{ "Event": { "published": true, "date": "2022-05-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-07", "timestamp": 1651968182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c87210b1-656a-42d3-9977-9ea5f31e16e4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aebb3ca-ce0a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651930306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651930306, "uuid": "f6b4ff36-1f52-46ee-ad83-008e39e62cb1", "comment": "Malware payload (Loki)", "value": "3ee53296f4dcbedff6c1b1f5114d1e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651930306, "uuid": "e7e80c25-fbf5-434b-84bd-4aaae2cab353", "comment": "Malware payload (Loki)", "value": "003396c210cd293040ce599f420766798d59dac5529e72ae8a390fa2f41df8f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651930306, "uuid": "d20a2cd4-b979-4e9b-a926-4486c43db9c0", "comment": "Malware payload (Loki)", "value": "c60eb6686b51ac0e62ea36f59c90e7e08ab22295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651930306, "uuid": "9460eecb-c25f-4f04-a932-7fa18d9b9eb5", "comment": "Malware payload (Loki)", "value": "86d1b638249b6165da53598e5351e9b0900df01d3e8cfa2b995b4123098a74c194c144f79c9636861d561b2e2e5ab5f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651930306, "uuid": "0d5cb15f-091d-4668-87f8-110473231827", "value": "T14DD3F1A836B1C4B3C5721A721D7B8B1656FAED063474A31F1B507F4D3B33681CA6A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651930306, "uuid": "2ae2647a-34fc-4a8c-baca-e68212b04224", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651930306, "uuid": "0c7107bc-03cc-43ce-8d6f-d194f96869e0", "value": "3072:z1NjcVVnLpPuObqpF0lypiyOeUe7S+Ia3F8bwDGUHeQi0NVB6l:pNeZhq30l2i4PJ6byn+ONVB6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651930306, "uuid": "ee4ff33d-b2ce-42b5-9397-17f7054d4797", "value": 133946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651930306, "uuid": "ed4ef0bb-c0e8-4a3b-bd9a-2544461054de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651930306, "uuid": "b31bc329-c870-465e-8853-942f81dd1ac7", "value": "3ee53296f4dcbedff6c1b1f5114d1e8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0db6ab-ce5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651966762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966762, "uuid": "35d5ffd4-944b-4bee-ba58-8209769a5333", "comment": "Malware payload (Mirai)", "value": "c43a1cdca4de77c4f77a0c734619913c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966762, "uuid": "22b7eecc-8f3e-496b-a6c7-2844d168fb89", "comment": "Malware payload (Mirai)", "value": "006be40fa99fda1a7340f784d561dd19be337bd186d32f11e7bb3637be882fa0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966762, "uuid": "485dacff-7f88-4f4b-a62a-0a9178a4b055", "comment": "Malware payload (Mirai)", "value": "dd1e87b54560274ec0edc1f5d2d54c8fd5c15f77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966762, "uuid": "fd88b578-8211-4d46-b2e6-faa0da57a393", "comment": "Malware payload (Mirai)", "value": "ec14b0c02428de4d04840791481c985f370b2465f75f569448111fb8d76d3a36286119eef9b4301bdbdbe7e0a87f25e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966762, "uuid": "3bfa3f81-dc7f-4af1-b7b7-933cf6eb422d", "value": "T139C2E08DEAECB85BCE5E6C7A819E52449A8AF08136C707BD2F954CC8E335517360D46C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966762, "uuid": "471cc709-c6d1-41a7-acda-8933e5ef16cf", "value": "384:FW+ETVLoV9mcN+pCgDjNl06viaEG2yd89s0rZkE3pylsHpW4son7Et7aG7SiyyR+:FmJLomcAGaEX/9sIp4dVonU+G3Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651966762, "uuid": "c073fc3c-fcdc-435e-90f7-49c108455f49", "value": 27172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651966762, "uuid": "728ec0f8-28c0-4049-a272-9baf1b29ba8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966762, "uuid": "64871f6b-e0af-44af-9e2a-44fd9f210f14", "value": "c43a1cdca4de77c4f77a0c734619913c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc849c7-ce01-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651926718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926718, "uuid": "ca82b056-7162-4a0f-8444-89a38c642d7c", "comment": "Malware payload (Mirai)", "value": "c67440b3a418ba8f7d690880801288c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926718, "uuid": "782a4b75-d989-4840-becd-1831c5668acf", "comment": "Malware payload (Mirai)", "value": "006ec0ba7dae589fa1715776ed68519f2fb356555935c0108bbff43edfa4d45f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926718, "uuid": "ecf0bf39-22b5-4895-9867-c4c91bd315b6", "comment": "Malware payload (Mirai)", "value": "adff9a67ffdb6048938d5b262029f4fe5e56c1e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926718, "uuid": "2fd7f027-ca12-406f-9c7d-4c741461759d", "comment": "Malware payload (Mirai)", "value": "aba06af3bdf941fe607cd6827a215bf94dcb70aa94ae2fbc9ab4cb9f108f7e653624d913c149e5f587731c822e6eb24e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926718, "uuid": "74edb6c3-b0d1-4dda-9f97-24bec8a3e905", "value": "T11AD2D03060CE86A1C2B44A3BE279C746353A133590FD318971AA073CB3ED61EF6B9192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926718, "uuid": "1da893a7-12d8-43d1-ba0f-f574a333b60f", "value": "384:aiSmdW3j+7uhaqX73NABByaUmigwEplS/DQSn/FalH9NG6hymdGUop5hu:+m97uVjNu9tvplajn/FSRs3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651926718, "uuid": "5e753301-2edc-4fc3-8b51-12ff17c01992", "value": 28628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651926718, "uuid": "c8741dd6-a92b-4c6e-b39c-698df49c765c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926718, "uuid": "3dbcbd70-e69e-4d0d-9497-f7f72e1f8c18", "value": "c67440b3a418ba8f7d690880801288c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8544b1aa-ce32-11ec-8e58-42010a9c0032", "comment": "Malware payload (TeamBot)", "timestamp": 1651947692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651947692, "uuid": "432d37d8-4c15-40cb-8acc-b29b6f7e2a08", "comment": "Malware payload (TeamBot)", "value": "ac86bd180a6e7e76d80c948942b2b694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651947692, "uuid": "4e940da4-583f-48de-8c8b-e7894ef0b205", "comment": "Malware payload (TeamBot)", "value": "01e17ec27ece9f0895819c70920849b40689c9d231501261ddb4a172029908b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651947692, "uuid": "5a2aa6ab-739a-4e11-b2b0-5e032d77a119", "comment": "Malware payload (TeamBot)", "value": "fd99c03a6acda9cb247de782d18e8bf947a16a5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651947692, "uuid": "7f6346bf-a466-4d86-8505-08000da5714b", "comment": "Malware payload (TeamBot)", "value": "dea666598eadb579b348581992067c4aa9cef94e34eb8411afcb06192bebad36804fabb4f351048ad926941be834cadb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651947692, "uuid": "780bc777-1d67-4b94-9a09-430a57337140", "value": "T1FC44AD10FB90D034F1B716F0897583A8B93DBEA19B2455CBA2D52BEE56346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651947692, "uuid": "7966dfea-3868-4766-9f6d-79fe989f2d4d", "value": "bd6c087e94180526f5f9f8579d4f2ad4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651947692, "uuid": "b4d891c1-67d9-4c2c-a20b-4ec2ff581fb4", "value": "3072:R/7dSrx5P1fX2fMK6FwuCSMcae6whulR2fNPe1WntZjuBE658xxBAMkWPB0zc+VY:W1fX2fWFRdMNe9uj201K41Y3AF5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651947692, "uuid": "aac0a981-edbb-4858-8b7b-914e2874ae3b", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651947692, "uuid": "1cc86051-8c15-4e77-b0cf-9cc7f2980337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651947692, "uuid": "132d5ae1-467c-43fd-9918-812fa0d475ca", "value": "ac86bd180a6e7e76d80c948942b2b694.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e295f8-ce58-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651963805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "a3b43aba-a4bf-49f4-93b6-87fb55968fee", "comment": "Malware payload (Mirai)", "value": "6ff68da4f718ea3956f60da869d0c9a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "f94f82a6-e08f-4062-adff-b53a766b40f1", "comment": "Malware payload (Mirai)", "value": "024c06660d313cc19d20c4ac7c8aba2d0e149d0bdc26494679b015cc80da07bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "8378d77b-01c5-4f9c-beae-7d04cf97faed", "comment": "Malware payload (Mirai)", "value": "8013a632ac97b833e942c59340beb45eaf83e3d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "2efd8534-5c4f-47a0-8e68-27dccab32806", "comment": "Malware payload (Mirai)", "value": "7c9cbb3880822c42873b6eb124507095fbbe575740c7937e4b2a6435394d019ade3f3f625b1f690bb3b541eb3e181ef0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963805, "uuid": "314e59d1-ee14-4075-8998-9632d59a0a55", "value": "T1F5D2E1B17249D491CD506973C9245763EAAD08F832F67AD34954C2C961FB21A0AF9F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963805, "uuid": "cc12218f-04d3-4435-a84a-9b5aa25bc759", "value": "768:nXmWG04Z21LnEDfyQlPujtGpBC7vZ7xWs3UozY:nXmWG0S21LnEDfysfyvZ7x7zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651963805, "uuid": "31114e18-762a-42a2-aefe-3f8d00e8c10b", "value": 28968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651963805, "uuid": "29ebf36f-7d43-4b5e-bf41-e4f159c71c41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963805, "uuid": "e0643bdd-4479-44b2-a193-ac7455d33370", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb50a64d-cdd6-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651908376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651908376, "uuid": "97b8bc6a-ba57-4e58-95be-f24376339914", "comment": "Malware payload (RedLineStealer)", "value": "64f0d8a589fab279b63711670e3ffec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651908376, "uuid": "b62ac89b-35bb-446f-b21c-15e65e1dc773", "comment": "Malware payload (RedLineStealer)", "value": "05c9fbb603c84f47277231056059895a0e0a77e32c2160f2888e77b83fc1341e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651908376, "uuid": "a3689428-0037-491a-9d3c-b688cecbe678", "comment": "Malware payload (RedLineStealer)", "value": "0889c58a0ff94674716f0a3c44ed5f6994d8e2b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651908376, "uuid": "8869fbae-ddf8-4d44-9f6f-c896db460658", "comment": "Malware payload (RedLineStealer)", "value": "b66be837a3e2eb4be84feb58381b98f02508d1811e244f8108215a400f6de95c39ec5e18430547285fca3108f05a5c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651908376, "uuid": "87e185c0-f894-42c1-8079-89cb9786716a", "value": "T15C5549BBA701E52FF212F031D15D9A25682217312A1FB89B67165AACD32F1C1CE35F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651908376, "uuid": "dbeb637b-a604-413b-9bdd-cfe7b3407220", "value": "9de116a58a6964e888a644a836e6e83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651908376, "uuid": "f7243463-76b5-4c0a-9b17-411d4a02f6ef", "value": "24576:YRPvhi0Mx9XnvIxeCDYg7BDws4fJ/8+cAPGVRAYlAKAde3NQpFT8aUXS0UecKoYp:I3hJMvwxVsgtDb4fJ/8CMihVo3N2dkiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651908376, "uuid": "ec69119b-0295-499a-9e2a-5426d9926e42", "value": 1401336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651908376, "uuid": "e8784df8-5aee-4120-b93b-fb81da7237ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651908376, "uuid": "9b053787-1475-438e-b413-20a1eb1bcbfe", "value": "05c9fbb603c84f47277231056059895a0e0a77e32c216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3284d5-cdcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651904321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904321, "uuid": "c1989af5-3dce-4ec1-afc1-38a2faea8e26", "comment": "Malware payload (Gafgyt)", "value": "33272baafe36f0482da170a1eb12bcf9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904321, "uuid": "adef9a59-145e-481a-8a98-d034f7435e66", "comment": "Malware payload (Gafgyt)", "value": "05ee9e1573b62c46a0db74e7498446df19262a3ae7ece20d58215da51fd9adcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904321, "uuid": "fd941df4-a703-4f50-8641-1d0b4427693a", "comment": "Malware payload (Gafgyt)", "value": "37c25a7b3f86213d64244c864959eccb7f2103e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904321, "uuid": "3dda814c-5994-4903-97cc-ff997157cded", "comment": "Malware payload (Gafgyt)", "value": "0a7ae90f18f8fbbbe12b6419bca940abee53b61a94b7aed087fa05d3b1c9e4b0aba65aa4518a4473249ee02f13506da3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904321, "uuid": "71bf3fd7-ad5e-478b-b078-5fede854c630", "value": "T19CD3C55AAB619EBBD81FCE37069A4501248DE64682D93FBFB2B0C51CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904321, "uuid": "cab763e8-be39-4451-9ad7-4b945992a745", "value": "1536:o2beTpNb9DERkLMurNpZ3efJp68E1wYqSvd00PUmkVmSFxBC7vXZX:o2cNJLlrvJF11vdlPUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904321, "uuid": "004f275c-6657-48f8-aaab-625684746fb8", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904321, "uuid": "226d413a-fb91-4e75-a56f-c7ca2b8977fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904321, "uuid": "c54b25af-d880-4df3-be22-c746c5584590", "value": "33272baafe36f0482da170a1eb12bcf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56dea5a-cdb1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651892340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892340, "uuid": "de28b26e-6db0-4453-8ccb-ab6f944a820c", "comment": "Malware payload (Gafgyt)", "value": "0a6d1de6e6f07b73bc8aaa21e348eac8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892340, "uuid": "1633c12b-315c-4367-ae16-d258c701861e", "comment": "Malware payload (Gafgyt)", "value": "085f07271b02751c87fa69903bb0bf9b5eb718c0dbb603cfe56489f70e95cd77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892340, "uuid": "25ab484e-bde5-4b16-b47b-7f078e58c51d", "comment": "Malware payload (Gafgyt)", "value": "e748d84439d2975c318c26a875629001fecbe0fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892340, "uuid": "811654c7-0e9f-4929-858e-02e3b00d2252", "comment": "Malware payload (Gafgyt)", "value": "5ceae3d7b02c01ae0d9e589ecfd34ba91f4578222a3bfc2a2e6b8b0e6d7cf49a7f648eb641ccd081ab76855500585cc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892340, "uuid": "1f5aa1b4-5a02-4326-9378-0f228b0db368", "value": "T164D34B57AA92CF12C1C325BAFE9E818933131BB5E3DE7103CD24AF6127465DB0D6B125", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892340, "uuid": "bcf84ad7-2967-478f-b960-e11ce6c14c14", "value": "3072:kL0isA+/Jxio8cm8yoawY9G3tbBqv/L746w7:kL0dxb8cvra398rqw6w7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651892340, "uuid": "babe3d60-6249-41b8-ab55-81e134aa0dc9", "value": 137352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651892340, "uuid": "dee65167-f135-4e82-8f6c-c5b865549007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892340, "uuid": "9a424b9c-f21e-4e9c-aa52-422e14d4c4d7", "value": "0a6d1de6e6f07b73bc8aaa21e348eac8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26948b02-cdaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651891269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891269, "uuid": "7ca07215-6ee3-40fb-ab30-f405f13f8229", "comment": "Malware payload (NanoCore)", "value": "17561cb37873e16c640da008549c0059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891269, "uuid": "c2dcc21b-718a-4ccf-85cc-51b713b078af", "comment": "Malware payload (NanoCore)", "value": "0892b24b3879f453fb22152f849805cb4be69d668db3408fa20647ef52eec74a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891269, "uuid": "1b541f39-b030-4dd1-80d4-a6b13e4c7058", "comment": "Malware payload (NanoCore)", "value": "7fd9f58f5d857edec001ae37235d35bf9f6867af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891269, "uuid": "682aaa70-7676-4efb-86bc-b81cfc0aa2bc", "comment": "Malware payload (NanoCore)", "value": "dc502b477bb27f01c142aeceaff6ebd023ccf65a7933441386e82376c8c5a6714717cec1502b54f13d04c8e7a19d4984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891269, "uuid": "43fd3ec0-774f-42d2-a6a4-3e227f5961cb", "value": "T1A204A252BF8FC622F9680B3089A2C7742737FD65BA21464B31D4B7DE3F722815912A35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891269, "uuid": "e4f0beea-1206-4338-a809-4f33a4391df9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891269, "uuid": "fe70c824-13c0-4ba3-8fe7-725b4f6ad9fb", "value": "1536:vi+7fVXaS/BoBtZBFJMIy6HRUBb3NG8J:3Rr2BnX06xOB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651891269, "uuid": "3a33c18a-6a10-4547-9bb4-5b1d812d1869", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651891269, "uuid": "a712e627-17da-4197-8c8d-ef058f1c8913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891269, "uuid": "1c20821d-ea44-446f-b0fa-5ca03d302cf8", "value": "17561cb37873e16c640da008549c0059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e351b2f-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1651904650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904650, "uuid": "d2463222-bd44-46c5-bb2e-9ee7e4d62b8a", "comment": "Malware payload (CoinMiner.XMRig)", "value": "fee3674c120e62835967d2d15b4c4810", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904650, "uuid": "fb8d7a42-0af7-4cf7-b81d-7deef28154c6", "comment": "Malware payload (CoinMiner.XMRig)", "value": "08ccc12312e3e8f0d2bb8d05fcc478a6d4c59ad48b582b0e9e27618642a2336e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904650, "uuid": "138c4313-21fc-4fa8-b150-8a7cbbead46b", "comment": "Malware