703708020, "uuid": "3beea32d-e34e-4993-9aff-e680473792fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703708020, "uuid": "41089137-7dad-424f-b2a5-0b9ab1f2de6d", "value": "6144:qftBXrQwh2qszMOFGoAnfDqvARWvCgsEKPNDyFe1ux6cf8AyBuAWOmznxsT:wtBEwh2DP8hnfDQBKgQ1eF9v0XPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703708020, "uuid": "2893d547-5e94-4b6d-a0c7-2b0b22b4a054", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703708020, "uuid": "0003ede1-04e5-4682-89be-26c26a735944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703708020, "uuid": "9b6c4460-e857-4997-afea-33b9e03dc494", "value": "SecuriteInfo.com.Win32.TrojanX-gen.32142.10062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c940a954-a4da-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703697008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703697008, "uuid": "33cff148-4814-41be-804d-01506b9e4cbb", "comment": "Malware payload (RedLineStealer)", "value": "c833507635537e50f5e884eb8242fea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703697008, "uuid": "1917737d-06b8-4e9c-b363-3ff6813c0525", "comment": "Malware payload (RedLineStealer)", "value": "de3b0cedbb0ce19fed2c76e7b1d160e8580644820ef5ef4d4e843379fd4c6289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703697008, "uuid": "c1cedab3-744b-4a2a-af12-c9e5491b9839", "comment": "Malware payload (RedLineStealer)", "value": "b2f9169c79f74f8c32adc2c33c95b5072c2665c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703697008, "uuid": "3383af3f-7f64-40a4-af42-ba5e4b2034f0", "comment": "Malware payload (RedLineStealer)", "value": "a2f086472100e9d6b180dffd3222a93cf4718d065854165097c504963eef7a9b296a4b227ef712b0c80e2fd19724cf34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703697008, "uuid": "ac1e96ba-57de-4fbd-a645-8851e372a53d", "value": "T17A03D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703697008, "uuid": "8ca78add-2856-4fc2-b4df-c0e6c091f5c3", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703697008, "uuid": "139a9135-3316-4937-ba85-4a78ca6c7870", "value": 37994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703697008, "uuid": "397ea8eb-8e61-4cee-8443-a1d830cfbc79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703697008, "uuid": "70a4c90b-e7bd-45c7-ae04-72ced2bb0dc7", "value": "c833507635537e50f5e884eb8242fea0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e565c254-a48b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703663125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663125, "uuid": "3a230c6e-3107-46ba-aa7e-97a7ec32b415", "comment": "Malware payload (Mirai)", "value": "8e5b0d7006344855f8cca1287cce1baa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663125, "uuid": "96f9b0e9-cd02-4fb5-85dd-3f138442f7e2", "comment": "Malware payload (Mirai)", "value": "debc274224ad72b8c9351ed18ad8791b834ce00eef2c5b5e566260f7818bc285", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663125, "uuid": "a46cecaa-9ec4-4e2f-83f7-8d3d9997f33a", "comment": "Malware payload (Mirai)", "value": "916572df7c49f09d007383b8dbbdcd2a3061533b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663125, "uuid": "11eddc2b-b5e4-437f-9548-07d48c2dd77b", "comment": "Malware payload (Mirai)", "value": "310a3d7d62c575df5b172e9b2ad7bf52d97ce082f2f03af9cfbffcd63bbfc05d2a2da048012bfd3a0482b1db35ca2408", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663125, "uuid": "572dd690-900f-46ec-9c69-472872b7b8f9", "value": "T1D1E2F111691684BEFB308471E0F6858677A91BBCB9FEB0A65462060DDCC2A4253E1BDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663125, "uuid": "a824b536-e97d-4afb-a5f4-01060bcbd97b", "value": "768:TEKkUgXAnURCr6HmDFStmYtHq9q3UELdp:/kEn7uHEemufLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703663125, "uuid": "600c2812-ba9b-4bf1-876e-16a3fff66c5e", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703663125, "uuid": "78757e0e-15dd-4590-8ac0-b1d8561152cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663125, "uuid": "84d89e4d-c64c-4af5-9e9d-a0973625c383", "value": "8e5b0d7006344855f8cca1287cce1baa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a0003a-a4a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adwind)", "timestamp": 