payload (CoinMiner.XMRig)", "value": "c4659852d4c846d974caacb4d3f5ee32918b2c6e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904650, "uuid": "f536ec85-166f-4865-a32e-109477518bdf", "comment": "Malware payload (CoinMiner.XMRig)", "value": "3e22973d573f7642c43565eaf07732fd99875a9509638d0dafb4d51330c3e005cc5d8024adb9398c8a22ffd885550f3b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904650, "uuid": "645ad667-6ff8-40e3-8545-d9b2e44216a0", "value": "T1BC442262BDB72607D88715B208B06A41EC3FD416F740AE547A7FCD8399F65B190A33B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904650, "uuid": "f96f9913-86c8-4f69-8fb3-42a55bf46230", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904650, "uuid": "f507e0e9-1227-4afc-a541-55e9241b20be", "value": "6144:+BABAdbouCA9dctS6HrFGDrbyyu6vzTr5dNKTToAH6s:+mB0OCW1gDpu6nrcVas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904650, "uuid": "6f11ddaa-d8f7-4bc1-ab95-77a9d10bc8e7", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904650, "uuid": "e2e98d84-552b-4428-bafc-9a15f0a9862f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904650, "uuid": "5af0f9cc-d72b-4001-a20b-fcbeb3c9daa0", "value": "fee3674c120e62835967d2d15b4c4810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9b2e05-cdcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651904357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904357, "uuid": "5d874256-33f2-4599-885d-add9c29330d9", "comment": "Malware payload (Gafgyt)", "value": "094c2d8fcf717192006e8f29ba87349f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904357, "uuid": "e31c7a6d-f652-46cb-8624-22e1199045b6", "comment": "Malware payload (Gafgyt)", "value": "09cb65c3e6bd08e16a2321a19562daf52d87d1f944a1c90c451d9679fc7be020", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904357, "uuid": "9f0b5505-b0f9-433e-9293-cc3edb3af91e", "comment": "Malware payload (Gafgyt)", "value": "b0552f8e75703f8888329f20f2e80a7272db522d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904357, "uuid": "fc95dfb2-06ee-4635-a14a-6c3bebb56b0d", "comment": "Malware payload (Gafgyt)", "value": "912b3258298261042e7ec62cbd2c848ced0182b58d17b500b72bbf0214e7d049842437dc87c204f519f77739f26b74d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904357, "uuid": "e25286ff-d359-49e9-ac8d-f7620699bea7", "value": "T122D3A56EFA12EBBEE16C863107F76F70D39531A62AA1D341E12CDA181E7125C2D4F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904357, "uuid": "228433bc-748d-4e02-9db5-e98cbc1a9f0f", "value": "3072:jGTyrDxJWwAfr9f3yJddxUEJmTDmjOrWcpu3NJFARtRVJhGvaZqhZYiDhB/ZZ9B7:C+nZSZrnJeUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904357, "uuid": "387b1894-c0e7-497c-bd21-2cc52f8de4ea", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904357, "uuid": "76ec1085-0d5a-4175-a1ec-74efe9b96c8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904357, "uuid": "10afe4f8-bd9e-4dab-99f4-b10e7fde1245", "value": "094c2d8fcf717192006e8f29ba87349f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650e2f5a-cdb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651891803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891803, "uuid": "617e1aad-1d42-4d63-a29b-059c0309ff14", "comment": "Malware payload (Mirai)", "value": "983f1317a7ff7fd4e658d0c201f0aea5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891803, "uuid": "dbf61589-f390-449b-9d40-cb032df74de6", "comment": "Malware payload (Mirai)", "value": "0bd4197fedbf6b3141427067f548d1acd65c5924f906ff3246602e8258e62b72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891803, "uuid": "b1ccf37a-cb14-41dc-ac54-8e51d6be92a6", "comment": "Malware payload (Mirai)", "value": "c7f1c80e0f5fb0a73b177a8e9b11065d2017fb72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891803, "uuid": "83002b61-ca10-4d63-8bde-8406ca27a9aa", "comment": "Malware payload (Mirai)", "value": "a5d6536476ae259d6e09e9a31d2c251eb484e18398a4b1e5aef8b683e8e67aca75f6e8489c0983d1d0adbbea8232d9e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891803, "uuid": "b844149e-619f-40b1-9ddf-0269ff856135", "value": "T152C31A09E6A14787C6D537FAF68B524E7323875473EF2306C9245AF43BC1BAE5E62012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891803, "uuid": "4ac0a188-52f6-4aff-b730-220c5f5ddbdf", "value": "1536:DPnO3LYvKRQlHVd41kvR2zthyTc2lRy8Ii7bO6Q59/353czyo2q8zw/9Cg0KBJPB:mLYCAJvR2zth8RO6QT/3Gzt2dM/9yGPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651891803, "uuid": "da157ecd-4d7a-4926-be36-44cc12aa0498", "value": 126215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651891803, "uuid": "96850c5b-bd2f-499c-b2cb-b879fcb8c1ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891803, "uuid": "a983c830-0c73-4de2-92ed-eeb5a1fd080c", "value": "boat.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a394c8ec-ce01-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651926697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926697, "uuid": "00d2dfad-be54-44c5-b2a2-4b2db790d4da", "comment": "Malware payload (Mirai)", "value": "ec0f6365bb2ffb968ab43de82d3b0ca8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926697, "uuid": "f41ad05a-705f-4a5b-9008-81bcdc6775be", "comment": "Malware payload (Mirai)", "value": "0bf66e9a43c2743bacc7c885dc345834a8533bbdea0891fd73acf69fc3c90df0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926697, "uuid": "27204145-633a-42cc-ab99-e11f89bced1b", "comment": "Malware payload (Mirai)", "value": "da69113d7f224996c6f6e85af633e5fffb04a3da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926697, "uuid": "eeb06468-651b-4562-b331-f881a5f6ceed", "comment": "Malware payload (Mirai)", "value": "d695320cc909793baa139b042c9c6e2aa7dad62d597e0459ad7a24d52d7579e93f05b5441995acb9246229ad3e0325ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926697, "uuid": "8db9adfc-4409-4aac-ab7e-949636401c27", "value": "T133E2E114D9666962CAA0423F4C7B074EB7C74BFA967F603B162D521A70D7C434C99192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926697, "uuid": "d46dbdde-9298-4f63-ba7f-29cc442ac43a", "value": "768:6HKy1RIDUOZmu0JAwRHPL4vPq7y3T2w9q3UELTI:6Hh1RElEHPcXqOTWLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651926697, "uuid": "bd3158f1-a809-466d-9af7-efd220b5dd1e", "value": 33596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651926697, "uuid": "8a8f0163-a368-477f-a2b3-4a13f70eb81b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926697, "uuid": "c5f5a10d-ceee-490b-b3e7-cddb59e449b6", "value": "ec0f6365bb2ffb968ab43de82d3b0ca8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69f47a2-ce2b-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1651944795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651944795, "uuid": "9fc3eb22-ff45-4021-a479-09d95eff5eaf", "comment": "Malware payload (GuLoader)", "value": "9ad99cc088f351ad7df466e40f1e12b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651944795, "uuid": "f82504ce-3ee0-4b0f-b8a9-63d3dfcd15cf", "comment": "Malware payload (GuLoader)", "value": "0e7db572ddaf60250fbb8ce46bc1f5de5b35a32fffd3460485ee160a8873bad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651944795, "uuid": "ce379dba-4679-4331-bad3-e90dfd4c561e", "comment": "Malware payload (GuLoader)", "value": "569123053558c04c5775c9dcec01d34dfd14a63c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651944795, "uuid": "9b126732-5fb9-4818-a7a9-ff2352faf025", "comment": "Malware payload (GuLoader)", "value": "01e68691b4e4bc1c87966bf28e5089ec52afefafaa69a1ec8fbc1ac7ab6c71a0301492cf26859483e9826987510ae16f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651944795, "uuid": "05845118-1a94-4b4b-9565-0a1666e678fa", "value": "T13C64F5C0E98495A1EC19AB306A36CD3556237DFDA874941D29DE3E2B3FFB2D3502A053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651944795, "uuid": "6cc6dd32-b925-48a6-a933-10ec9468dc93", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651944795, "uuid": "6dfe5f7d-5f83-4720-9219-cc6fa829b0b2", "value": "6144:LYa6VzAkzL7r9r/EDppppppppppppppppppppppppppppp0Y2+hSNT9hmw:LYnlP7r9r/+pppppppppppppppppppp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651944795, "uuid": "15d281f2-5c38-4ad9-a6f8-82b7bb225851", "value": 307856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651944795, "uuid": "c14601ae-91f4-41a4-b507-e0e15bcfe5ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651944795, "uuid": "d9acb606-990e-4315-a4d1-d294217d3ba6", "value": "SecuriteInfo.com.generic.ml.1686.30320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5abd71d-cd98-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1651881684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881684, "uuid": "256eddec-3ae9-48fa-b596-96edcc154659", "comment": "Malware payload (DCRat)", "value": "22f8e48e5344d337d0993411f4128df7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881684, "uuid": "7603e7ff-a155-498a-81fb-448a74877375", "comment": "Malware payload (DCRat)", "value": "0ea4f67aca805ae8edbf5504cb49d5c313315dfd855cc493c227e08eb2429680", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881684, "uuid": "7ded9e22-7b99-4a85-8121-3a55c2cab3f6", "comment": "Malware payload (DCRat)", "value": "3383b9227ec90eeea152d600c00e493cd412b4ea", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881684, "uuid": "6dea34d3-6259-4948-ad77-e35c4e96c263", "comment": "Malware payload (DCRat)", "value": "79adb2447c6ccd109ad7577b7b581d35d448dee53b503334286f34e2edfff4ad7fe7f84609288cf8ce7291330c634666", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881684, "uuid": "1f6e59a8-f8f0-40af-bb6a-be3df8fb07ca", "value": "T1C6753349601563B2EA85FBF284CB0A27FC8F44F2617B8704A0552E76DEF6BF865705C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881684, "uuid": "ea84a694-d9c5-473a-a0cd-276de0c57dc3", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881684, "uuid": "189e1be3-0ab6-4357-88aa-b5939dc980ed", "value": "49152:cD9c3ZoutJypyZKbsMa5qZaT8XftyBUsIzoOF3dnrmB:Y9AZoCD8bsMkfwXUjIzoOfnrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651881684, "uuid": "14add8f9-84d6-4071-86d9-531393a4b502", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651881684, "uuid": "b83561c6-b590-4a6e-ad63-64dafef5cf0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881684, "uuid": "140657bf-a370-421a-b29f-62cd4c8719ca", "value": "22f8e48e5344d337d0993411f4128df7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980992f4-ce0c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651931402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931402, "uuid": "4bce00f5-7f3e-4d3c-8786-f67cdee8596f", "comment": "Malware payload (Gafgyt)", "value": "629e0b05c95c8b863562ed443c88dfe4", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931402, "uuid": "fcfee7c8-44f2-447c-9802-934350fec915", "comment": "Malware payload (Gafgyt)", "value": "0f176b1f33abb3a3a3764766216049cb28dbd84e6d8b3b1f29745f944d6f3c06", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931402, "uuid": "d8e992b3-deb4-48c8-a89c-cbe4cee50f4e", "comment": "Malware payload (Gafgyt)", "value": "06fc460fde368692bdf360380b7f828d1c2f0aac", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931402, "uuid": "4ad0207d-1c18-4adc-a305-54e6d884dfd2", "comment": "Malware payload (Gafgyt)", "value": "48522ae067f588f6df42aa4ed8519302ed1fa120babc03ff4e09f405a915684639ef262e42820288aff3d20507d5a988", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931402, "uuid": "120d12f7-808b-4232-bcf9-96f2c36676bd", "value": "T1BBF2F260569FD876C6AC107A6DDBB9061A31FA37098072B3C9C87227CBD8E185834E57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931402, "uuid": "dd217b7f-a2f4-48d5-aa2b-f9408bb17ff5", "value": "768:eJ/IXdyNcf0FRSk5SR5oNys8Q9b41fpWYtwnbcuyD7Uiyq+:eVItyjRF5Sqys8Q+urnouy8Zq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651931402, "uuid": "c569e6b3-a6ac-4152-8746-ab32b6834f2d", "value": 34460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651931402, "uuid": "8e797ea1-b09a-49d8-b980-2205ac93b397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931402, "uuid": "72daa1e6-edfc-42a4-9abe-bf7cb6b3a5e4", "value": "VIANET.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6658bff7-cdb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651891805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891805, "uuid": "a24158f4-898e-4618-8243-fcba4c5830b8", "comment": "Malware payload (Mirai)", "value": "41783dcde44e518cb2f6b86d36e4f5d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891805, "uuid": "0f3ead2b-a028-46c2-bd78-3508ccb48cce", "comment": "Malware payload (Mirai)", "value": "117d63cd098e29467fabf02345075a31c4cd735a18119e9206943f43e0e105ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891805, "uuid": "96652bb2-a03b-4f86-81da-4c4e91e22c15", "comment": "Malware payload (Mirai)", "value": "a064901d7aa8a442321f2be1b13a1846652f32a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891805, "uuid": "3c91c3bb-e3a4-4633-bc2d-926dfbda5639", "comment": "Malware payload (Mirai)", "value": "1ce317411605838ca4dbc5ff8b09fe57609782dab32b75144dd7bf80c5731f27f9a9a3929353f8870abaec69800bb2af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891805, "uuid": "8018c9f2-3e70-48bc-a812-2a6d5df1c9f4", "value": "T1F1237545F9FA939BDBD572FAF608228DB72D8694B2EF3117DD31059033C0E6A31A9064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891805, "uuid": "762d468c-913d-4410-b3e9-196ab1693232", "value": "768:fwdVeub9gooSjNOd7PizgEkfJDxbRUupbd8+rIyliXUVvMXvH3:4dpbKo3jNOFPXJDxbRfgylYY0v3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651891805, "uuid": "4269dc8c-8a97-4b67-affa-b3c3d6648fb4", "value": 46736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651891805, "uuid": "1ee4ad9b-92d4-4e4f-b911-f9e185ebc0ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891805, "uuid": "b001befa-b7db-46b7-b0de-896bbc6158a4", "value": "boat.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a28b3c8-ce01-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651926681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926681, "uuid": "b7ff9be2-25eb-4a3a-a9b0-6e4ffa5ee078", "comment": "Malware payload (Mirai)", "value": "0daa7a017adaa67850d4f77c2ff970ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926681, "uuid": "d03d51bd-e3aa-4ce8-998f-66b5ebe602f6", "comment": "Malware payload (Mirai)", "value": "127a270f035fbadc82c9613a049bfa68aba77628903a912e2961ed71767b9eec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926681, "uuid": "49680333-d092-4e4e-8930-74a4ba40c1f9", "comment": "Malware payload (Mirai)", "value": "b1b0155d93f02fb7747dac211cd5ff4611f2ddcd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926681, "uuid": "12519ad8-1b6b-43bd-818a-298b5bf44852", "comment": "Malware payload (Mirai)", "value": "cda54bd38da21db2c39cf7d3f6422acaa76607505db2c16833cf7afe744b85bffc2c04ad45784f3744e3817782251a21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926681, "uuid": "ed4796da-858e-420a-8797-13f76d6d8e13", "value": "T10CD2E0C2B02B9514D608633DA4BD29CD9ED70CABDFB5D0617385ADA62B6743B6730F10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926681, "uuid": "ae153517-b56d-473d-a287-01252757799f", "value": "768:cM4lFxmmZidb7Zg7LA3Cqs6dT3G0fOvM4G:jIFxhiZ7Zg7y/Y0mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651926681, "uuid": "155df876-57a3-4b5a-8132-18c2d1e2b1e8", "value": 28920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651926681, "uuid": "84a3f9dc-ab6c-4ed8-8f24-24e68ffc0c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926681, "uuid": "e60b20e4-de1c-48f5-9e18-6424464c6f86", "value": "0daa7a017adaa67850d4f77c2ff970ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9898aa86-ce0c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651931403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931403, "uuid": "5ace7827-a6a7-4ab0-9614-62f704ad71b1", "comment": "Malware payload (Mirai)", "value": "fcecb76bdd63df7d8cb0391fee3c98ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931403, "uuid": "bcaca2c3-2583-4c23-afbd-d6d412c9387d", "comment": "Malware payload (Mirai)", "value": "13e3b6f38bc2272b9fbe8fde9674be109c9764377d59c0d2de4c69ed31de5828", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931403, "uuid": "838a5e57-4600-4be8-85e2-8222bb71d3af", "comment": "Malware payload (Mirai)", "value": "57a37cdada87af3d8899461eb51129d99c4be44a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931403, "uuid": "35a61a4c-181e-48b2-9cf0-c8e1353b5827", "comment": "Malware payload (Mirai)", "value": "1498dae565d12bdb073a646feed76f015d3b1137f5d1b8e88f8af93c9b7895f59722fbb7fe0c0b1456c0624da6cf641e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931403, "uuid": "052560e0-616b-4cec-8f5c-82b5e98d8b3f", "value": "T1D143F130E5894BD1CEB1DD7521BEC6D33B0C93ED536AE2726A180AE1A287152BA1CC16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931403, "uuid": "56a6fc11-8495-4186-a58b-6d6839fe925e", "value": "1536:A6rwnVPsWe8HG+seKMJz/Si64KQWnPckJDDmg8rwS:TMKMJRWnzJDDmNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651931403, "uuid": "26ef4ce6-651e-4dd2-9555-68a8cf249fde", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651931403, "uuid": "2a834b59-cf3d-4c4b-9c35-a9cffbc7300d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931403, "uuid": "96e31c2c-7a3a-4260-876d-cbdc51b3a3e7", "value": "VIANET.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534fa6ea-ce1d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651938588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938588, "uuid": "abf3d906-7a46-4853-bbc3-9c773e55e75b", "comment": "Malware payload", "value": "222d7e0aafcf566d7c932b43590f982b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938588, "uuid": "bcf06ea9-2e86-4d42-8adf-8014ce7bdd1e", "comment": "Malware payload", "value": "15f530d3a423b10d467d8b7a94a79da8e6ec1d34c6ede0f0988a43eb44c8110a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938588, "uuid": "1e812850-56ba-4d54-b9df-3ce8591e624b", "comment": "Malware payload", "value": "de97719d33ddb20e883323444bdc9641c2682bb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938588, "uuid": "233a5d6a-d681-4854-9170-d9280075489a", "comment": "Malware payload", "value": "02f9f760bdd981c8a100b8fd6a97edc699485eb263e7c74f3d5c8406abe309b18d5827ba714268a15c2c8eddbeae3834", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938588, "uuid": "b53420d6-88d8-4304-a7f1-84686111e376", "value": "T18803E139BA54915CFC690C73C15F0BF029750BB4E09B9D8A8EAA64D6CC830AD6C226E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938588, "uuid": "37310d73-f24f-4c07-ab19-7a977cc47b7c", "value": "768:Z9vCitxteFx8htZ/jXnM77e4YYJmLvws4nNXAJEAcYii8g5NJmJgGlzDpxYsS:Z9vCueFxSY7lNJmLroNqES8mkVrYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651938588, "uuid": "d756fdb4-52fc-41c6-a598-bcefea880cae", "value": 39220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651938588, "uuid": "f4ff931c-89e6-44be-a38e-cc1c71f6908a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938588, "uuid": "ea48a2b3-4201-42f9-a726-f289a96de0cc", "value": "222d7e0aafcf566d7c932b43590f982b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0ea638-ce3f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651953263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953263, "uuid": "2723e0bb-6316-4e77-8fa7-ba0e4820d39e", "comment": "Malware payload", "value": "c80699b863f1a779919effc535ccb3a3", "object_relation": "md5", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953263, "uuid": "c4bd916a-cf50-4ecd-b0cf-50922da2320c", "comment": "Malware payload", "value": "1668b3b4f7c882da40eadb9105dd6b052d6feaff71e7e0931f38fd174e66d353", "object_relation": "sha256", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953263, "uuid": "d669d4e1-3c33-4067-b14a-44afaa2d167f", "comment": "Malware payload", "value": "0a51da562a0cd6c72407367ca4d94d592b297d06", "object_relation": "sha1", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953263, "uuid": "10d68e29-319d-45a9-9c0a-8a9b4c538db5", "comment": "Malware payload", "value": "02ca81bfed3853f94ff1feb9d079c0a98e33d2022d703e9ff0a11386a36f2f0e914bcb2fe0100e7fbdee4aaa96953845", "object_relation": "sha3-384", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953263, "uuid": "93ccf616-cca9-416a-9d7a-aaa5b217baf6", "value": "T16C42F107BCF9F0280ED427B6859BD602B148348BB5E5D8CD7EA9E4F3515EE88371C845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953263, "uuid": "1dcf1d70-6874-4418-944d-a3e4cd6e372d", "value": "192:isUYke9Q3inimKYMqPH9FT+nhEnTfRpu3uCC/NLES9H+uimZPVE4U73Q55imZfrv:nmNxLxV+L0pyuXfXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651953263, "uuid": "f946e0bb-6104-4bf3-9984-dfda772ad831", "value": 12025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651953263, "uuid": "df184550-3660-4d79-879a-2c166458190a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953263, "uuid": "bdbcb96f-df74-4b6e-abfb-6fd2e36886a3", "value": "G0nnaC0pe.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6cb9eb0-ce4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651960203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960203, "uuid": "1140047c-fec5-4844-9c0e-2dc015f37808", "comment": "Malware payload (Mirai)", "value": "c19f0ae2cc653559afef3024b3df9886", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960203, "uuid": "8ef7eee6-ec6d-4a53-b3dd-dd0017edb50e", "comment": "Malware payload (Mirai)", "value": "16ad14056993e86f4dcd7c3cd3b2b792d1459f9b78b72bd15d2b2140e5b5e606", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960203, "uuid": "edff39db-19ec-4c63-91a4-a1b54709986b", "comment": "Malware payload (Mirai)", "value": "a0f59826a49a4e52047b3b14e39771184a3c52f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960203, "uuid": "e2e7f382-bc52-4f43-82b7-54849c605436", "comment": "Malware payload (Mirai)", "value": "8c26d5d35d1da453295b3ca4816519b3b63576fd47d3ded8b1b69dd39a9ca9a55ba28b61f1d35953afef16165694091f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960203, "uuid": "7500da0f-bfa8-4810-be9b-5f31ea50ffb5", "value": "T19163F1F0B6536A36C7D10AF6C8E080C61D3786F4E016E5133B514CA9B696BAA3BB4D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960203, "uuid": "4971705a-ecd2-4ae0-ad93-34979e2341ee", "value": "1536:+dJjTDCz3MAL9l1Pb0IxhLTQDv3DZ2zEFtU0nLTmXhGwu/GYUA3lvb:+3nCzFhr0IxhLTQD3DZEEDU0nLyXhFdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651960203, "uuid": "eac63381-8689-451f-b468-cc8015051b39", "value": 70044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651960203, "uuid": "0ce86f08-91dd-4251-aa2b-c647e104ab5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960203, "uuid": "e880175a-4756-451d-963a-a19d5bf8b188", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d9216e-ce61-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651967745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967745, "uuid": "72027e03-3606-425a-8352-62a814f9fb73", "comment": "Malware payload (Mirai)", "value": "670509747f943040f1906df04267d8e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967745, "uuid": "6d8d6fa5-e565-4b42-a02b-e9251a943fdc", "comment": "Malware payload (Mirai)", "value": "16f6c8bee806ed7b01d69d41c98aff5c95d6b8a0c23a1113ec8e3a85420eab90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967745, "uuid": "d6bb10ef-48a4-4b9e-b095-cf41a1bad1ae", "comment": "Malware payload (Mirai)", "value": "ccf1f85118c40401ab6df285083c871e5b217aaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967745, "uuid": "e20e7e0b-520c-424c-a069-7d713f4e94a5", "comment": "Malware payload (Mirai)", "value": "49fc5065e034e565a32ad18daf42d55a8b026bd67c520ea07e57f11f106d8b9cbe822c6c5daecaaad57cd48f33a029a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651967745, "uuid": "0e4f7f9c-c845-43bd-a50e-978d6185896b", "value": "T1013329DBB8029E3EF48AE67A405A4D0AF53122C11193173377BBFDA3BD331549952E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651967745, "uuid": "11354a6f-9891-4596-a35b-efc8e06787e0", "value": "768:3T+PlSBw80MZe8rnZuQBPhdjgFH+cHAEut8L8v8XB7Q1sfXyTdfbonM:3aewWZzbZD+FlHANt8L2qQ1sfiTdfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651967745, "uuid": "eef35c24-65d0-467a-98a1-945abce1e8b0", "value": 53540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651967745, "uuid": "704367f7-d175-4c91-9b45-7897c4011d61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651967745, "uuid": "97a0b107-a0e2-4f77-a235-88e2d021612c", "value": "670509747f943040f1906df04267d8e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80164af-cdd6-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651908370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651908370, "uuid": "660c93e4-9ea1-4154-83c5-3d629e2fadfa", "comment": "Malware payload (RedLineStealer)", "value": "dd42ba83a3bb7b7c538e876525667d2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651908370, "uuid": "d93a3de8-84e0-434d-89eb-60a0924fb17b", "comment": "Malware payload (RedLineStealer)", "value": "18e648f3afcb4ae93860ca4a2a073525e0f088f0595726b6efee6b1a4afef42e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651908370, "uuid": "abebeefd-aabf-4300-a3a7-01af99f115d9", "comment": "Malware payload (RedLineStealer)", "value": "b23d1a809bedb640ffb7e8b2b86117e37b07cdbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651908370, "uuid": "e35afa49-48f5-4791-bb7e-f084654bc46a", "comment": "Malware payload (RedLineStealer)", "value": "c0f16d8c5567f7ff9a09fa817efe5e12e535c4bb41634aa875c19178859e5c883da7a1ebfc0285cb30c3f81accbf5906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651908370, "uuid": "41bf69a4-f382-4435-874a-95688d725462", "value": "T1F984D010BBA0D035F4B711F45579C7A8BA3DBEA1AB2441CB62D52BEE56356E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651908370, "uuid": "a1894a59-f26d-4013-af65-cf699aa546a8", "value": "8418d14a42cfb4088cd49d99ad4e93bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651908370, "uuid": "c9e6fe90-0f72-4a7f-b78e-901517c82701", "value": "6144:ZDIX73PoWm5OLRe4cjafSuT7WpKu/eNDfnMm2S4OwtiFZ:ZUrwWm5qY4cjanT72WNDvMy4OwtKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651908370, "uuid": "ebdf372a-6f21-4cb4-be83-d5c6d15e14fa", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651908370, "uuid": "b8688957-f362-43d3-a1ff-a2faf199df25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651908370, "uuid": "9c7424fa-fcbb-492b-b330-97dadb1172c6", "value": "18e648f3afcb4ae93860ca4a2a073525e0f088f059572.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0478c149-cda8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651888205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888205, "uuid": "a19e4727-ba82-4fd8-b683-5a2a087a74e9", "comment": "Malware payload (Mirai)", "value": "59383fc0b8662992602ddfd6e4758f8b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888205, "uuid": "9baf4cc3-dd4a-47e9-810c-89d4a2b58dc4", "comment": "Malware payload (Mirai)", "value": "1d96415eda91aa561b375773e0ca5fde9761bb6e56c8118e1560c28a84bd01c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888205, "uuid": "581f3e05-9877-40f5-9978-ec044d08a193", "comment": "Malware payload (Mirai)", "value": "769aab495ab918e481d3c3abf9ab15521c854327", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888205, "uuid": "07960343-9e98-472f-a1f6-76bec0893d14", "comment": "Malware payload (Mirai)", "value": "0dde4460d8301eb64bbb1030ecae4f68a8b64c12af1bb095400421f1b696f13915f5a98e4b09decf95b10e343a03e48a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888205, "uuid": "f3257b74-2c0c-4aa3-a4a0-774bc22fe61b", "value": "T17DD33A46FA408A13C4C617B6FAAF41493322DB55E3DB73068D185FF43F86A9E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888205, "uuid": "7d2a176a-1618-4e3c-a0f2-16405152aac9", "value": "3072:OAfRuiVUkjSv4d+TfJvWaFdCAnhsJhL+HeBg4xKql2TVvFhbhj6b5M/9FLW3:df0iVUkjSv4d+TfJvHFdCAnhc+sg4xKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651888205, "uuid": "984a9803-ac6e-4a05-b58b-452fe86d5f58", "value": 136657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651888205, "uuid": "e79fe4a2-8648-43f1-9927-675ea569f699", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888205, "uuid": "de348b7e-1979-4f74-aff8-5e220022e143", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edbbaa4-cdcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651904329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904329, "uuid": "b4133d87-613c-44b4-a988-38cc9215a2e7", "comment": "Malware payload (Gafgyt)", "value": "fb3746e4d941f50aec3bd75852dc1c26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904329, "uuid": "19ea8c40-e100-4401-85bf-94bf3d02e62c", "comment": "Malware payload (Gafgyt)", "value": "20b6377c284ee6ef66d8ee0aa35d58a92f35e02d0d6386444c3e293b94bfcebd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904329, "uuid": "8e6c027b-5b26-45f6-bd31-bd3620515f6a", "comment": "Malware payload (Gafgyt)", "value": "d3840177823b29561f3b19a794c5ce0fbb286873", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904329, "uuid": "331e00fb-0c23-4a17-9bfe-0d054724f353", "comment": "Malware payload (Gafgyt)", "value": "2c090a85fedc69f924d402829b1cddea348901eb8397410dcf300bb60a3107a06c3ca623009811861897d1d47913d04e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904329, "uuid": "97464daa-56cb-4883-b69b-fcb7c232d3e9", "value": "T1F6933A0799A59F77C0C7EAB919EB59300326A8520B2F1F5961386BF4438F9CC740FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904329, "uuid": "6576b000-7d52-44f9-9822-367b5ca6ba9e", "value": "1536:fI7+hcIM9naHAAGtKhmA+J/FosGvJtKqC+DQtmW49VquLeefkcX:YNIMZoAAG0hS/FoHKq5Ym79VquqefkcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904329, "uuid": "814608cd-b3c9-438a-9845-1763f50dd02e", "value": 94356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904329, "uuid": "8a406861-ea63-4e3b-b08b-06ab35a5fb3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904329, "uuid": "0f9f4687-5f31-4a36-bb6c-df68f6019419", "value": "fb3746e4d941f50aec3bd75852dc1c26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1287b9-cdfb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651923920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923920, "uuid": "54c099a9-2da5-4921-801d-cde0cd2fcd1f", "comment": "Malware payload (Mirai)", "value": "8409336b5285be056463c2c30940a19f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923920, "uuid": "35a5e97e-a8e3-4ee9-8fd6-7adcdfd44ecd", "comment": "Malware payload (Mirai)", "value": "21316e79fdd789f33ec493a7b8d8de43a8d74f175e1a0880542bffe02627e324", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923920, "uuid": "d8ff6e73-2e08-43d8-b3f0-38f93ebf320d", "comment": "Malware payload (Mirai)", "value": "0df5d0ca3a83425a548a825ceea51ae98436324c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923920, "uuid": "ae09c131-5fb7-479f-8793-7cce7f4d1e00", "comment": "Malware payload (Mirai)", "value": "38c6c5f50367bf338ef1c1a0ec5ec3947946ece2b58b0b7cc8a5538c59dbd4b2a6cfe33b234af56840417928bb6f90f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923920, "uuid": "b2c7f75f-7efd-4b09-a616-092fcad0d5f2", "value": "T1D063964D3E319FACFBA8463457F39E20A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923920, "uuid": "29d659e3-6c5f-4cc2-b764-1e1d29d1d960", "value": "768:RzZWyvL5MsRXxPx2pqV2Ubz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2U1GecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651923920, "uuid": "e5e2001f-a844-48cb-97d3-058e04f8841a", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651923920, "uuid": "2a62512e-688e-4aff-91e2-358f7bac1144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923920, "uuid": "06aed051-699b-43af-ba20-80f4d80f4819", "value": "8409336b5285be056463c2c30940a19f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659acdb6-cdb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651891804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891804, "uuid": "3b49faed-c568-4f92-a27a-cabdf07f4a94", "comment": "Malware payload (Mirai)", "value": "09182f2d194f18142380f98275986ef1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891804, "uuid": "40cd1b83-a724-4c89-9859-bf96f2e1af56", "comment": "Malware payload (Mirai)", "value": "2149a195c4f8453ddf770f8de250facc6492acd9b1d6751e93fcfca7fe1847cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891804, "uuid": "3a5307c7-41c3-41fa-8e0f-247db914bb72", "comment": "Malware payload (Mirai)", "value": "7206f4badbdf7d72edc058bd56ea330e8e42a4c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891804, "uuid": "4f80a238-f5c6-4ce3-b50f-f03565c04fbe", "comment": "Malware payload (Mirai)", "value": "abe9b10a8abb9ffff627650260012999d8111c907feea9b8a591702ec394b6c91c115857dafdebcb13390ed13589043e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891804, "uuid": "ec76f6b7-6a25-4eab-a9cc-5bf5a73e37b9", "value": "T143435AC5D693ECFAEC010976217BAF328A77F13E2069E9D3E3995922AD46503D40736C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891804, "uuid": "1ccd1b68-345c-4415-9b11-c00967de8dc4", "value": "1536:dq5CIbmgv9j+9tyfH8uba7B6GQ4EjeO1xM/X6:tIbmgvl+9yH/ba7QG9fOf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651891804, "uuid": "7d0340e3-21f7-4000-a409-efe9b91e8f59", "value": 59760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651891804, "uuid": "a63b8161-2ef0-42f3-ae62-3068b89e3f46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891804, "uuid": "1506e682-1ac4-4fd8-b83d-3df1adcd7d8d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837b54b9-ce15-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651935233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935233, "uuid": "95cbd3d2-7bd7-45f2-bdc4-3bcd9619cfce", "comment": "Malware payload", "value": "b3e31d38a6391971f8dbc44e64a49d01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935233, "uuid": "73c8eca6-2a1d-4bb0-828a-553d5eb3cd51", "comment": "Malware payload", "value": "266772997854ffcbdb98323e3bc9f2e43faae24e8330603bc44a9c2b9d40e262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935233, "uuid": "c45a68da-ef68-4546-8b32-0d4ee9b8c4bd", "comment": "Malware payload", "value": "3fa7c4fc90e7b474f06e2e7e243d2384673cace4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935233, "uuid": "c6ecda93-556c-4d65-abee-cdb840c5d54b", "comment": "Malware