1703674450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674450, "uuid": "423657c6-148b-4e4a-95b4-398dca25fead", "comment": "Malware payload (Adwind)", "value": "bd0cbc5f71ff982e78195f68169b3dad", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674450, "uuid": "ceb51a80-9860-47fc-bf73-db0b2aab08f5", "comment": "Malware payload (Adwind)", "value": "dfd7f418c82f6680a31cef2ab30e5507d7b60d4eeeabcda0c5696a4d9dae5656", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674450, "uuid": "6256a0a9-f3ab-4d1d-ae64-f61ab38d23d9", "comment": "Malware payload (Adwind)", "value": "51b4b8421d9563662e61607082c651a1d86f741d", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703674450, "uuid": "3a4d6613-e445-4ceb-8fd8-ad285b6b0c43", "comment": "Malware payload (Adwind)", "value": "a91bb65c3dad35adf09e73215c3a699961880dc609b7559bd48018c04c893d1be6cc6006d0fedc38f53b2663802216fa", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674450, "uuid": "a87e0a3c-1aee-4c55-bd92-bce8228788b3", "value": "T1FC0423B65BE09CE7C2C8C8326F7C63F5D9E551ECD49E013687000E8B99C26747AC26E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674450, "uuid": "5c0fb9bc-1b90-426e-81fa-ca70d8fb6969", "value": "3072:sOT4c7+gvv7p6M0xJszE6Ton1pN+NDwYJwU886NfZffW9H2zy+K08r3G57IDQfSM:p3p0sg68p6iU88ou2z008rWBarhvFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703674450, "uuid": "b3280eb5-3f72-41e4-a37d-81be685fd14f", "value": 182593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703674450, "uuid": "c2fc5ad7-9612-47ae-b39a-ac02bfad8104", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703674450, "uuid": "d38eb0b4-355e-4299-93b1-6a8fafdd080c", "value": "bd0cbc5f71ff982e78195f68169b3dad.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f332e73-a46e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703650444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650444, "uuid": "2188eb9e-a748-43ee-9812-82c8565cbbe4", "comment": "Malware payload (RiseProStealer)", "value": "730be47dec20386ee8c5ccc55a88a6bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650444, "uuid": "3a8d3651-b196-44de-973f-d3365204c400", "comment": "Malware payload (RiseProStealer)", "value": "dfe53a3643313201394d6393ef46447a32968d7a8003139921f3a63996a6f683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650444, "uuid": "fbd60edd-6405-4001-95fe-33904b3cdb3d", "comment": "Malware payload (RiseProStealer)", "value": "d643c647409ab15abe36105c3004d49279745184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650444, "uuid": "ccb18aff-dcf8-48b7-a48f-05193b39e8f9", "comment": "Malware payload (RiseProStealer)", "value": "6ad498138b6286c2c5bcdf7153bf415c1a1391d491b89ed4c0bfc4160446816230bf3bbf9edae8d0284952014ddf387c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650444, "uuid": "2c4c24ae-7e52-491d-8aef-bb4909581bb3", "value": "T17F9523D3E2C2543BC8B5AF704CB626E356397D928938971B2F51790619630E4DE3272E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650444, "uuid": "a41fa288-d677-4b56-a86f-0dd4ac5a67a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650444, "uuid": "7dad7c45-8223-4384-8346-51c174aadabc", "value": "49152:P3AqnjC2FKN2PNK8XJ/+2wiEeLyxS9gOsGuefn:vAqnZ3lh+G7L6MgOsGuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703650444, "uuid": "ba4585e6-da69-499b-8276-e1396852b38c", "value": 1990656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703650444, "uuid": "b47f3bb4-1262-4726-b4c6-9fdf9dd6007f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650444, "uuid": "0a59e8d3-1814-47b7-89ce-3ec990ea4fc1", "value": "2WEXTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256220e1-a501-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703713483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703713483, "uuid": "0c240e21-de7c-49a7-a092-220c02239c84", "comment": "Malware payload", "value": "db9e47eacbdb9fc1b04a2527d6e22a8d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703713483, "uuid": "56c55cbc-e909-4ab0-b925-84488e634e09", "comment": "Malware payload", "value": "e0b2457491a8c2d50710aa343ad1957a76f83ceaf680165ffa0e287fe18abbd6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703713483, "uuid": "73c7132b-8f6f-4194-acdd-684eda523caa", "comment": "Malware