payload", "value": "bbe15629e56992aeababefaa9954800ab7044f57c0c3ab708ec691266b3184a56d4ad0792583307273ea75b180d947b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935233, "uuid": "81fc8f29-3f48-4dca-b3a3-93ac345b1dda", "value": "T1F2F4F114BB91D039E0B611F08976C774B93E7EA2972484CF62E46BEE56346E0EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935233, "uuid": "0bd85a23-88ed-458b-93db-bfc2dbb48298", "value": "ffc63d9ecf6198940160ad003c5f8997", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935233, "uuid": "073ba281-2983-451e-ac2b-0efa3eb50dfe", "value": "12288:jd5cqmwYnv/+GHBh7R1ZnrGR8bk1BqcyUCHV1o3pNwT:TzFav/hpRXnrGhqcyNHk3pNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651935233, "uuid": "ddad8c03-af2e-4ef9-bf7a-f70e0fffe20e", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651935233, "uuid": "06385673-02eb-4fd2-9b2c-8438294e57be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935233, "uuid": "05840faa-f4cf-4871-bcfc-0443c64d528d", "value": "b3e31d38a6391971f8dbc44e64a49d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6efa9b-cdf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651921045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651921045, "uuid": "d7bd8770-761c-4e23-a99d-7f4ab79b6d91", "comment": "Malware payload (Mirai)", "value": "a7eea4b9980e9caa54a6f46fc9938f9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651921045, "uuid": "f8f96e06-ecb3-4667-a830-47638123ae5e", "comment": "Malware payload (Mirai)", "value": "26745ad0acb78243758ea545733ad08aaa4cc6d9dea45da6d0f8d1adb4e1e6d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651921045, "uuid": "a11bea21-1816-49b9-bf6d-c3d8712c4d30", "comment": "Malware payload (Mirai)", "value": "5c9600610c71d04369f3815408b7645d3bc82f3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651921045, "uuid": "91fc005d-a344-4c62-9020-c0d7d5212456", "comment": "Malware payload (Mirai)", "value": "6520cab42aee32d4a37de1ac0bb977dc31b1628a917859678d1bcf60552fb1c13b0284449b52c2aaf6abb628aa6cad65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651921045, "uuid": "450d503f-52fb-492d-9eb6-6b70eb05db73", "value": "T19A737DC6E983E8F5EC115579202AEB739E73F63A4135DE96E788E623DC01601D60338D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651921045, "uuid": "5c6f501d-644a-49b0-ab95-87be387a2837", "value": "1536:/dFZmnv7rFQJd5YTLVKDoCjio+vBkqRBvj9ND8SRQHZoGBqRSy8h6:/dFZmnvv635YTLVKDbio+vW0BvH8SQHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651921045, "uuid": "b2128272-1484-42e8-ab24-69fdd3caa1d5", "value": 75700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651921045, "uuid": "23b9efe5-3766-47f2-9373-da901ec7c0bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651921045, "uuid": "bab6c6d0-0901-42ea-a2b8-40560c8d29f2", "value": "a7eea4b9980e9caa54a6f46fc9938f9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93c5430-ce4a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651958167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958167, "uuid": "a948f6b4-02e5-4da1-bf14-0493b3a7c820", "comment": "Malware payload (RedLineStealer)", "value": "adb561d66b4e0f88dfb935f2c2db86fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958167, "uuid": "e29dc60b-6d04-4905-912c-b5957330616a", "comment": "Malware payload (RedLineStealer)", "value": "28fe23cfe9b83132313efd561a8ae845f79a190603e1c37b17f756c6683b69ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958167, "uuid": "9f1e1b54-48a8-43ad-b7ba-a7da1c3f8ecc", "comment": "Malware payload (RedLineStealer)", "value": "300a7ca1f21784ad73f5222bb25af4400fb4c2c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958167, "uuid": "ec103c35-5315-4121-9508-1202ecedf15c", "comment": "Malware payload (RedLineStealer)", "value": "4eed80f6b9cbbbd4ad96841dfc617c24c7ce6a478b99c8210f2b5b209892c118fd3ec7aef52998a6f505b06e1da9a9ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958167, "uuid": "cc796e8f-b9d4-4e24-940d-37b745db367e", "value": "T1AD84CF10AAA0D035F1B716F44979C378B63E7EE19B2450CB62D52BEE56386E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958167, "uuid": "c5322415-dff6-421d-a48f-ca975e3ce9cd", "value": "c2f34b03efba3580b2f36c10f3cf4dcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958167, "uuid": "ed7e4d3d-db38-49a9-87e6-7efc1cbd9b14", "value": "6144:s8Zhs2maLgYTIn3tHaebHKXT/wJSzZU3onYekwMWRvRINtqcbuxo:bPIaUqIn3tH1Ha/wJKFtvRwtzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651958167, "uuid": "3a8f1205-d9de-479d-bd96-e7fc29e3c4a3", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651958167, "uuid": "a9f24d6d-74e7-4aa5-85c9-6e82b0c8984a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958167, "uuid": "87dfa572-2152-4c1d-a877-943fefd1e71a", "value": "adb561d66b4e0f88dfb935f2c2db86fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bcf25e9-ce03-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651927382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651927382, "uuid": "67029d79-242e-4fd1-af9a-4c449b0867c9", "comment": "Malware payload (Mirai)", "value": "eb3b2534998315db9b3a5c1f6321f28c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651927382, "uuid": "1d27277f-9297-42f5-bb08-bfd1edc2ffd5", "comment": "Malware payload (Mirai)", "value": "2910dbb914f3dc08e9c3151c5c2b3680df1dbb2ccc7fd45467b40eb8868eacb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651927382, "uuid": "f028ac71-a889-44d3-b24d-e79fa54cbfb7", "comment": "Malware payload (Mirai)", "value": "53633ca6850f4bfacc8bdc1fccefe8b8c48614df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651927382, "uuid": "073047dc-9ca8-4292-8810-8731058224f8", "comment": "Malware payload (Mirai)", "value": "cd66ee0a8976ffc29d65ad111aaf4f7b10fd134c15793ecab88c5b5cf1fa8b4aed110196b466e375121fb01c39180579", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651927382, "uuid": "24f10886-081c-42b6-ad74-1a5976fc1c63", "value": "T1D5738D31AD7A2A67C2D0A03B42F74765F1F2078E29A8871E7D710D1DFF24AA0652717B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651927382, "uuid": "5abe53a2-8524-417f-ba4e-94bf2617b6af", "value": "768:f73N8VyoumJjXxoy9zcXpZ9CNWYij/OvcgzrB846O36NJISG9O+vFmrrTSvR:Dd8VyVmJjXxoyWhN2vnrYOKNgtmrruR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651927382, "uuid": "2a086822-0282-4718-acf7-4a04194a2299", "value": 74800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651927382, "uuid": "9ff97298-784e-42af-ad69-6531ee797b26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651927382, "uuid": "800c9134-4094-4400-b52e-9559c06175cf", "value": "eb3b2534998315db9b3a5c1f6321f28c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1026b8-ce5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651966792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966792, "uuid": "232a050b-42d7-4908-9c99-bc586e481bd0", "comment": "Malware payload (Mirai)", "value": "27d86621277996ce05e75f133703c674", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966792, "uuid": "9e8bd000-4cb6-4038-9857-b4ff2502a207", "comment": "Malware payload (Mirai)", "value": "2f258913c298c640b5a0986ad3eb3954c5954d87dde417831137f3825329cb3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966792, "uuid": "25ef8769-3ccc-4ba4-9812-3274fcbb45a5", "comment": "Malware payload (Mirai)", "value": "991b0e96a334392bec746e9362061484252fda1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966792, "uuid": "24222966-37c5-41d0-950b-d5350103c195", "comment": "Malware payload (Mirai)", "value": "eff8c33cb611d7a25238af83d2caeb5f570ffd0a83dde67f1e699cd87df727a90df75480b0ae8935c3cb78ba34bf9448", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966792, "uuid": "969804d8-fdfc-47b1-95b8-d12ea3f65f12", "value": "T1D5B2D015E0E66D94F79FEBB31ECB3BE11370574EA6465AC32196FF62A60383126486C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966792, "uuid": "a7719eb8-5180-44f3-89b0-ab89af4977c3", "value": "384:QLl0dUqDa4EjXNQTNu5AKeMw5VABDBDdW1XbKJR0M7YSK4mMs3+T9P7bM4uVcqg2:zdZDJkiQHeMoaD1IBKb0i9Kb32P7I4ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651966792, "uuid": "bb319a85-aa75-4e7e-96a2-2c395d464b3a", "value": 24168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651966792, "uuid": "5abfedc8-c6f6-46d2-ada3-063e99d7ae44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966792, "uuid": "fcaf05c4-fef5-408e-91a8-a7dbeecb44db", "value": "27d86621277996ce05e75f133703c674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b1c0d1-ce09-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651930001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651930001, "uuid": "7043a161-b0ec-4865-9241-c42cc35bb0d9", "comment": "Malware payload (RedLineStealer)", "value": "41072e1f2ef020cedb12fd2e12c6301e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651930001, "uuid": "45c46089-25c5-4fcb-8567-4a66e329c3ad", "comment": "Malware payload (RedLineStealer)", "value": "2f6cf61ca279ab22095de51cde942554b9aa1b481d5237f79fa5990ccbf5121e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651930001, "uuid": "2dd909c7-9e01-48ff-b344-6130459b6604", "comment": "Malware payload (RedLineStealer)", "value": "f163ec0a389cb2698619b4bd8c9482a88a527b4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651930001, "uuid": "aaafef6f-69a9-43cb-9375-f6683b2c3d2c", "comment": "Malware payload (RedLineStealer)", "value": "0d89c54b000c7a3c656f17c92ce8d091a7d8812d6bf50034b1aa2290efd9bf7a2615a39c1d033d5c09cc914ee01db4bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651930001, "uuid": "acdf5a54-921d-4006-9bc2-421a439ad940", "value": "T14E85C0D38742400BF162643B802E6E6D75731A3157CFF8B777899BE9971B2D0A628B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651930001, "uuid": "ad8af4ba-828d-4c1c-8ae0-abe6198cb1e1", "value": "e9626794517ae5f9ef503b6366d80781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651930001, "uuid": "c5c2108c-327e-464f-bf85-38c4b514eb60", "value": "49152:nZmWfs0p0jbkjpXtnkq5oc7z+ViK0gd1r5+kL:nUw0fkjpXtnk0T7z+wVIp5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651930001, "uuid": "1b2ed4da-08b4-4f6c-8ffe-9146e7f9999e", "value": 1840744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651930001, "uuid": "c99ca067-58e7-4b41-a983-eeeeb071cca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651930001, "uuid": "1a131511-1539-4398-b3ae-21ada913a856", "value": "41072e1f2ef020cedb12fd2e12c6301e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb63835-cdcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651905189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905189, "uuid": "84eab2d6-5e02-4fa6-ba18-917dab0efea4", "comment": "Malware payload (AgentTesla)", "value": "d03fda0d5ade594e5ea8bc50414f330b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905189, "uuid": "e1040c43-f86f-4158-9659-c5c2f2fb80c6", "comment": "Malware payload (AgentTesla)", "value": "3037a97c468fc375aa2bad100eefae35596417959c450d8cefc0e25fb284867b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905189, "uuid": "ad14df40-5219-4129-afcd-e3bb26bc2d6d", "comment": "Malware payload (AgentTesla)", "value": "822d43586a9c5005999db7ccd89b063e6c7db361", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905189, "uuid": "34380d1b-ea70-4836-b97b-74113354aa11", "comment": "Malware payload (AgentTesla)", "value": "2bc85678c560b88f462915bfdaa7f1e2aa3fd74ee4a0424b94f529442b6bbfbce0aafa0d1c02bb45f6d88e048c23da40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905189, "uuid": "439bd3e4-b538-46f5-8425-6959f9267570", "value": "T19CF42327A82CF77D577D2ECE2657149EEF480084DC584606B5762AEDA84EEC78E0C6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905189, "uuid": "55a8037e-c5fe-4df8-81c6-9b9fe2659a83", "value": "12288:WWU9yGCcyTYt9a0DXtncF18uI8SCVe1noobEc80NBcRmY4s2IPyU80Q:e9OrklO8CUlZbEn0/c74sf00Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651905189, "uuid": "89b3d660-8ea6-4afe-8938-591fcd20da6b", "value": 748280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651905189, "uuid": "f05a3fde-28e4-4b84-9476-b9655dbaeefb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905189, "uuid": "59ffad8f-d8b6-43b0-93b6-65dedc9eafcb", "value": "PO 345678..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4717d282-cdcc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651903779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903779, "uuid": "f84f68d7-956f-4afa-99a2-14b211da5619", "comment": "Malware payload (Gafgyt)", "value": "c08393a6d511e635fb8f9ce44d7924fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903779, "uuid": "392b558b-bf61-4482-ac7e-c669a7afb913", "comment": "Malware payload (Gafgyt)", "value": "31fa9f121ab7bb10a2a3f789c5e928e309912d1d76377cdde1d499524e472cb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903779, "uuid": "2a5c1480-61e1-4825-9a19-bf909d80c4fb", "comment": "Malware payload (Gafgyt)", "value": "a905ad50f82bd19c9c8a906a9fc3b6741f5d0943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903779, "uuid": "46abf68a-9ef7-4a9f-a051-4429636aed64", "comment": "Malware payload (Gafgyt)", "value": "0c4ec60d1e1795f87f2ba9c02f720a2fbcafbd1b72f464cdc3384aea84458a6918a7f7eed1018be0ba80abcc1b5f8015", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903779, "uuid": "51e16198-9fad-4e3f-87ed-f0ee5b27f407", "value": "T14F835C49D747CAB3C88307B2029BBA764532F93B5E2E9E45F70D7CB49B124D87226712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903779, "uuid": "1651acd4-09fa-41d1-b004-2ed3de6543b2", "value": "1536:sQmab6bXPm8VjWWHT0im5t3ItTShKW6GLdUF5MI5Atpgw5UOGHfV+mLI2VOYjXUd:Oab6bXPm8VjWWHT0B5t4tcnBUF5MI5dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651903779, "uuid": "5c8a4aca-3a88-4779-b3ec-d1800a54d28c", "value": 86409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651903779, "uuid": "3aa286dc-2545-40e3-8e31-d743fe1e7746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903779, "uuid": "14e48bd7-7ca1-4142-be76-dd65be5a41bc", "value": "c08393a6d511e635fb8f9ce44d7924fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1b13df-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1651904673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904673, "uuid": "ef42a851-cb07-4c81-a9a4-eb965ea4fe53", "comment": "Malware payload (Amadey)", "value": "5ed6d44f271360b862a1f5a6fe8b290a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904673, "uuid": "41549d81-8dbc-47a5-851c-c6e402005f70", "comment": "Malware payload (Amadey)", "value": "328dc9b2eec9f4d8aff50fe09a9dbdfaac863bdec92a3146a0176495cd72b34e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904673, "uuid": "1c86ec3f-ed2d-4052-81a0-043b9504a66e", "comment": "Malware payload (Amadey)", "value": "f3d7b03d5dc0a68fda4d6e768e7ecceb7fbe5c01", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904673, "uuid": "1403d2ab-134c-4be3-b6b9-cf4f3138eb51", "comment": "Malware payload (Amadey)", "value": "2396d896cc8bb1fd4e73fe4cb17437fa01830c7cb3453735b447f58adfd3c492bf9afea8071a6d11bb61151144d2e9cf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904673, "uuid": "a344db92-8de1-47c2-84c5-a826026106b7", "value": "T168C35C73F1D08872D0B10F7CAD5AE698663EFE202C251557B6E94E4C2D3B6C2296C6C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904673, "uuid": "7badf707-642f-4911-a895-e4eeafbc01ce", "value": "557f0c64436e04f97f66ceeb0911cbf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904673, "uuid": "7405c4a7-e71f-4502-b53b-a4e380dcc43e", "value": "3072:Qx7p5EJTJJn/DL5nr0Z2fgnXKSxN07IXauEed0Kj6u9:Qx7811/DJ0Z2fjgrEeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904673, "uuid": "a2e3d289-c412-46b2-8cb3-e5cc290b6a61", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904673, "uuid": "447be0fc-914c-474f-a4be-6754d0534bb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904673, "uuid": "be1ddf18-13fc-4941-90ff-4464e9f24515", "value": "5ed6d44f271360b862a1f5a6fe8b290a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5776111a-ce36-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651949333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651949333, "uuid": "78ab6fa7-0609-47ba-8bef-baa2241ef0f2", "comment": "Malware payload", "value": "aea07430fa1b09945a77c0912ea742de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651949333, "uuid": "5d2f1ba0-d81c-4285-8389-00c5aa1dc7a0", "comment": "Malware payload", "value": "365a652328f3b3a5b31dbb6b002fc360c5dc8909399320f30d6e9ef257fae675", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651949333, "uuid": "03646921-729f-4795-9ff8-559e23a73c97", "comment": "Malware payload", "value": "699d73dce32730a1d570c82eacef466287471877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651949333, "uuid": "5fe2ed52-8db8-48e9-a7d8-130e8a95ae46", "comment": "Malware payload", "value": "4e43188001a4fd425604b60accd5af8eed5eae133f7b955bb5473a01384f633c382e9bffedfd7b9576b7454a93e6dec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651949333, "uuid": "343fb0bb-9435-4eeb-8197-3647e7b6edaf", "value": "T1F3467C575B280B609DFF1C6E8BC868DD1A5CCDE16F48DB11B257B3E00968DAC4E72B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651949333, "uuid": "f522f615-f15e-4667-a990-dd88faaa0a85", "value": "6be9c40be4f7a657915b4f89b7664396", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651949333, "uuid": "614063df-dc6f-4542-9225-f7df8f033568", "value": "98304:vVGbtuQsn0JOcKxMbD4IkccHuF1dqqkT7c:9M20IOtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651949333, "uuid": "8385b33f-c108-4a2a-9d73-21015c1284da", "value": 5449728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651949333, "uuid": "9c1f34b2-9eb1-4b54-b577-0fe9232428a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651949333, "uuid": "4b5f820d-f506-498d-9118-e5fe97044333", "value": "aea07430fa1b09945a77c0912ea742de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b2f396-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651904790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904790, "uuid": "872a661f-6628-41d8-bd93-38fc7426ef73", "comment": "Malware payload (Formbook)", "value": "964e3365907ec861cb47c142680913da", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904790, "uuid": "5a48af41-3074-493b-b72d-6328c65eba6a", "comment": "Malware payload (Formbook)", "value": "3664c59f198b6e3ec2bc254b9758fe20046b4cddd0a35f3e9c8fbf631c5a8a50", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904790, "uuid": "5fdc4bd1-c011-4b1c-9d45-915c916552e1", "comment": "Malware payload (Formbook)", "value": "b108e94ca73005e9b21f210454fbe9899570bdd1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904790, "uuid": "69de0c5d-fa76-4268-ad02-2fdb898bd37d", "comment": "Malware payload (Formbook)", "value": "84420fe404a5f2ae308c802f82a4f046929ac508270ce0a7e8cbb2e552738c582bdc77628271599358ae21ffe77f923b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904790, "uuid": "7e3b7a5c-995f-4221-bed4-998bf03be120", "value": "T1AF75290E774A8945C844E772EDB32F622BA5D7BA5C416307E3C53A3DD82B3A96D40783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904790, "uuid": "a9bfb75e-8632-4a3b-90fd-5ef423e5a56b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904790, "uuid": "ee638898-6c56-4a3a-b7b9-4aabf2b5f02f", "value": "24576:TRYMfy7ZtzM2cBQIvyMgYPJkGiPXmP7gQePMnv:VYZtNVcO5VXk7VePMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904790, "uuid": "7d87ce1e-9c5a-4d5c-8512-796344d11461", "value": 1674240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904790, "uuid": "bc4522c0-dd77-472e-b750-8be9f333f484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904790, "uuid": "e310ca2b-83cc-4c1a-8a89-7a6fdf579a5b", "value": "DHL DELIVER..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e29c55-ce58-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651963805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "f1828577-dcb6-4a42-9368-6e5d24074cc3", "comment": "Malware payload (Mirai)", "value": "a0abcd78c2d9bc4691cfa75a00c05e6e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "3346beca-0304-4532-8dee-2e69a4979888", "comment": "Malware payload (Mirai)", "value": "3ab0a6c5966a98e898e4f01e69852aa80427b6d99f889005dc1389b6ac1217c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "7a93d7fe-579e-499c-9aee-201e8723cdf7", "comment": "Malware payload (Mirai)", "value": "187b4c19db5da8855e5a74b8c31a22bffa1c764a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "5ba3e6a8-9445-4401-9693-2b35543cb918", "comment": "Malware payload (Mirai)", "value": "77e51e9f6b06292dfa789d785e8c05e0e784ac686b73c7da61df9dc293fcb9554973e251bba6966920ada7dc7e9fbcea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963805, "uuid": "fdc149ce-44ba-4c47-9928-afed9c7857ab", "value": "T1DDB2E014271F793182500A3664378FCB57373BB8B3E3B2992654646CB08F09A2FB9687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963805, "uuid": "42210a33-33ea-4eaa-8c78-9278884da69a", "value": "768:TxlsdGH/ogVlNFp8XOPhdNIdB2ebZQgs3UozPL:T4dGH/oiTF1ZbIuQZQVzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651963805, "uuid": "8e8cdf8a-3630-4a40-a418-dc3be2cd3b4f", "value": 24648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651963805, "uuid": "ac71c283-3634-44fe-bf9c-331f02490030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963805, "uuid": "5988bb6a-431a-419e-a173-cb076bd2c65d", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ab7b25-cd99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651881837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881837, "uuid": "09cee5f3-d24f-4fd6-876c-b68ca9ce9d36", "comment": "Malware payload (Mirai)", "value": "ba4e5800701cb8b9657cfb0a563fc594", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881837, "uuid": "199947b0-e89d-4b01-812d-452fdfc93044", "comment": "Malware payload (Mirai)", "value": "3b5183546e9659cfc08a9fa9217f0f4193b068f1e7d3f929e41c4a1f9aaa48e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881837, "uuid": "907c58ca-98d2-49c1-a0f2-02b37cd30cb8", "comment": "Malware payload (Mirai)", "value": "163792bdabab379b4af98326034a961bf7b2ef43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881837, "uuid": "82689789-ab92-405a-86ff-a2f8b8f822c9", "comment": "Malware payload (Mirai)", "value": "bfae275dad4f1cf9dc15bb42e143c58e0a1f9034885464989797f9df5bc33da6118facc5aaee11ea225589d0595e866b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881837, "uuid": "7cc1329e-f3c4-43e7-91b1-f860120e7651", "value": "T1D6534A52B3180AA7D4930AB1253F2FD15BBEFED111E4F1853A5FA74A8036E33154AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881837, "uuid": "e0d54866-a442-4031-9f5b-7c8a0ed902b9", "value": "768:GLIS8DXipYDi98YsRn3MxgsiSSyCtztj7oTAYckGPIv1oUHWlpDosaDbInWS8w6o:G5qDiy9hMKXNQuDDoVbIWSd60a10/m01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651881837, "uuid": "821e493e-08d7-47df-a2a2-ac58a1382ff3", "value": 64164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651881837, "uuid": "259f7226-6503-4c79-ba72-1e2ff9b3026c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881837, "uuid": "4a3c9464-16f5-4641-81a5-bd14864f5057", "value": "ba4e5800701cb8b9657cfb0a563fc594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9c1806-cdff-11ec-8e58-42010a9c0032", "comment": "Malware payload (TeamBot)", "timestamp": 1651925803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651925803, "uuid": "28a988bf-0b6f-40cb-9f1b-76555d9b3f4d", "comment": "Malware payload (TeamBot)", "value": "c86f8fb2543d689604d438508e413d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651925803, "uuid": "9f13d283-c772-4e6f-9619-3df3f6b9002b", "comment": "Malware payload (TeamBot)", "value": "3b7418169dffd3a0ddf61958493ec5c7baaef6aed97c9327ddf7f3ce2216a19c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651925803, "uuid": "205326d5-7af2-4053-be8c-03097940cbb5", "comment": "Malware payload (TeamBot)", "value": "fc0e7f40cdf4991c1019ae80e47f68b403870e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651925803, "uuid": "911d2413-efa8-44d3-bd0c-9eb5c5462f24", "comment": "Malware payload (TeamBot)", "value": "b923a95d06c4b465859faab9e52911fcdf17419b14b47a788f5a84e312682ad314c0665ccd5bab499585e77b4c5ce011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651925803, "uuid": "0c63ffc6-805f-46aa-817c-4551b7a45aa5", "value": "T12D44AE14FB90C035F4B722F489798368B93E7EA19B2150CB62D52BEE56356E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651925803, "uuid": "85e7c706-68ec-475f-bbcd-3a7c89576b6c", "value": "76ed3e8c2fc2822f37031e8769fe515f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651925803, "uuid": "09882a96-669b-43d2-a0fa-d0b5793fa8ec", "value": "6144:OFnXlki6LPQd7HBqbRuVVMDuEt6dVbK6HXvMwo:O9VpeId7HBquhEt6vO6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651925803, "uuid": "523fb427-f517-44d7-b50d-32f37417031a", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651925803, "uuid": "d8260b7f-8d16-4e72-8808-1511b35ef159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651925803, "uuid": "452631d5-1535-4c02-8d83-769d11a9047b", "value": "c86f8fb2543d689604d438508e413d69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e089df7d-ce0c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651931524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931524, "uuid": "6dd70160-3f34-4413-a625-5a0ed7ef44dc", "comment": "Malware payload (RedLineStealer)", "value": "7a02a840292d0e51187fa2d16bdb51df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931524, "uuid": "2a593bca-8f23-4ec9-a454-5c5902c5682f", "comment": "Malware payload (RedLineStealer)", "value": "3b91052e6f1962e47b4f084571f52013fbfd825b05f099019267aab08b08fe5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931524, "uuid": "181f09e4-43ca-48c7-ad8f-9758863a07d4", "comment": "Malware payload (RedLineStealer)", "value": "492a16b8036692f73acd9fa52cd2a8e29b1f54ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931524, "uuid": "96ab188c-5ccc-45c1-ba74-07ccfbd5c0e2", "comment": "Malware payload (RedLineStealer)", "value": "96009d398da8806de78bd12fde7a95d4d1a01a91b5e2d8e6565d084e76eb936e60ed72fd407d17bd9eadf5cfaf7e5ec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931524, "uuid": "eda22565-64ae-410a-8d0c-0b17753fb43c", "value": "T159959EE38742011FF2536435C02E6E6D717217315B8FB8B7B7885AE9972B2D09A39B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931524, "uuid": "f4cc97fe-081a-4095-b230-803357b190e8", "value": "6db5fd36871bf7ca78879be44b315cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931524, "uuid": "9c767885-0e24-4a6e-9e02-ad95bb61f10d", "value": "49152:XwEIM5G70GxI65O8N+32/yLALBxCDrYYh0:gEIM5W0GxM8YQvDC3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651931524, "uuid": "51e551b9-dcf1-4114-a89d-299baf4c17e9", "value": 1920512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651931524, "uuid": "afe31593-cf93-4877-a711-97ffe7b5ffc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931524, "uuid": "d4e0609a-8a9c-499e-8cf0-6b74bdef06ca", "value": "7a02a840292d0e51187fa2d16bdb51df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837abc94-cdcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651904309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904309, "uuid": "3a85df7e-21bd-4204-b8fd-515623bfa68d", "comment": "Malware payload (Gafgyt)", "value": "226a86ea726416d8e6ea26a80549854b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904309, "uuid": "ad4f5dd0-d88c-4032-8365-134f3234efd0", "comment": "Malware payload (Gafgyt)", "value": "3d4b82c6b3c3ed32a8201d97e28b5e4044544e4116589d7f05acd08115414a45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904309, "uuid": "31b73f6c-69ae-4417-a2b8-823540eda2ba", "comment": "Malware payload (Gafgyt)", "value": "5755c96d6bb2dc8861c10f6aa5538676b2104f2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904309, "uuid": "3f849249-4c3b-47ea-a182-cdc54b0cd639", "comment": "Malware payload (Gafgyt)", "value": "a228ee13769ad496f942dc67fadf7846bfd548afd2ea412b8e81b864238a8a189d476095c360dcea915556fe4fa33a32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904309, "uuid": "7d572b56-7f13-421d-8223-2d8bd0c2cfe9", "value": "T109C32905E8918767C2E2177AB79A425D33332B6893CB33255938AFF41BC1B9D1E79131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904309, "uuid": "e5d28530-1b31-44f7-90ee-d903abb987ab", "value": "3072:KdB2qwap6KVXPi4jv8x++MDkmDhZmTQOIsXAqE:aRwap6Kt6++MDHZmTQOICAqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904309, "uuid": "05c098a2-aa9b-4348-b0c3-cb91a5bf0bce", "value": 127529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904309, "uuid": "e81ff6aa-e479-4b1a-9c06-8ca541f83da0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904309, "uuid": "f769e3bc-952e-4d6e-8985-6f4f85e4ed7d", "value": "226a86ea726416d8e6ea26a80549854b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e67161-ce5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651966778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966778, "uuid": "0de59264-f0e6-408f-9116-b455acb23cf2", "comment": "Malware payload (Mirai)", "value": "939d7309b4834ed748afe65a3b55290b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966778, "uuid": "bcd29e16-c7e6-4aee-9f4f-de78f431e96b", "comment": "Malware payload (Mirai)", "value": "3e7e8a89b5ac6987bb166a389192ed4ebc17721c6f3f4c2f38a984316df58b55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966778, "uuid": "2d3964d5-2d85-417c-a996-77a51d99f2cc", "comment": "Malware payload (Mirai)", "value": "26737226c4d049c00728203984486321fde8de2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966778, "uuid": "4c329994-04dc-4454-9a17-cb86bbd17d98", "comment": "Malware payload (Mirai)", "value": "ffdff978166cee58655fa7eba9c85ba3c278a11341e4fa0b0554ae6d130807ee431afa0e632b596189cd23663814c675", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966778, "uuid": "59918197-7b34-40f5-8eef-21f056f13001", "value": "T1AAC2C07C5C0545E2C59E80BDCF9A1BA02F6A1F82E543E95A7C46DA92DC9C6F478C3CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966778, "uuid": "ba6998a1-9082-4c56-94c5-01de463e817a", "value": "768:RE4SpciEhe/R2mcEzcIzhnhGzU4N3nfF0JgGlzDpbuR1JoX:mlOQcEVzhEFhntsVJu2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651966778, "uuid": "197700c9-bf4e-41ea-9e20-d2a9d64ab930", "value": 26432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651966778, "uuid": "bb45af04-cddb-49f6-bdf6-b871605f1070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966778, "uuid": "a41ffe00-f554-4517-a744-e004fc83841f", "value": "939d7309b4834ed748afe65a3b55290b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0567022a-cda8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651888207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888207, "uuid": "4c9a0331-85ec-4f4d-98ca-056939e296bd", "comment": "Malware payload (Mirai)", "value": "49f1cffc7c94332604f7d6caefdac7f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888207, "uuid": "a7133a77-f4c2-4fae-b5cf-b652422cd7c3", "comment": "Malware payload (Mirai)", "value": "4080812b44070faaf08d36c307c285d09c89a9467aae25a0552e5d9163d4e154", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888207, "uuid": "ee1a21f6-8079-4664-bdae-466c7ecc9081", "comment": "Malware payload (Mirai)", "value": "f954b8fbdc3533198fd12724406b9a4dd331d0aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888207, "uuid": "c7e482ef-4d51-4da7-ab7b-8978289e4e24", "comment": "Malware payload (Mirai)", "value": "55cbf044cbfe83dde06308a845966d9aa19f50e51f85c208f675858a25bb891acf5f4aad48fbaae486a71fc2b3bef95d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888207, "uuid": "c0a05c02-de77-4c8a-8a4e-8238db27e148", "value": "T16F531781B881AA25C7C05777FA5F008E371697D8E0DA73038C296FA577CAD1F0D6B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888207, "uuid": "f960018e-e14b-45f9-ac7c-95b4091e25b7", "value": "1536:HuNh0OlWxYh6ivKEhtma3BeZWc0L2DdAF:HuN3lWxY+axwV0LuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651888207, "uuid": "4280f767-5e0b-40b4-8839-a466bbc451ab", "value": 63728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651888207, "uuid": "416067a9-2e98-406a-a830-e3aaca9f922b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888207, "uuid": "e0708a00-fb43-41e2-934f-01e11f5b330d", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b88ada-cdcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651904347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904347, "uuid": "e7de72ad-8896-4296-bc3e-0138c2cdba61", "comment": "Malware payload (Gafgyt)", "value": "72cf1ba4e83a303d72535736d4dc367d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904347, "uuid": "007a0cc2-6065-4e3d-a57e-757a0dc77815", "comment": "Malware payload (Gafgyt)", "value": "41d37682dd5dead878263fddb4eccc33ebabfb08791c6b98e0acf12741282d80", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904347, "uuid": "c1c53539-18f2-4b0d-906e-4d92d44f65cc", "comment": "Malware payload (Gafgyt)", "value": "2c4d93e8f130a530cfdc9fcbea50c1d795f3b8f2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904347, "uuid": "19b28b21-44e2-48a9-8d8b-c57705b3d122", "comment": "Malware payload (Gafgyt)", "value": "13ed332b5ba9646e4f3121df0448cb95f82de5a11fc8e62a2428817302c50b6c4309c58392d3a05647807e17eb1eb604", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904347, "uuid": "a5195a1c-09b7-48b2-9e35-57d6dea7634b", "value": "T109A33A33A753D6BAC09322F417DB9675A823B47C0B32322B33D86DE56B05DE91E5A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904347, "uuid": "7ac55116-c3c7-4d80-b39b-2e9a592f8c29", "value": "3072:2K5ejA4jB4h89HOPQzM9FqVyM9W9vmrYuOHy+ZNzX:sHjBzuPQQmk9vmrYuOHy+ZNzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904347, "uuid": "83bdd22f-9474-4b05-bd8d-61fa3735227e", "value": 99332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904347, "uuid": "0938bb6b-d184-452e-bebe-9b6c97a631bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904347, "uuid": "4266b39e-2180-4cef-bd3d-2b51956b0ec5", "value": "72cf1ba4e83a303d72535736d4dc367d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edc3aeb-ce61-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651967733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967733, "uuid": "210dc05f-336e-4c41-bd5b-c560c1982353", "comment": "Malware payload (Mirai)", "value": "f95d4a8b61883ef9b93fd54cf2cdfbcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967733, "uuid": "be5d8bb7-b691-4285-83ed-038535bdd301", "comment": "Malware payload (Mirai)", "value": "41f14cb8aa1e316d63f6bf50ac3ef3b7f405e019608e80f1607059a7a5f79b09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967733, "uuid": "9d9ec7cd-448d-48d9-a490-8cc8fbc9305d", "comment": "Malware payload (Mirai)", "value": "3105f4e7af26012a3cd7e8c388f5c60cd55ddbd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967733, "uuid": "61190b88-1361-4001-8e2c-b38aec845aff", "comment": "Malware payload (Mirai)", "value": "7b5686730275277ab1ca610ebac93ef496e3286e84c72e104b663110bba0ed0ee1b4520d051157b902b5d8ebec015bd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651967733, "uuid": "08a46894-9445-4a20-98c7-6ba2cfe6dccd", "value": "T1A3531925BD751A26C0D4A17A21FB8705FAF6138E22B4861E3DB20E9EFF507406513BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651967733, "uuid": "cc9fe6cf-7e37-4867-9692-a58ed54a48f3", "value": "768:1Rotfc3BbKf35UIm4N6xN+406Wsh5ir1dnQdENSvIwBO+2x741lu:1RmfcRbKf35Ut3xNq6vhYRSxyqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651967733, "uuid": "f94ee738-dc84-4dcd-8ca7-30672ec1dc82", "value": 