payload", "value": "89ff501d3d2fd1cfb63bb1155dc31cc1e04f682e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703713483, "uuid": "b513f3b0-1391-4c60-a367-5bc4cb44d037", "comment": "Malware payload", "value": "5ca2325edafaf33234f5cf0a81ce69fe0a13d247b2d4a44973df14dbaf5deb015d8ca00a86a112a0e47f065a865cb94e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703713483, "uuid": "4480a2a1-54e0-4100-bac8-ecab15601623", "value": "T116257C0433A6D941CB3C57F46AA7CB173B2092B3F6C9878EDBAE5D722A1BDE444580C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703713483, "uuid": "d6ef1675-9051-4e4c-af6e-3645313b9bcd", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703713483, "uuid": "8f4ac097-d9ac-4ebb-81bb-bdbc191a2b1b", "value": "12288:Ijk33J3QmxerXYYeuX4M/f4EhdcBJJKUIgq2P8XN1U4ojXYQQt7MHz11H4MQ:+kp3QmU999PcEYqsSbU4T761", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703713483, "uuid": "152bcea0-582d-438d-b79b-b303de4cc2f7", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703713483, "uuid": "f9905839-d73e-40c6-9289-dde01244995c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703713483, "uuid": "9ed56f32-818f-4ab0-834c-35f0adc1cf5b", "value": "RABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZMCSnYqZbH7HcMvxjERUPNWK__CfsBHmMXRMEQhWPc2NKL8fVfZAcwjtYgF2pRkEFPYYUDWQG.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7da9f99-a4cf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1703692227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703692227, "uuid": "d606284b-d1d9-4f0a-8c4b-d37f299bbd4a", "comment": "Malware payload (Adware.InstallCore)", "value": "eb2acb140b00c0dcec4964976f94faea", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703692227, "uuid": "cf0c6694-1dc3-4e07-bae5-28cafeb93e4a", "comment": "Malware payload (Adware.InstallCore)", "value": "e6571fc9b2aca47203db797dddc23ff0dd2de96c6ec92053d5701b375142279f", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703692227, "uuid": "a07f3ae4-f0d1-4c8c-bdf1-62e8fcb329b6", "comment": "Malware payload (Adware.InstallCore)", "value": "9d3c1eed002c1011415c96289bb1405830acdb0a", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703692227, "uuid": "b55172b9-3128-4c6e-bbaf-e23f56450b74", "comment": "Malware payload (Adware.InstallCore)", "value": "c9f47f2488ca35d084f0b60665048b35c5f14b3076a6c50ceeb1de7759a4abc7fdf2144c4347d7b7ddd6edce57efcd01", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703692227, "uuid": "48a432c5-9379-4941-a936-f687d7a0fcbe", "value": "T142F5334A59509B3DC31247B06A247063CD1BEE0BB9EC0CF57A395E98EFA1F708B553A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703692227, "uuid": "91391fe8-168f-4ca5-ac3c-af45025b71c8", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703692227, "uuid": "3f205d6f-b1ac-450d-a43f-f0c86e2ae1f2", "value": "49152:qyvUVHk7gw9ODhpyLznWIxnMz5VCElDfOsfH5M3twPoZr6H2lD6:LvOE7xOsznWIxMz7CEtfOsRM3lD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703692227, "uuid": "12357b0d-5eec-4ffa-8b43-3e6b4c0224c7", "value": 3432168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703692227, "uuid": "f958d34b-6640-4c40-b3d0-7cd97dac80ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703692227, "uuid": "9ebad829-a74d-42d8-800f-d6edce2e4d92", "value": "malwareterminator_2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faff9ddb-a4d4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703694514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703694514, "uuid": "bef6b94c-8e29-4add-9709-1664c876f806", "comment": "Malware payload", "value": "15d7973fdb4e7371f5a6c9e5ed25053e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703694514, "uuid": "fbcdb785-3af7-4156-ace3-8e061d3f71d6", "comment": "Malware payload", "value": "e753b5d6bd89199f58269c75b0f88872e387f24fbc6f78f46e3bf2ae64e5163e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703694514, "uuid": "033faef1-e28e-41d0-b603-e028a3b5ba76", "comment": "Malware payload", "value": "8c7f1757b0057ea3682bba5ace88fb654dab6383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703694514, "uuid": "17604379-5267-44a4-8f06-593932cea69c", "comment": "Malware