61200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651967733, "uuid": "4224a041-c45a-4dae-bba2-d5f041ce96e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651967733, "uuid": "e1defb5c-e515-42b6-b417-5628e1c67ee8", "value": "f95d4a8b61883ef9b93fd54cf2cdfbcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cf5b15-cde0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651912422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912422, "uuid": "d3033d6b-6c65-4812-b2ff-e8f3220a0d09", "comment": "Malware payload (Gafgyt)", "value": "61a4ff13f293d512c6254c8a36d1dfeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912422, "uuid": "8506a6e5-e14f-4f79-a501-e2956c5f6965", "comment": "Malware payload (Gafgyt)", "value": "43dac0be53b38c7159cb9dcbc62f242479d2db34e3d332c79116277acd14ef11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912422, "uuid": "71c1af5c-ea75-4d00-aa78-e20d6ca7a8b6", "comment": "Malware payload (Gafgyt)", "value": "349395ee89269816c1c5e7e6449f406b6f0c9095", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912422, "uuid": "4f5bf975-b8b7-441d-a145-3b8bac2d8528", "comment": "Malware payload (Gafgyt)", "value": "d97cce058c39da73a45eb56b7fcbe3fa62aecfb19a72fc58c15c8df55798ec12ed80c9c3427e40e0b30623bde090118b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912422, "uuid": "61771939-039e-44d4-bbbc-3603776263c6", "value": "T1D57240852E229FEDF66DC63547B34A20631823D626E09A88E76DD9040FB034D559F7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912422, "uuid": "909ac914-2c7d-41d5-b89f-18eb9675c9c9", "value": "384:HcjD2mLzNDVE2BC0MgC92yt1nESAOXZRO:8GodVEcQ2OJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651912422, "uuid": "78a34a22-98f4-49f1-a51f-9830af44d544", "value": 16000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651912422, "uuid": "ca56e769-75ea-4de2-b9d3-43fb227d7aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912422, "uuid": "bcba6c7f-c779-4775-8183-e4a0481c8eb2", "value": "61a4ff13f293d512c6254c8a36d1dfeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0f659b-ce29-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651943650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943650, "uuid": "0d4aad1e-7eef-46ac-84c9-240cf9d96222", "comment": "Malware payload", "value": "6889cfb3137ffee92478c3c2bb2a7722", "object_relation": "md5", "Tag": [ { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943650, "uuid": "73ef5ef1-025f-4754-a724-cf56b2b1f484", "comment": "Malware payload", "value": "448d23c53cc9f4a1a97683474c4e2e7a45ac05570effebc9018924a2c3cc44dc", "object_relation": "sha256", "Tag": [ { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943650, "uuid": "77c42278-a10f-406b-989f-fb401d42ae1a", "comment": "Malware payload", "value": "3d52224ca0af65863a464c90896270b56b81028e", "object_relation": "sha1", "Tag": [ { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943650, "uuid": "dfc315e3-07d3-4658-b4dd-3366a8333514", "comment": "Malware payload", "value": "a82f0999d921ad6e17ff6e9cc587f039e9605ac8a5b3da21e8c35ed6d577530bbe76ec79bcb5a8f2ba866bf5f4554e34", "object_relation": "sha3-384", "Tag": [ { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943650, "uuid": "e2f26b47-fcac-41f9-9f40-755bb77c1435", "value": "T11DE5AFDD9A4DA4D07F81BFC9D8862DCF26204731BAA120295E7BF8468DA74FD904BDC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943650, "uuid": "d7e7e855-4756-47ec-b4a2-22b7a643607c", "value": "24576:w33eITsPXOtpncI+YvuBYriu44yzXMPFz5hJRZF20iuLC+JjGsh1PV0jCF4/8ky9:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651943650, "uuid": "6ededb6a-fa7d-4b22-b90d-c8c309c02297", "value": 3294493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651943650, "uuid": "3227b4fd-6c4e-4d68-b4b6-655a5cbf916b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943650, "uuid": "5175e2a7-4aa7-4e0e-bc2d-d0b32dc98a60", "value": "JCKCFSQXDZNKKJZTFXKSGP.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec8bb7e-cdda-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651909804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909804, "uuid": "5e31330b-26b0-4f0f-8b6c-c0fbd4c32fe4", "comment": "Malware payload", "value": "7d5e6b3dcf0a516b17123e8992ce0e40", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909804, "uuid": "58c9ef1c-4c40-4c50-97d6-9b3533f41fc1", "comment": "Malware payload", "value": "458149382dd97ec5a0593e1c3eefddf1bb076a3377d4b7c163bfd172a38d65cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909804, "uuid": "25f94a0c-e201-4c62-9282-76ced5c178e3", "comment": "Malware payload", "value": "fc22233e6cea820db120942935d78e6c17894ae1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909804, "uuid": "919ac803-8e56-40f1-bf72-c3b8c4a28605", "comment": "Malware payload", "value": "2c805693b64b6eeceb5cbdf13d6b9e12c9b440fc14a92cfcbd339949974df34f5d29b6598b1622a60dbdc4e99edaf361", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909804, "uuid": "d6b2e1f9-e8dc-445a-81d3-6384036d73b4", "value": "T1EF631A57E7808E17C4A2173566EB83113323DB11A797630A562CAFF43F477E89E1391A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909804, "uuid": "07ca3994-8441-40e4-9719-758a51302985", "value": "1536:8RnOcSpdgqlS8iWgvAy+Csuv/nzw/9Bq8Oov:DpdSX4dCVv/M/9BfOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651909804, "uuid": "f9b73683-cbec-423d-a02e-4e556c99a4ed", "value": 66886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651909804, "uuid": "4a558f63-9b15-4e6d-b623-52542ae4537f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909804, "uuid": "5623e90f-0663-4d82-88b3-62793ab4ff01", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7987db22-ce50-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651960557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960557, "uuid": "37dcb121-0a56-404d-b571-7e4e62fa405e", "comment": "Malware payload (RedLineStealer)", "value": "09f4a15f52a0ccc43f4c92d7bfaacfd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960557, "uuid": "3f3656f4-915e-41c8-8036-2a825b0e63d4", "comment": "Malware payload (RedLineStealer)", "value": "4666173f826ba0295bd816506fed3dd92565e617f4989ff9377b1a156652baf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960557, "uuid": "905d4cdb-04e9-41cc-809a-0b210122dd8d", "comment": "Malware payload (RedLineStealer)", "value": "40c8e6bc6fcf3107455c5f37156ab4a6f7073024", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960557, "uuid": "7d94a340-8359-440c-8c01-7f97190c9917", "comment": "Malware payload (RedLineStealer)", "value": "d3ccfac1db38650f91913c779fbb68ae4987a758001ce4b93e9b306c9e256456e1c98a755da6058467f20772aea7a0b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960557, "uuid": "8454e2c9-592f-49cd-8147-d70030f37725", "value": "T10784DF10BBA0D035F1B722F4497A87A8793D7EA19B2444CB62D53BDE66356E0EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960557, "uuid": "419dde8f-bafa-4e2c-a223-565891150d86", "value": "c2f34b03efba3580b2f36c10f3cf4dcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960557, "uuid": "93e21f4e-c62d-4fce-8a5e-3d466f21fcbe", "value": "6144:5/jesrn3mgYTAULx+YOe7XeDq++9J+t90KgNPU4b/CdvjMA578MUMz35rlMxo:VKA39qAULx+YRXP5J+X0NU4+TJbpZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651960557, "uuid": "d703eb9a-6ccf-4e6d-9a20-8f6ea7ca2eb7", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651960557, "uuid": "4e12216b-a849-48af-b4b8-4c06c9e52eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960557, "uuid": "6db91ead-7c60-4022-97ad-9847541078e8", "value": "09f4a15f52a0ccc43f4c92d7bfaacfd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04acc62d-ce43-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651954777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954777, "uuid": "eb0d7a9e-78e2-4d75-be99-006bb5c975fe", "comment": "Malware payload", "value": "ac478f2b3c909d31c7ec5b0e777c3d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954777, "uuid": "bf4bb367-0d45-4d86-b1f5-3198ca0a9e62", "comment": "Malware payload", "value": "47934dfea8c7ec9a59ac5b99f4e440a668f8217999b7f03020bbee22720404ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954777, "uuid": "95b90534-843d-4174-96ec-2a69b6400c51", "comment": "Malware payload", "value": "9a8b25abd5e3250a414cb61e686ec313111692f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954777, "uuid": "bfb674b3-149f-47d3-8b9a-1657bb0047c5", "comment": "Malware payload", "value": "b0882e87dc24f0ca7e7b5c68a7634a5310064b89040ec3db821ee79b192b490c87c274ecb9457014eced3b2b78a776a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954777, "uuid": "7f538937-48b6-4ca4-9b16-4bf6486a2110", "value": "T1D3220816E3B84D76CED946364C638AA00D38F243C4537B6E15C4892F7D1BF45CAA3AA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954777, "uuid": "d10946e8-8a2f-4154-b46d-85b0689889e6", "value": "192:4nWat2eAr5kuuM/TGZLy12OD6A7qOKDfRlu:4p2eAr8M/my1HeA79KDfRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651954777, "uuid": "2f589804-a85f-4aeb-b6bc-d267b3985a10", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651954777, "uuid": "64e237ae-0002-4f4b-9dc5-157f3f5f68ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954777, "uuid": "c6e0dfaf-a126-4e41-806b-178fbdf91153", "value": "Space_Royal_v.4.7.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2773d2d7-cd99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651881821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881821, "uuid": "e195970c-96ae-4ece-8c68-63b7afa4e0ea", "comment": "Malware payload (Mirai)", "value": "57b7a92fa0008066d871e4e8b4544495", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881821, "uuid": "ceebc18a-3057-40a0-8f03-3d7012c6adcf", "comment": "Malware payload (Mirai)", "value": "486774d45d5661a84010f54b4bc28910d577b729fc89127c31c7c7975bcd0f58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881821, "uuid": "eaa46485-9c47-4e7b-bc0e-f3a64c7759ba", "comment": "Malware payload (Mirai)", "value": "4d2f54ccf90e1ef0e41499b04ecd6c8d6e06ef9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881821, "uuid": "26b49f2a-b0c4-4ddd-9ec2-56c142e7d5b1", "comment": "Malware payload (Mirai)", "value": "550cd8df5084eca6d11dffdb95e50fad6a48736b65f2308fbe2b20dfcbea0e42dbb1a46c8dfaa29b7dc2d379c917c2fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881821, "uuid": "d50daa85-74dd-4ff6-935b-75d722078bd9", "value": "T122434A65F9824A3AC1E0137ABA6E569C373163E8C3CB3217DD641760BACA41F1D77E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881821, "uuid": "076ddfa9-f795-430b-8ffc-00658911692d", "value": "1536:rpUJkRKoczXJSL7IxM2hPqRoWy5j48Nx4a10:rp5OXml2hyR7y5/NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651881821, "uuid": "87c48477-86e7-4975-920f-f6fd6109c521", "value": 60044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651881821, "uuid": "03d8153d-2185-408c-bbf1-5943e5e83f4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881821, "uuid": "e152efc8-f22a-48c4-ae25-efa4c39965ed", "value": "57b7a92fa0008066d871e4e8b4544495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aabd7c4-cdbf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651898147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651898147, "uuid": "bb6407bf-f668-47f7-8eb4-d4802239e93e", "comment": "Malware payload (Gafgyt)", "value": "6f6bfac532c5f94e01b4b3e2c4347c83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651898147, "uuid": "6d04062e-293e-4837-93c0-145d81308ebb", "comment": "Malware payload (Gafgyt)", "value": "4869c3d443bae76b20758f297eb3110e316396e17d95511483b99df5e7689fa0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651898147, "uuid": "49b8eb12-9dde-4edb-afb8-492fecfae2b6", "comment": "Malware payload (Gafgyt)", "value": "9b8e35d724060ddc625442ac12d08d77c9afe256", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651898147, "uuid": "a2a5caf3-e607-4a74-82a0-a5295b8a4037", "comment": "Malware payload (Gafgyt)", "value": "729bfd49fe87d80d77a713f21cb28db9d5d4b44df603c703ebc67380d0d919cfcfc8de6981144ba3af99701d54dc2207", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651898147, "uuid": "53bc64f6-3f64-48d3-b12b-ec78a4d5401d", "value": "T108D32D56BE82CF13C6C325F7FB9E428C371657A8E7EA3103ED256F51338759A092A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651898147, "uuid": "6af66c8a-b202-441c-bf8f-6600c7d1107f", "value": "3072:qtTu0w2AWp2pGZU++31C8cpUvqRwnkpT7Db8S:+Tu0wwpTU++3w8CUvpn4b8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651898147, "uuid": "8fc259aa-2482-4657-8b4e-6d86eba78d22", "value": 131032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651898147, "uuid": "7aec8b03-c1bf-4581-a259-b00289862cbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651898147, "uuid": "b54c986e-05e7-4878-9897-56e12473c7f4", "value": "6f6bfac532c5f94e01b4b3e2c4347c83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70587f30-cdd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651905995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905995, "uuid": "dd213118-054f-447c-ab7e-9f45387612cc", "comment": "Malware payload (AgentTesla)", "value": "7ffa67a029da5c4b428fccb5f661a414", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905995, "uuid": "94ef7b34-83d0-4c67-aee6-b95200f16719", "comment": "Malware payload (AgentTesla)", "value": "48f4c4151db94777eec41aad629e994b6082cfa3db50cc375020b83946747af8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905995, "uuid": "64f671c9-bf57-4f9c-abf6-5feb995e41ea", "comment": "Malware payload (AgentTesla)", "value": "ade296d65cf394ea6c7e8b33fc755c3e6b367688", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905995, "uuid": "26488d92-3675-4585-8ce3-a8c7bfe5e715", "comment": "Malware payload (AgentTesla)", "value": "cad95c284ffc35eb4b8f522e0cf5641e085f853e9410bc5af4b70e9686b5b690fe89dbaabab2c18ce711b2572c464b47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905995, "uuid": "0e7f3e8a-ac9c-41e1-9309-420296031bc9", "value": "T18E942338D33F995CF4C0C6F2485079F520AE0E6D9C8546D9BD831B35E9327DDB8A2AA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905995, "uuid": "d31e063f-bf44-4bfd-9925-0414aa3cc0e9", "value": "12288:Vv+7dvIiC7IMb4cZxs3sRaomxAxew71Bo959O:VOJCn4cdaomZO1Bo9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651905995, "uuid": "c8a8adaf-75a4-4c0e-ab35-ab722f527449", "value": 428569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651905995, "uuid": "884b84fe-595d-42f0-9318-01d317390a3b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905995, "uuid": "bd66f839-11ba-4d17-9b83-4744e75adc24", "value": "Request for Quote.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c725c76-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1651904620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904620, "uuid": "52b135a5-4dc6-478f-beaa-6dfcae872c06", "comment": "Malware payload (CoinMiner)", "value": "5f085b942690f0f41557b1f424d66ea6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904620, "uuid": "80418a3b-2dc7-49e3-a1b3-c6ab98d92251", "comment": "Malware payload (CoinMiner)", "value": "4a50e6108ab6b7b2661c551988150f3e92584707a45a70c14f44e519102eec22", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904620, "uuid": "691a089c-c7d0-4b41-9825-16b7397b35b8", "comment": "Malware payload (CoinMiner)", "value": "eeb68830b72abacb42fdcf8fd04d393474559f33", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904620, "uuid": "b4cc065a-8979-49bf-8888-6a85a969faae", "comment": "Malware payload (CoinMiner)", "value": "723ee90ba2fc99754fa51df923b2ed0a68524ccb8365fc3b78d93c51f98242cb4592c9804cceeb4ce0fd2e5c3db4b897", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904620, "uuid": "cf01617d-3f14-4c0a-9555-3b552922abb2", "value": "T1E0153356AFE4FC71B917E27393149F0AFE44D25AC3CE827CF661847E5CD89226012AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904620, "uuid": "30fea4ae-06b3-4bb0-953a-e84377c4a3dc", "value": "24576:Sy+jMkaTDtuF6kYK2MS6+wxaD21EtYlsVVRylcOJLrTkHuN:SyFkaTDtuMkxrU3t9icaLMuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904620, "uuid": "da20c0a2-9f96-43a4-b98d-7785bf79e72e", "value": 875864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904620, "uuid": "efe4d647-6f07-4f1e-93aa-e11baddae4a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904620, "uuid": "ec21f537-b095-4a7f-a245-551a3422aa45", "value": "5f085b942690f0f41557b1f424d66ea6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13a2fd0-ce4a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651958100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958100, "uuid": "3095fdf6-5257-4c8b-974d-e01d1c1d1d2b", "comment": "Malware payload (Quakbot)", "value": "38ad770f8403537ebf40f4c124a3336d", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958100, "uuid": "73e83749-17aa-4aa6-928a-7e9362afa36c", "comment": "Malware payload (Quakbot)", "value": "4ae4b557d53199a33e8273f5fbc5007fb4b981a0687640d0282023f58fe3838f", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958100, "uuid": "e526c617-6981-4003-81fb-0157c12717eb", "comment": "Malware payload (Quakbot)", "value": "263344a540fac232473e9f770c68b53cbd11fae4", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958100, "uuid": "93cd9fa3-a2d6-439e-813b-b9d388c0ed30", "comment": "Malware payload (Quakbot)", "value": "2bf5000b0d54c56f9baa21e571c2c885326e8fba3545481b909e029327896b10bd2afec9d3d5116b96870f650492ec01", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958100, "uuid": "df86bbe8-4d62-4835-a491-8d165eac34e4", "value": "T1BBF48E22A3D34836DD77163D8C5B93949825FD413D34DCFA2BE4EE6C8E39A403A1529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958100, "uuid": "fce021f0-cea3-43a8-8131-ea82222a0e49", "value": "1f323ccab9817929388091e1b9ddaddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958100, "uuid": "b4d0e20a-8835-424a-b35e-1ccd3670ba20", "value": "12288:b0tFRlN3qlI7Sq77ti3kKvKJPXWwvPi/0Q1B0vZRzIBt:bUzrOKfQUDZC91UZRMBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651958100, "uuid": "00c4298b-4310-4ffb-8b34-aef3e805623d", "value": 771465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651958100, "uuid": "cc69f467-c402-4edd-898f-9d9bef630b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958100, "uuid": "28690c48-610e-4929-88f4-2e4c89d0d273", "value": "Knhfn.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ccda91-ce16-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651935697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935697, "uuid": "5c25a29c-71ba-4442-94fb-50cdb09b0f5c", "comment": "Malware payload (RedLineStealer)", "value": "8de7db4a9a7fe7f63e21a2062d27802e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935697, "uuid": "c53c2503-b5df-461f-9d44-c80a354d0d1a", "comment": "Malware payload (RedLineStealer)", "value": "4aea67d65adb9ea09e36e46623b3faf51c3482476fbd38b644aeefb1f0bef0f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935697, "uuid": "a7949b23-5544-4d18-9086-368f7fe70f7b", "comment": "Malware payload (RedLineStealer)", "value": "9a55cd317f189b91062f0ea51e4f30062468a1e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935697, "uuid": "94b6a810-d87e-4480-81fa-96eab29a0df6", "comment": "Malware payload (RedLineStealer)", "value": "21768e48c7b88f07e57b62e20b12c04ecaa43016bd55ac90003de73ec9365636c1a1da18ae721f834ef1fcef97572f4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935697, "uuid": "c5e505bc-f8c8-4be5-836c-72984d0a94e6", "value": "T1AB449E10BB90D035F1B722F4897A8369B93E7EA19B2450CB62D53BDE56346E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935697, "uuid": "f11bdd27-ffe4-4949-8a26-88609b02dc53", "value": "ffc63d9ecf6198940160ad003c5f8997", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935697, "uuid": "7cfa28f7-62a4-4f62-81eb-a962b49787c3", "value": "6144:WvEXpxfrtGlyJT8qO+vCEap8HdeJcLYmUfEbo:Ws5xZmOT8q1Cx8HdyoYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651935697, "uuid": "16d8ef78-c5ff-4c76-b50c-ed4f5a86d59b", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651935697, "uuid": "92ce016f-35d3-4415-a1f5-fd01e39ceaaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935697, "uuid": "8667c9e6-ef1e-4667-8888-5b1659895e9e", "value": "8de7db4a9a7fe7f63e21a2062d27802e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788305a5-ce3f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651953254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953254, "uuid": "b8f9a89b-c094-4413-869a-6283247d970e", "comment": "Malware payload", "value": "5d6ca5e74722d80dd1b0aabbfaa03508", "object_relation": "md5", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953254, "uuid": "35bc9b50-cb5b-4e46-8cda-0f2b85245c2c", "comment": "Malware payload", "value": "4bdfb8f41648edb6f5c4d45f19098abefb2f7e0b2c635821508d832d4f1ef0ee", "object_relation": "sha256", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953254, "uuid": "47c4ee54-67a2-4aaa-ba51-0c9d39d36a76", "comment": "Malware payload", "value": "d7f94bc70633b9b1aeefc3ac1837f7e3fd43fbf3", "object_relation": "sha1", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953254, "uuid": "38a5f284-0efb-4d3e-8fe1-3b348a1ca3d5", "comment": "Malware payload", "value": "37e408dd7f8e1a7d0e59fee321f1de71a4cfbead270980d70c99c547109f518b98de5886fd6bb32aab7c9e18bbc83fe8", "object_relation": "sha3-384", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953254, "uuid": "c829cfba-68e0-40b5-85d5-e133a02e705a", "value": "T11C8144667331C837AA839B84A76C2C4FB59030C3B4426D4F373E007A31699ADF959675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953254, "uuid": "fb6655bf-5e99-4b70-9fc1-ac576b980d6d", "value": "96:cSIztBeZYjJGWod2xxQsTf4OSSFfpS/fJS6fBSTfZS9fNSxfOGefOGzLrfOGnfOT:ZcxxQElSKRcRHJAhClOkFrJj6GL5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651953254, "uuid": "722ceec7-d3bd-48c0-894c-dd35e546c40c", "value": 4048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651953254, "uuid": "4088151f-de45-4a69-a9bd-bc034caa7379", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953254, "uuid": "befbe208-e939-4036-90b7-ae476ac9964d", "value": "G0nnaL0g.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe81e84-ce14-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651935006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935006, "uuid": "3c446a50-47ea-4cdb-9e58-d9de98147198", "comment": "Malware payload (Mirai)", "value": "07ef12f7524c5d3cd0771223f07d38fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935006, "uuid": "7a2b9479-d169-489a-9281-7c9c1389af89", "comment": "Malware payload (Mirai)", "value": "4ce67ddc9382f601621d3f7be1510ad3bd3132b44e6778d6ef6d6f272c67fef9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935006, "uuid": "a9dbb909-6bfb-46a1-a278-134b631ce63a", "comment": "Malware payload (Mirai)", "value": "d0db4bc0f3cb9c6c5bc30345f3ac53976adf9737", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935006, "uuid": "a4c1d2c6-bbad-42ef-8d6e-fd0269e4fb55", "comment": "Malware payload (Mirai)", "value": "c4294c4dfbddce400c0419810080a656a84eb0a80fc56bffa063b41cfa95e01c2032108a40a71300955da99b978985e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935006, "uuid": "c1379757-f62e-4373-a7e8-a5e1c8444fb0", "value": "T1294329C4A6C3F9FADC11197C716AAF729E73E03BB135EE8AC3D915739911602910239E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935006, "uuid": "baf72228-f893-4327-b2d8-5f0b8192d60d", "value": "1536:T+aBMuFoUEgyFcZdSWY/aKVv76SXIVVSr:T+CMuFogyFcZdSWY/bVT6oIVIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651935006, "uuid": "99f56d46-e4d5-4445-ad9e-5b14ad3ab32d", "value": 58652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651935006, "uuid": "366c8edf-9520-41b5-a584-3a229144def7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935006, "uuid": "cbad69a3-26fb-45b5-bf23-e80809410b03", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541414e0-cde0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651912390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912390, "uuid": "e440a79b-1058-43fc-83ce-e07fb5460b9b", "comment": "Malware payload (Gafgyt)", "value": "63df7b98f5187629868e50b2620fb5ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912390, "uuid": "76164841-18c5-497f-9447-e727f205aa0e", "comment": "Malware payload (Gafgyt)", "value": "4d48f8aac7a176aba04173888f8ee849dae41b16c5a86d1c0be70e7d3b11be44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912390, "uuid": "5cba4a0a-e67e-48b2-8665-2638f5853fcb", "comment": "Malware payload (Gafgyt)", "value": "eb0817adb2cdef43dbe031ab40361dc2fbbe284b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912390, "uuid": "0380d209-c331-4bc6-bc7b-273e97d05f06", "comment": "Malware payload (Gafgyt)", "value": "acc1038c3cbfde9f0f55ddf0d5140006f2762cfe44046d507925fd0b3422e6ce6ff192bfc080b4e796d2de1a6c1f7340", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912390, "uuid": "8cf8708e-145e-47f2-a463-d78e25ba5ffa", "value": "T1F0726219EF948E37ECBFDD7745A90B4630CDD00B62B92B1A2274C82CB65F54649E3C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912390, "uuid": "a74c32fe-09c3-48cd-8a50-1235c60e6b67", "value": "384:Hl/Za4YbY0sZYuiDyoXisMSeEcXefo1w3K/:Hto46mZYprXiHSeEcXefIwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651912390, "uuid": "9d1939fa-b6a3-46d6-9d67-030761c54526", "value": 16064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651912390, "uuid": "a69c1137-4397-4a1e-bee6-548712b1d064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912390, "uuid": "eb0be980-1a09-45a6-9c71-aed105c7ea46", "value": "63df7b98f5187629868e50b2620fb5ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab46505d-ce08-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651929717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651929717, "uuid": "3e4860af-952a-43f8-aa59-70fd12315f16", "comment": "Malware payload", "value": "3e6ebbd8387b7c7341510535f3ab3385", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651929717, "uuid": "54e3f569-e425-4e35-95c0-a6d69d65231a", "comment": "Malware payload", "value": "4f4b14696cd25db1f88a0f4e2b6195834158eae27f92e9b3e6f5151b3925a65d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651929717, "uuid": "66d4f51c-a5b5-497a-b59d-025a93519e5c", "comment": "Malware payload", "value": "b5bcb491ec9813432e6074ca0b3dd311ee0f66ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651929717, "uuid": "4b945d2b-f9a9-4c5e-ab32-c7d26c70f48d", "comment": "Malware payload", "value": "5791b803def43cb617510cea3dfc71b0d9867a2b1b239a3063266a8a60a13bbfb65d13a46141d17239dc0072e80e463e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651929717, "uuid": "51786c27-c910-4cf9-8ae4-4d202776f531", "value": "T17FF40110BBA0D035F1B721F4497A8269B53E7EE19B2485CB62C52BEE57346E0EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651929717, "uuid": "b4a3c818-0c91-431d-9ca1-d560b5d8f5d2", "value": "76ed3e8c2fc2822f37031e8769fe515f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651929717, "uuid": "dac5f257-7cfe-496e-9db2-64fdce73718a", "value": "12288:wTVvZI+LjE8AIWKVThLsc29Ls4YETFemEExem1zIa8DFnPpkH:GRt08hfZs1da9Exem1zI1Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651929717, "uuid": "c38e1376-afb7-42ad-a576-08553266e91d", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651929717, "uuid": "450fbf55-00e9-4cc9-91dc-3d6c2823e628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651929717, "uuid": "0c2efc25-507f-4643-8ead-4455d11c8294", "value": "3e6ebbd8387b7c7341510535f3ab3385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0366eeb8-cda8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651888203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888203, "uuid": "d6dcf7e8-4be6-4e3a-b93a-8c7d58ef5532", "comment": "Malware payload (Mirai)", "value": "c34206485f3eae6b2c58e7059f356295", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888203, "uuid": "7784f4cf-5e49-4e76-b795-51c5903fea44", "comment": "Malware payload (Mirai)", "value": "4f79cf72386b9c9579ed737bfe4e897625f2c5542d2063041ce82bf3ed809492", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888203, "uuid": "99e5597d-0a49-4f98-b512-14d3af7c0457", "comment": "Malware payload (Mirai)", "value": "82d5aa0d89a799705ff219f280a5b386f77c768c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888203, "uuid": "ab6698db-c11f-4709-bff0-a4299e73ce1f", "comment": "Malware payload (Mirai)", "value": "bad4aa36f69497f3c597b87baa4c3ffb7760573f9238018bae9cdabccc643fabef2d860c9385ca16001333a07cbb39cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888203, "uuid": "d1ea5bc3-5970-4ee2-a9e4-fab2d680b372", "value": "T1ED4329C4A6C3F9FADC11197C716AAF729E73E03BB135EE8AC3D915739911602910239E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888203, "uuid": "743e38a7-876f-47ac-bdc7-aa39e9ebb2e9", "value": "1536:T+aBMuFoUEgyFcZGSWY/aKVv76SXIVVSr7A:T+CMuFogyFcZGSWY/bVT6oIVIrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651888203, "uuid": "e4134003-94b1-4b88-85cf-ae89295a3974", "value": 58652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651888203, "uuid": "fced3854-0a1c-4b4c-9096-e3d8e8703951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888203, "uuid": "9a27f113-30ed-4c81-88e0-a8c7d0c7ae5a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04fe30f-cdca-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651903177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903177, "uuid": "51bae681-867b-485c-b64a-d3a1794161ef", "comment": "Malware payload (AgentTesla)", "value": "e4436d7b758ee18c474bb077afab1dcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903177, "uuid": "67ee308a-d206-412e-bb64-fd9d99c45e24", "comment": "Malware payload (AgentTesla)", "value": "500aad1280bed56d0bbe927fbdec9ad31c1192e0248bee2efcc855be89ccec5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903177, "uuid": "9395159b-5937-4c0e-9ebd-da0afadf94a1", "comment": "Malware payload (AgentTesla)", "value": "1bbcf7f4aefe6846fda29aeb6f2eea9d765fdae8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903177, "uuid": "a1a32c3b-f004-4a12-bef2-251357794e88", "comment": "Malware payload (AgentTesla)", "value": "f4b05fd1da868d36f3b2d4cacbf5876b2a8c3430d0248776fc5c109ea9796886451d6eb62c2256cc83fdc7b14b8fa7d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903177, "uuid": "b2005a24-39b9-4bb4-a26f-f0e9de40acb1", "value": "T1E084235EE6BA42121E1051A1B1C7C0D69FB80B7DF2794ED14FF8BBD18960FA60B019DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903177, "uuid": "ddd0fd46-1191-41d8-bee6-d3689ec24e81", "value": "6144:4sDsqC8pKnXtcCq8cZs5ncxN+LyGO43tbX+QLkMqDE6B2bFM2d2u6qpYPHvhuu+1:4sIqCE6XeCRcC1cr+Lyn+3kMqo6OFMtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651903177, "uuid": "8f0d3cbf-d3b8-42da-93bb-c3c13e548eab", "value": 391555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651903177, "uuid": "98329bc4-318b-4b18-9c78-75134656611a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903177, "uuid": "09c87a48-cb2c-478c-9c28-0c9daca5c98c", "value": "Request for Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aab89a6-cdcb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651903409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903409, "uuid": "651a6c8b-be97-4377-9d0b-1e16bcb83b83", "comment": "Malware payload (AgentTesla)", "value": "2b0f4747dec64260f14192fb092c3fcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903409, "uuid": "c04f54fe-893b-4957-b8d6-17f18428c288", "comment": "Malware payload (AgentTesla)", "value": "501c5ac9a9dfb5a7854aaa57e0efa7d70c034e7e344f5dc92e239c2738015c3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903409, "uuid": "2494776d-0316-46a4-9d4e-26589de7fca5", "comment": "Malware payload (AgentTesla)", "value": "43590d07652dc4a0018adec1cfdc8a0f9bff5113", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903409, "uuid": "d980b4b2-e5c6-4dd7-865c-156de0bf4b0c", "comment": "Malware payload (AgentTesla)", "value": "96b97e295f540d5f4838eb37be6e41055416c5706f78ec1bc75d07f1e17adcb70a86661ec2c1d3f1dec0ef2cd4d97c80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903409, "uuid": "cea2909f-d2e8-4e53-8a34-0a2e8cc09483", "value": "T1C494230E9D34D3D500E5C9A1AC0286BEA78FCD61C3A9465D22945EE4EB3125FDBCC2B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903409, "uuid": "0b69c26d-3106-47c0-9710-adf95d1a08eb", "value": "12288:Fm4TK+hkE8qyco6o3BH/8qtYBwDA/aW81W6mcOxtm:84u+hB8qyD66GIYBaA/aWL3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651903409, "uuid": "b47ead0b-f722-4031-b96d-6158daff9209", "value": 431201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651903409, "uuid": "c6289256-8a34-40b2-8129-cee4a7dcdc4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903409, "uuid": "ef36810c-6570-49ae-a982-3173ddd6dd8b", "value": "MBL+HBL SHIPPING INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3149db-cdfb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651923898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923898, "uuid": "bc9790e3-be6a-4d12-a269-029287e73dbf", "comment": "Malware payload (Gafgyt)", "value": "d5dcfb35c9130d609ccf5c972e5493bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923898, "uuid": "fd4be655-fe0a-41d2-bdd8-748be5d28ef2", "comment": "Malware payload (Gafgyt)", "value": "540acae6c5e8dc5875640c6a6e58cb9f54d3dd0cc6b93162b2b1208dd220455d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923898, "uuid": "e47e22f7-e682-409b-bd8f-99c211be97f5", "comment": "Malware payload (Gafgyt)", "value": "1feb9ab714552971bf49b741f1f59d415f954c93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923898, "uuid": "29bf1fad-f717-48d1-b20a-2869ea6a7847", "comment": "Malware payload (Gafgyt)", "value": "ab388c385c5ed284ca6d6d851071dd9ee5ea3011238babaf0ff8b49f02c81cb85f1d5a415d3acc255dbf9a3c37aeba99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923898, "uuid": "27cb68d1-7f28-452d-84f7-c7a8b9b93bf8", "value": "T1FE72F73DFB431D67C495997892E7472DBAF9820F98B50F2A3C620E9CBF44D8496432B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923898, "uuid": "d5b20329-d6d3-4ba8-b011-bf4371e2405e", "value": "192:gZp68UQ/gF4AZzYrd5lUGclRRUi1utYqouZVUCyu4P0eB6kd+D2rrPllTTTo0GB6:Obt/g1ZCd5yGclZ+FU+p8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651923898, "uuid": "57e7d0e6-2ced-4070-9d8a-83f10a05141e", "value": 17116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651923898, "uuid": "55fb4efe-2ee2-4592-92ee-093a497048f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923898, "uuid": "9d12d24b-969c-4275-a3bd-bee740a812ed", "value": "d5dcfb35c9130d609ccf5c972e5493bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7b7865-cdf7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651922256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651922256, "uuid": "a6f28233-5507-4f1d-86d3-328d3576bd7d", "comment": "Malware