payload", "value": "26e87e5694836cb4e2e08efd0088a4ef4f28d19e196d5e61ed2eddceb57ee1c483e34773643dcdf83f6b1754b7a9f98b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703694514, "uuid": "161ab5ec-1792-4607-83f3-1b487a6ab2ae", "value": "T157052922B2A08B3EC3721B745D16B185DD26B9133EE4ACF636F81E0CCE75D716926391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703694514, "uuid": "28746f47-0b24-4aac-87db-4c77c29193a8", "value": "5ee7bf9f6582eaac86f806e2514790aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703694514, "uuid": "d624d26e-df97-4b3e-9fee-eb267c8bb992", "value": "24576:gIZg+uiirPO37fzH4A6haDbcUZEbdT9TaWwtQ2X8yx9Z2:ggqrPO37fzH4A6ha3cJ2XlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703694514, "uuid": "05a21ea9-4d46-4ea0-adf1-7b1351bf24c7", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703694514, "uuid": "57e64e30-c52d-4b54-b072-4fcebb4a5568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703694514, "uuid": "9d0c472f-787f-4d9d-bf21-e09c606955f1", "value": "malwareterminator_2024.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdf3e86-a49d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1703670627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703670627, "uuid": "b4c7891e-e631-4d92-b95e-321ee11349f6", "comment": "Malware payload (Amadey)", "value": "81ed47a991b51ac416d56e87a29a9e1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703670627, "uuid": "5fb40354-616c-428e-baf3-a200d1fb8085", "comment": "Malware payload (Amadey)", "value": "ead72d1eb42fc44e002ff76e006620db8308a34c3dd728df0fc26905b149ae29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703670627, "uuid": "33c7d7fc-938a-4120-a381-ba4077e303e8", "comment": "Malware payload (Amadey)", "value": "0532b1052beed07bb9243e819b4dd5c3343120eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703670627, "uuid": "657baac7-437f-4d64-978c-1f3130ed3ee8", "comment": "Malware payload (Amadey)", "value": "110b7a594c0e9f2b8880e45953aec8d2bd16ccd5c035f7a75f0a58de9730ed2c975740f1bd87918a4e05ab53665f6a43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703670627, "uuid": "9290665b-55ec-44ed-8623-d5d01ff56e0a", "value": "T1E626338064D0FD1DC2F2653E9735D3D21D1FBA2384D68502FD9665AF8933A67B0CB82A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703670627, "uuid": "c9046ccc-66f2-4739-9209-5566f3dbbbca", "value": "6ea02e00483c90b3f210e2d517ab619a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703670627, "uuid": "e35ad1ae-f597-4301-a292-7de4aa8a692e", "value": "98304:Weekh63DHMYli6N3ZngCekllw5HON7IZGwTT5MCMBwxQf+0b:Weu3DHJ9RplwxOqEA5MdWxQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703670627, "uuid": "44751638-0fd5-4b87-88a2-8e2555f30637", "value": 4610912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703670627, "uuid": "98d79b2e-cc29-4e2e-ab0b-5f86f407e054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703670627, "uuid": "080a5b18-db11-44a8-96dd-98049543ef39", "value": "81ed47a991b51ac416d56e87a29a9e1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0e1879-a45b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703642257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642257, "uuid": "43ed4b1a-0c53-4b8b-a67f-32ae6971c361", "comment": "Malware payload (Mirai)", "value": "244baa0dd45c01c1325fd7ed8cf5f50c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642257, "uuid": "89baec86-f31c-47ff-826c-5387b4e79662", "comment": "Malware payload (Mirai)", "value": "ec689dff4b94b660d01a35adb6fa0b30b51443b054df191695857062f153af8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642257, "uuid": "79116733-ecb6-4329-a998-7046f5fb9ede", "comment": "Malware payload (Mirai)", "value": "d19c2a8f13116e988c15af0dba73cff81d17adc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642257, "uuid": "a55b1223-41db-4ae9-9456-15962a57a419", "comment": "Malware payload (Mirai)", "value": "ea0689688b643595b285d8a73551fe587d16fd51523e88f280159bf729a0d020aebb7c7b99d7bc7fe16e7d2637943349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642257, "uuid": "c273b3f8-a6ca-44c9-8950-2139f53e5dc3", "value": "T1F353E9627C926A2AC5E063BAF6BE418D332167B8D1DF3217CC212B057BC551F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642257, "uuid": "6fdd20e9-c249-4f2e-b08a-56590da70292", "value": "1536:wmHfUXVywKHMIeVOeKSs2KlkaLFgiZuiKjoh+tTnm:wmHfUl1IFMiKEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703642257, "uuid": "ed74dc1b-626d-42b8-aba5-061357417857", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703642257, "uuid": "54c86451-0347-463a-978e-fa66b3f543b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642257, "uuid": "c2a989af-c194-4be8-b96c-66d90ed29992", "value": "244baa0dd45c01c1325fd7ed8cf5f50c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9013d099-a466-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SpyNote)", "timestamp": 1703647090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647090, "uuid": "20e7a23e-b1ca-4bcf-8fdb-ab35d972083c", "comment": "Malware payload (SpyNote)", "value": "aa6b00e409304c8a520aabb3f1ff2ca4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647090, "uuid": "1e2b453c-893d-4216-8645-24d492fbf782", "comment": "Malware payload (SpyNote)", "value": "ed7390b95279b2a5467c566c2b839146b6578230397793840c48af07ca78c3a2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647090, "uuid": "5a790dd3-20c3-4abf-8754-9c8c54a2cd32", "comment": "Malware payload (SpyNote)", "value": "e929e6c56a3032c68763ef319e0f4d036c850046", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703647090, "uuid": "0b967883-727e-4277-ab1a-acf256c4d049", "comment": "Malware payload (SpyNote)", "value": "5bc1d3b3a0a3cadccd7e32e554a676275bf1589d26873f767effe80fb7ec37f84c82f55eba6f6ecdc9a96b1c80ae6973", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703647090, "uuid": "587ca735-536b-4fb4-953a-ebd524b13112", "value": "T159A6125BFB08A427C5B782368A7D474379574C6586A3C7EB2910B12C1EB7AC00FE9E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703647090, "uuid": "f18f424d-d600-434e-ae1b-0ef840f49b57", "value": "196608:GRM015n31j1r8wvIVknYtfoc+HmdbHIMq+GpBgzc0NUYhc2:Gu033F1Y+Ytn3o+Og5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703647090, "uuid": "aaa921b1-6d01-4170-b3de-165b5a026b2b", "value": 9869516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703647090, "uuid": "91c27735-727a-454c-a783-aa24d7d79458", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703647090, "uuid": "deffd527-eedc-4c27-9296-dd880178cb34", "value": "Quick-Search.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d287dac4-a48b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703663093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663093, "uuid": "8bbeccf8-b8f5-41a4-b559-6deff77ed5a3", "comment": "Malware payload (Mirai)", "value": "61e7a91dc5ab5cbbf65fc87fd28bc90f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663093, "uuid": "277a3246-01b3-4973-81a9-56b741ab3cc5", "comment": "Malware payload (Mirai)", "value": "eea6cfb14cd331da41cc53eb1ac33280aa38c1820b81daa40e75a32b5329f8ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663093, "uuid": "708907cf-8ff3-4e85-a0d4-273e8e5d1804", "comment": "Malware payload (Mirai)", "value": "b776517f7229caf16e825d63c5d807d0121ca5cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663093, "uuid": "5ae16bf0-e522-4474-933b-b3ac9099b084", "comment": "Malware payload (Mirai)", "value": "2a2bec7259647c8c1a0b3f0601cd147ea52c17dd8d257e4b70cf690b96181512f192d9f6b8aed67669eed83b20023e53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663093, "uuid": "01f5043d-ac45-40f0-8dab-32650eeffee1", "value": "T1FFC2E0A1E1B62EC5FB3A6E901FA5C2C177B04E9EB777CC9225589F08086321B47096C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663093, "uuid": "21770aba-0e72-4eba-91c5-f860ca1cd568", "value": "384:lQez9/6Jgn9yMGEGHV4u/DT8HgPEt6seDYc/OxM4uVcqgw05VxJc0p8:yG959yM0HWubJsWDYcGe4uVcqgw09S0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703663093, "uuid": "a5639239-dc8b-478a-b804-16356d9de5d3", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703663093, "uuid": "d9d91b0f-8556-47d9-82b6-c29ec8f884a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663093, "uuid": "d9898b3b-f999-4ef1-890c-a2989bdc23a5", "value": "61e7a91dc5ab5cbbf65fc87fd28bc90f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8816146-a50f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703719797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703719797, "uuid": "14f6afc1-a5be-4fec-9599-5138d4131e1c", "comment": "Malware