payload (AgentTesla)", "value": "70af15f4e14cbb48c0e84d555f68f25b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651922256, "uuid": "11081047-07d6-4a60-8277-8d3398e9d5cd", "comment": "Malware payload (AgentTesla)", "value": "582f36c987011e5bd27f0ce41e208c492116d26d834144bd022bbb5e172424cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651922256, "uuid": "d6bff857-4e09-4dbf-8cd1-653edb845a60", "comment": "Malware payload (AgentTesla)", "value": "037e8e4e48d997a882aa125bb0f6daf311dea348", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651922256, "uuid": "3aa4e92b-ff29-4d91-9e0a-a36c6bbfb5cf", "comment": "Malware payload (AgentTesla)", "value": "887e756f34c981f10ac637ed415b44aea50a427200cb46418290a9d62b73eb70963a915248592fd2bc12795812528abf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651922256, "uuid": "f7085e8c-5b5e-4f85-8578-5e45d0e8e53a", "value": "T15A05BE58311C7A9EC867C9718A568C74A7A328AF67175133929379BFB90CB47CF130B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651922256, "uuid": "ce194dec-0580-4916-a273-9169e380833f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651922256, "uuid": "4bec171a-cea9-4e6d-8263-d9185f64d658", "value": "12288:yLQZyWgQFXqyhEz/3Qcix8z78PEEUMv6n55lHOTOHAnlhp+yVmUrAU5elhN4PXBQ:yAXmz/fpUErXxeOHQlYpU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651922256, "uuid": "8bc91970-494e-493b-b804-a07cd140009f", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651922256, "uuid": "e4b6d872-f71c-4f5f-9416-4adf5c704577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651922256, "uuid": "df1bb2be-3fe0-493f-b6d0-2b575b2eedbb", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d10d965-ce26-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651942551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942551, "uuid": "af8c70b9-dd1a-4b1e-9901-1e3e71285452", "comment": "Malware payload (RedLineStealer)", "value": "83353687653ad15ce57bf0cf6aaf3bb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942551, "uuid": "36158ed6-8a7a-4084-a21d-2ed17e5a02ca", "comment": "Malware payload (RedLineStealer)", "value": "59037b379a8231e6d24bd483a1bf15b7069ec604d55cf189f20370fce3e6ee21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942551, "uuid": "1f2a62be-5fbe-4b8d-8636-5ee58953391f", "comment": "Malware payload (RedLineStealer)", "value": "831a0a991928f2ce755b0bbbf7cc642e57772bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942551, "uuid": "49211470-e195-493b-bd2a-14506afee9aa", "comment": "Malware payload (RedLineStealer)", "value": "30a57a66793289abef732d16703f067aafebff6e76d489e25d370305fc85d9b20d2e2f64e39bea04e582e8c622e0db7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942551, "uuid": "d7530ec7-551a-40a4-8bda-a9f261cb5608", "value": "T12B84CF00BB90D034F0B716F089B6D3A8B92D7EB1AB2455CB62D52BEE56346D4EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942551, "uuid": "bf7f3e64-04f7-4ea0-a0b7-af88458b8f1c", "value": "bd6c087e94180526f5f9f8579d4f2ad4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942551, "uuid": "38250411-0513-4a67-8fd0-8780bd5c35a3", "value": "6144:DeaX2DZDPuRdMX6WKjIwqioheXjJBXkP6oICX5GzYghrSsMrR2RAsPo:D3GVz0+X6WDwYhOJBKXodh/MN22s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651942551, "uuid": "cc6d6d36-0b2e-4475-b366-56a4a389e1ad", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651942551, "uuid": "10bb8ff8-ca7f-4047-bfac-b0ca14185648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942551, "uuid": "736e59fb-db3a-4a8c-a63c-a06201f1402f", "value": "59037b379a8231e6d24bd483a1bf15b7069ec604d55cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46c7466-cdcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651905251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905251, "uuid": "190fe7d3-e247-4244-b6a8-0d0fda9d4c53", "comment": "Malware payload (AgentTesla)", "value": "4eee6e1dfe7b659b172782f619583807", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905251, "uuid": "443b2a23-e945-4137-a1c8-b1c08c2b338f", "comment": "Malware payload (AgentTesla)", "value": "597f3896718f139668edbf981fe0edd8c46847373a7e3450dd26af6bbd4f544f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905251, "uuid": "fd1b14cc-2b96-4453-9c79-83080b124c39", "comment": "Malware payload (AgentTesla)", "value": "94dc23a56358607cd2c7dcd6ecfa168bafa2b4d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905251, "uuid": "ad924d2b-32b1-468d-b3b9-458c095d8267", "comment": "Malware payload (AgentTesla)", "value": "7731b960c8c64cbedcf20c3db8b7f96072f843a10a62795c00e81c62715d307d0b7de859288a184ce8617f1c7721f847", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905251, "uuid": "e466ecec-2a1a-4287-b82a-546306628829", "value": "T1749423D1EB51579D621A5FB0AE04B5530789096D1EB33D923B8CAF5B30D91CCBB63A20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905251, "uuid": "26358c9a-8845-4fda-8f5d-d039a2e7e56d", "value": "12288:wWggPCEWgf2vyybfuj2oNZ4VlYIwJkt2eoVgLX:wWZPqyy7uamyLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651905251, "uuid": "54d35357-3aaf-48ba-b58c-580f58065152", "value": 431802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651905251, "uuid": "68b6f133-4eaf-4806-be51-217ab0b727a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905251, "uuid": "f9e5770e-06d9-443b-8ceb-783d960831c4", "value": "STR-DD225227.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19f7fed-cdb1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651892334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892334, "uuid": "fae863e3-fdd7-4394-b05c-86c0d08e3446", "comment": "Malware payload (Mirai)", "value": "0783764fa5fabee16dee312f4f0354cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892334, "uuid": "db632c8b-bfca-4e4e-b635-38d01d3c89bd", "comment": "Malware payload (Mirai)", "value": "5a0fea229d004f0a462b2fef211c19994772e5768a24af7425563fa314c1c439", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892334, "uuid": "91fbd934-99c1-4632-9195-8ad843b68bf1", "comment": "Malware payload (Mirai)", "value": "a5ca928a05871a53cb41729db970e5b86a0b6285", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892334, "uuid": "3093bd49-5ebd-4bb8-b517-1ec9b2fb47ef", "comment": "Malware payload (Mirai)", "value": "74e8d348f9c50bee7df4185d7218f0029df6c71d5f4718672602e0e46e9e4d745f03061b37f8ca02d98d03b7ea19eed1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892334, "uuid": "476fd705-832f-4aa0-8e63-baa433e9d985", "value": "T13B839209BF610FF7E8AFDC378AA92B41248D651661A83F75B934D818F64B24F15E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892334, "uuid": "be61021e-e18f-48de-b2a2-9733bdad8f11", "value": "1536:SAK8fKBYl7XDnGegW5wqJkisCPT6kyJM2azq4gwZwhRiVkXb:68fKBSXDnGegW5wqJmoGkfgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651892334, "uuid": "0655a7be-0153-42a6-bbeb-826d7674e26c", "value": 88244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651892334, "uuid": "67c2a4f6-41c9-4677-9bd0-1986d1ac96e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892334, "uuid": "6cc8e8ff-a3eb-46e0-a84b-0bc0964e4dcb", "value": "0783764fa5fabee16dee312f4f0354cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63add00b-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651904686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904686, "uuid": "a7080638-e475-4af1-b735-9abb4cbbc2c9", "comment": "Malware payload", "value": "66f65899b34d77ac511cdf89e1ceef09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904686, "uuid": "b5f38480-8231-48fe-86f6-1113cc15ce55", "comment": "Malware payload", "value": "5ab2bd50c3c25890d4764206082ce96132b56cf2a84a576a102d52c364979cad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904686, "uuid": "188f18d8-d567-4e68-a797-f33909e238e4", "comment": "Malware payload", "value": "c97d7716c109c09291b8605480468118d339a663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904686, "uuid": "bf0f2fe9-58bc-4595-91cb-87c4990d2b10", "comment": "Malware payload", "value": "a7370a3ccf12aed8658dd11ec1e0ca5f6f3ac728f5d2c086a57bda4e2f663319e09090102739ea52edb7223f36446f32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904686, "uuid": "e03ac092-b467-4dc2-8200-4efc27906926", "value": "T171D4120277D0D131D3964E715832E6B52A3B7C725A78591BF374BB2F2D313802AB63A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904686, "uuid": "085ed49c-9713-4846-93f8-32b8d60306fd", "value": "07bffe0e0cd72ab38210bc42cf55f3a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904686, "uuid": "167e9fc8-a4dc-4cad-815f-cb6af36608fc", "value": "12288:vLm/60R/rtk+nnzDTQJyAeD0Hi5zKUCBfKnX9v:S/VDtMyAnHukfKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904686, "uuid": "c32c2b74-7226-4fee-a27f-610f21117248", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904686, "uuid": "002132d9-2a68-4592-a51a-463f955eb757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904686, "uuid": "f9202a2d-0783-420c-87f1-4e51d7fc9e5d", "value": "66f65899b34d77ac511cdf89e1ceef09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d164ad9a-cde1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651913030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651913030, "uuid": "99a41794-b430-417f-ba57-c42afb6f6399", "comment": "Malware payload (RedLineStealer)", "value": "54553ea2e8d56bef1969398b89e4f350", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651913030, "uuid": "c50f5820-84b9-4f2f-8611-559dc9f9fcb4", "comment": "Malware payload (RedLineStealer)", "value": "5b08076101a777ed70b46a8e17da3ef38ee1a6cf9c0e6f6fcebee863c6789704", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651913030, "uuid": "22041afd-aa54-4580-a821-7650ab92affb", "comment": "Malware payload (RedLineStealer)", "value": "7425f6565d0a5b098dba1c7ed023c0dce94edb60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651913030, "uuid": "7eef7b50-6476-4d10-84a4-8ab8179fd2cd", "comment": "Malware payload (RedLineStealer)", "value": "d1eddc0c331d7112217c41cdd1ac232548583bb6f58c0244b5ca82bd5e997376e04cf53a367d122bf4e0d771327a0d27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651913030, "uuid": "11f4b74e-7711-4707-b2a3-a1b6064e0115", "value": "T11C84CF10BB90D034F5B712F04979D368BA3E7DA1AB2455CBB2D52AED66356E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651913030, "uuid": "4aac659a-2ed2-4592-a068-9fd727acdb1d", "value": "9129a3fce9d5378fac2c2a4063b92d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651913030, "uuid": "cb8cbf50-f64a-44a6-8bba-b71262b4a9a7", "value": "6144:ehZXhShmB5GB5ZYWcE0hi7gvj44NT1Fa35WXl2sZ0M8IW2xA2UwKyT4AgM1VD54R:e/xWmjq5ZYWcuUZxcqYM1IwFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651913030, "uuid": "7c07df3d-f231-48eb-8eb4-e182c3f00d2c", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651913030, "uuid": "eedb6b18-f3f4-4996-a6ed-29aa6e237ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651913030, "uuid": "d8a4b229-7783-442b-81f4-d3ae97ef2024", "value": "54553ea2e8d56bef1969398b89e4f350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71e242b-cdf9-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651923401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923401, "uuid": "da8d429c-a799-44af-b886-5dd30958784c", "comment": "Malware payload (RedLineStealer)", "value": "a9f443ef2113fbb14ae85ae84053b920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923401, "uuid": "0b26d7ba-572f-4248-948b-2ff2368d1d25", "comment": "Malware payload (RedLineStealer)", "value": "5c87ab2626ddab091f00b065a4eccc3329a5d42d4e25209f6749c73af490b7da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923401, "uuid": "e19533de-57e3-415c-a9e2-551caec7b8f2", "comment": "Malware payload (RedLineStealer)", "value": "9b0f3a7dd9f28833307ae6d2f1dd88732ce9ccb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923401, "uuid": "280d1c2c-ec25-4180-a5c8-87dfd3b2f7f7", "comment": "Malware payload (RedLineStealer)", "value": "ef526203c6f3318383699a3d29668382c53721984f4801e0ca880416aad96a8c80d3c20c45dfe1ae35a14c4a19044348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923401, "uuid": "3b9f0ef6-5897-47a2-80f5-75158951cc9f", "value": "T11AB5CF027541913AE8B306B38DBD95AEAA2CBC01471620DB93C93D5F0F7D9F12B36D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923401, "uuid": "27fef02f-dd7b-45d1-8a3c-7cd41da81f4c", "value": "981cbb800170d43b0732e40152890f5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923401, "uuid": "f730bc5c-3a78-47e3-a7c9-59413145b26c", "value": "24576:ky4c1H9v2x9DfEVAKUmZC/gUiRjz87FZccuCM3XTlheybG1PJcpc5eW5TL:ky7H9v2xGAKNVUaEuRXCyoJcpep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651923401, "uuid": "7914d987-ef38-4195-beca-402bbcd5aeb9", "value": 2328112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651923401, "uuid": "bda1effe-de27-4761-9b3f-7977e903bd51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923401, "uuid": "23bcd996-aae6-4bdd-a7ad-6f76d440c58c", "value": "a9f443ef2113fbb14ae85ae84053b920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef52c26-ce3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (QuasarRAT)", "timestamp": 1651951949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651951949, "uuid": "c99fcf4c-4e89-43b9-94b0-7032ee21eb43", "comment": "Malware payload (QuasarRAT)", "value": "b0b7de58bb0c405811b93c53484389ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651951949, "uuid": "932c3e40-6c98-4ea1-9701-6e140913360a", "comment": "Malware payload (QuasarRAT)", "value": "5ec6cce510d69c335c5be169b3919181d7c785d48759a89a2051cbadb522c337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651951949, "uuid": "f70a6567-f44e-4cc5-bb9c-25c6386d2dea", "comment": "Malware payload (QuasarRAT)", "value": "70221f55d2ef65ac6ff94b36a4b9c6b9e11dfeff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651951949, "uuid": "7631ba64-b373-4f29-b36a-83e365beb36a", "comment": "Malware payload (QuasarRAT)", "value": "c022e8e732ab22339665e165737b964978e527ce0c66512ee030a8a4152f8c2e0ac03e5f0bdb2a75d3ffbfea0bd1f4b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651951949, "uuid": "75dbe177-5d84-4508-a51b-c978759d5f75", "value": "T150038D4A7768C725C59D0B31D8B7C7F40B78AC05EC149B0F6696B62F3C71390AB936A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651951949, "uuid": "c9c1263e-5957-4c9d-aac8-cb10b2788411", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651951949, "uuid": "08f1f64e-9680-4c4c-8b7f-dd1cf82104bf", "value": "384:6qVRJROv5ejQM4OqXkHhS3fzUAAeTSvh0iiFQxUAAtJar+8DjcOz6Ev78nqh4r+G:g5ejzA2vbMJa6ijcG6kwrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651951949, "uuid": "569bf1d3-d429-4a5f-a178-85621c54e79c", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651951949, "uuid": "ad9a0eab-968c-4205-9698-75d9dfe579e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651951949, "uuid": "7fbdb2c2-d88f-43b5-b5d2-56cf10ee64d5", "value": "b0b7de58bb0c405811b93c53484389ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d104aa4-ce1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651937773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937773, "uuid": "5814f271-3590-4cc8-ad5d-3d5522186a83", "comment": "Malware payload (Mirai)", "value": "e22e87b19e48dcd114478e97d9756018", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937773, "uuid": "f1cb0fe2-1d8a-43b7-8ccf-0a9f82b6aa57", "comment": "Malware payload (Mirai)", "value": "5ee0c77aebe6686bec394920ff05255bea6ce6f086f9134fd285ff9adcaf7d99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937773, "uuid": "bb4e0679-2e61-4798-8451-d359fb01d12d", "comment": "Malware payload (Mirai)", "value": "4fdb757ae2800d8a4a643fcd5bb9110331900ca5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937773, "uuid": "683be866-2a79-4379-8711-5c8f5c551c14", "comment": "Malware payload (Mirai)", "value": "829fc92269af35836559b2a3c5da6e755bbe756057c0125b08b62fe8a95b4724d595d83da8dc4282850fb680563ab1b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651937773, "uuid": "75be290d-18ab-4858-94ab-9e6962a5e447", "value": "T1B063AE62C9352E2CC2998AB0B5A4CF34D363A50092476FFD91A5C72D9683DDCF9093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651937773, "uuid": "0ce60d4b-d028-4d60-a73c-64503ff95678", "value": "1536:UrL3dHsFDGDzO6xMG8M9OiDkkyC4u8c1Kr/UAN6FG:Y3ticO6xMOzkkytr/uG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651937773, "uuid": "d2cadbea-8911-4fcc-8771-424f6d18e174", "value": 66968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651937773, "uuid": "9c08b4c3-4584-46f1-993a-91c56c8c2e82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651937773, "uuid": "42ba7765-15e1-4425-8094-6442e7007f12", "value": "e22e87b19e48dcd114478e97d9756018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593f2062-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651904668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904668, "uuid": "d3d7bba0-79dd-43bd-a90b-fcff1104a7d3", "comment": "Malware payload (RedLineStealer)", "value": "0fa2600ee26e4819de518cbbc3c9d2dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904668, "uuid": "df755053-0a07-4b38-ae21-53de8221341c", "comment": "Malware payload (RedLineStealer)", "value": "5f570bf4a19fefab5b08aa27b3fffe77236482bd2f9c454dc58565ac7aea4fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904668, "uuid": "5e20be58-