payload", "value": "0b3c248f579a8f5865972218e63c3b34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703719797, "uuid": "0d7762a6-2af3-4636-a9a0-7fe06a8cb02f", "comment": "Malware payload", "value": "ef6edacf6ee1e0dd2e53046a91ba84d10a8adda6918ca7aac6e96ead432efbbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703719797, "uuid": "81b7ff70-c330-450d-a066-f4e0983985a7", "comment": "Malware payload", "value": "54f1ddaeff6595997f1fb55dc56acfc032a56616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703719797, "uuid": "8963169b-cd09-4c0d-b191-8e66a12dcf5c", "comment": "Malware payload", "value": "d26e4d2b4147dc7b1db4cb40a73699e8fc1e91df2fe1bebeb69cbf891e0d67cd44b9925b7afd41d887e931c7e4135671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703719797, "uuid": "dd7c32da-5f2d-4184-ab67-22da60c0c4b9", "value": "T159B64A47F95045A8C0BAD134C6664262BB727C4A4B3077D72B50F7B82F73BE4AA7A350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703719797, "uuid": "f7066aae-1ae0-4113-99ea-f555abab3b0a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703719797, "uuid": "7a9441a0-db3d-4ea5-9425-922c268ec95d", "value": "98304:CFS5S20uKttNYdJpKEiZGZBRA5RAWAtxhI:C8qLSpXiI/C5CbhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703719797, "uuid": "b55bb07d-3b42-4d6b-bf71-042416617ff5", "value": 11424768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703719797, "uuid": "96159992-4811-48b8-8e7e-041ae9e9df8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703719797, "uuid": "e91ab885-5a1a-4876-89fa-04b04e79a87a", "value": "drvsysx86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469ac93f-a45b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703642242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642242, "uuid": "19bbea58-73e4-4f07-b0a6-fbd0a58020c0", "comment": "Malware payload (Mirai)", "value": "b504a1e060ca9a3cb384529e54c19a58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642242, "uuid": "edaf069d-369c-42ff-9c96-0571605f9cdb", "comment": "Malware payload (Mirai)", "value": "f6b7897b68d7e8332daf7d9542e6bc6192d9d1338f9e008c724c8342ac2ec1f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642242, "uuid": "029c19c2-efff-42f1-8e2a-91920e92a13c", "comment": "Malware payload (Mirai)", "value": "bd3863118728dc58555ac71ba98dcf3ba1321c64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703642242, "uuid": "b462198d-f43f-470e-afcf-56173efe5bb8", "comment": "Malware payload (Mirai)", "value": "ee383a217dd2dd8fcb60585b439f8d967ae31b3963c5be70f25b168218db663e5c14ff42455735b017b83f51160aea70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642242, "uuid": "8831286d-0457-4d21-bde5-3db3a2d94799", "value": "T1FDE34C56EA818A13C4D527BABAAF01893332A75493DF730689185FB43FC6B6F0D77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642242, "uuid": "0cb0f294-2f74-496e-bd59-2224627913b9", "value": "3072:cgxYi2gojQeTWKrsRdx4KDuw/2yCmkdG7u+bn52xK1lXJ+/7xVdhqh:XxYi2gojvTWK4R4K50G7u+bn0x8XJ+/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703642242, "uuid": "253d740d-b405-4ce6-ba33-6ddc0a294c66", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703642242, "uuid": "9f870962-b6e0-41bf-914c-de965a56d34a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703642242, "uuid": "125e061e-e60e-47f6-ae7f-5368c3d17077", "value": "b504a1e060ca9a3cb384529e54c19a58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c014dc-a4aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703676310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703676310, "uuid": "8de9ef75-2567-4756-b8b9-a6437eb24f66", "comment": "Malware payload (Socks5Systemz)", "value": "04b6b79639f019af03e54093f8973875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703676310, "uuid": "a8b42a73-24b9-4cc4-ac61-e9773973ca44", "comment": "Malware payload (Socks5Systemz)", "value": "f9307b1c2231902df6670ed44331655d21e285d1c308a81fdb52174a186a9efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703676310, "uuid": "6404baca-6b83-461c-bf4d-083342351b26", "comment": "Malware payload (Socks5Systemz)", "value": "2cd30b0090f594e138a2e9ab30888badd8cabd4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703676310, "uuid": "54e99035-15b4-4eb1-a8c5-83af90828667", "comment": "Malware payload (Socks5Systemz)", "value": "f218c77e7f393ea97fd1d033d0b8c54bb329a01fb534116280b156f4779e8522ee5389168ff3f34467a22a11b1047adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703676310, "uuid": "1abe3bc4-ce62-417f-b373-b9549c381ad0", "value": "T1F104CF2238F085B7D6F3567158F4A6B46A7FF8626BB190CF3358072E1E212C59E39352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703676310, "uuid": "2b1f3d12-312e-4285-b1ec-88d9237a323b", "value": "226f094e604304801c804017f22986fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703676310, "uuid": "15c41069-b7dd-4dcc-8e5d-ed6e4dc070e4", "value": "3072:EI/S0eLF7AMak0iwl9NvommtwSDeskz5RfIGELgEE6Jm:3/S0eLF7APZiUfYerIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703676310, "uuid": "82d2df1b-1659-4de5-a3cf-8d29de3f385b", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703676310, "uuid": "335842ff-d70b-4563-8858-fc6d1fa92d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703676310, "uuid": "7d3070da-b579-4101-9159-589dc7c7d100", "value": "04b6b79639f019af03e54093f8973875.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a223922-a50a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703717410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703717410, "uuid": "82d2ec66-9ab9-4289-9c16-e11bbb68fbf1", "comment": "Malware payload (LummaStealer)", "value": "abac394d636e41916f68f52c94c57467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703717410, "uuid": "e591b707-36e2-42b1-9359-db5f1bf17c2c", "comment": "Malware payload (LummaStealer)", "value": "fadbdef4ac6830e0934a591995afc7ab329fad81102bfe6e3c1e27b5b0e3d738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703717410, "uuid": "7ef022cb-a602-481c-bf9d-10d32e1d5425", "comment": "Malware payload (LummaStealer)", "value": "34267fe10d37d23191f369511adc7e37086d49b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703717410, "uuid": "2a8dc586-fa33-45ad-aebb-c7bccd54bf09", "comment": "Malware payload (LummaStealer)", "value": "d11c5be83456735e2a34ad974900ea13089e91a4edffb27129cd252611d6a61eac293aac1fcee4d132756879c822f225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703717410, "uuid": "d4b144ff-99ce-4dd9-9513-06b8c3c05273", "value": "T10CC48DC17A4290F3C4912C340124AA7B2E781F729739DCFBC5572892D6B5EBB92B6137", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703717410, "uuid": "9a6e5700-0f91-4e54-aaa1-348cc2b1c521", "value": "87276645a61980fa58d8085fc4df7bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703717410, "uuid": "1798a3e3-f2fc-43b2-9962-704129a21ffa", "value": "12288:WFi0ZFfd5Rl1kU4nO55r/fI0vXkw1PBFpCzZJPgRpVdbMF:WFi0fd5Rl1RJ1AZk5FpaLIRpnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703717410, "uuid": "9ebf1965-7d39-4daf-9f3f-3f52b7800728", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703717410, "uuid": "903df19b-5675-4f84-a165-8b9e7d4f701c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703717410, "uuid": "2c84717e-d08a-4180-b4a0-ac02c2260020", "value": "abac394d636e41916f68f52c94c57467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75e563c-a48b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703663101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663101, "uuid": "6c5d2cef-fe7f-4a7d-8a47-6683fdf06bd2", "comment": "Malware payload (Mirai)", "value": "b73259e662e7073b76fa528dc5f26a8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663101, "uuid": "51981ce4-1cb5-4d76-8b5d-7d27021704c9", "comment": "Malware payload (Mirai)", "value": "fb2fcc6f0e7ff36f374a778e6ef4d3f74a7e503c5f1412f2b2a6a0d2012ffc93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663101, "uuid": "b2297187-79bd-4b0c-a178-196d319fb568", "comment": "Malware payload (Mirai)", "value": "a4c9e5344a6ac3a0f222bf5c47e87f728a964eed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703663101, "uuid": "a64ac657-6a1a-4d79-8e77-76ce68a602a0", "comment": "Malware payload (Mirai)", "value": "bb5f72a34596ecf5dc051de75df4a713bae86fff604e4edb1f45a6b23bc0a82c04133f91bcfc75e4632f47283f41d4eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663101, "uuid": "867ff8fd-aa46-4fdb-93a2-c46efde046df", "value": "T11CB2E162A1863E72D770323AB97CCA01477B57F8A4FA7275212477AC4BD2C4614B414E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663101, "uuid": "5d99f27c-37b2-4cfa-a3d3-39294e68af0e", "value": "384:eZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdE2hymdGUop5hKi:hX1De9kONQG5xD+jHMDzuDs3UozYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703663101, "uuid": "2578f9e5-84a2-435a-9bf6-c801462f270c", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703663101, "uuid": "ffa64bea-dccc-468d-bd07-dd0eea215f18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703663101, "uuid": "157736c3-5c4b-4c9d-a447-3a72cc70d08b", "value": "b73259e662e7073b76fa528dc5f26a8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b67f15a-a46e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703650411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650411, "uuid": "eb2f0948-2135-4126-b006-9238b83cf73f", "comment": "Malware payload (RiseProStealer)", "value": "a9504f03b04d581cd601af67b8becd3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650411, "uuid": "f29319ff-ca3b-455a-930b-dcf8e5114593", "comment": "Malware payload (RiseProStealer)", "value": "fb85a6a090bdb61fd8f3c13faf205ac39fd66f9ec01025c855058b9a88b4318a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650411, "uuid": "d2218bef-e8d3-495e-a4b0-7bc6a1447a17", "comment": "Malware payload (RiseProStealer)", "value": "6b2613bc458e8c09c81c10977a8e3f20cfa30bb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703650411, "uuid": "a1c34254-741f-40be-a6ff-a27fbbfe17aa", "comment": "Malware payload (RiseProStealer)", "value": "1f3cf31c857fd59f78d54a339f0fc3dba0d55cc576ca328e8001083a43ed17c5e443474e9828039faafb67a451fe8b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650411, "uuid": "3fde1099-1437-4f59-a35a-f51663c8ac9a", "value": "T175052322B2E8D567DDB1437018F602570B3ABD609D78935F3F986C1B18F2A946A313B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650411, "uuid": "da73ec30-1c91-4dcd-a2cd-dd55c3bd68ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650411, "uuid": "3ad8b824-218a-40f6-9137-00bd8183f2c5", "value": "12288:0MrGy90qlrZ/Y4KJX2jzRDqCegsIrHCOzxpU4ybbUr1tLjEiULkbX:ayYrCe54xpU4eu1BjPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703650411, "uuid": "e19e43f5-eb5a-49d5-97e2-499d0132a286", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703650411, "uuid": "b11878ac-0692-41fc-9996-aa4c36d8e1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703650411, "uuid": "fae18d5e-704b-47ce-bb6d-1fd6d7f73579", "value": "WEXXTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94f76e5-a512-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703721006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721006, "uuid": "9bac729e-33e7-4eda-8247-4125393348ff", "comment": "Malware payload (Mirai)", "value": "1416b2256841302ff30afe61d0a566fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721006, "uuid": "38e91f54-2768-4b4f-a26b-dd96a636e3e5", "comment": "Malware payload (Mirai)", "value": "fdf1c3f78a7f6ba8a8ac8ed6bd00cc599e43f5428a32373cb8c75a9d3cfd05be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721006, "uuid": "75384154-8762-489e-a8c5-61356d834aac", "comment": "Malware payload (Mirai)", "value": "c2efdbb572dc1dcf2d03506cb04962a99c98cc05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721006, "uuid": "4de4d901-5db4-4d23-8d13-197a09225c6b", "comment": "Malware payload (Mirai)", "value": "8f31ea8c12f1ce2ac2df784b829fa3111b136f66a84052a4a476e3f510a99efeb07f2ffe169052ebd3aa26ab1a2d4452", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721006, "uuid": "4b626cb2-5ba0-4584-9791-018b256aaf9d", "value": "T17E735BC4E1C3E8F5EC111978307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721006, "uuid": "f9f7f507-d55b-46be-a7d5-bfad559d53ce", "value": "1536:b/DYQYs1ZokODichCj15UzOHIt09bfsH18ruUGDKVQSi:zDhzUkODichCjUzk4090V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703721006, "uuid": "d979754d-eee4-47cb-aeb0-80e305ccf9a2", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703721006, "uuid": "8aa9ced6-8575-4dae-8f33-af635b7797de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721006, "uuid": "b8f89fdf-fa37-4723-9016-db8388977a4b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }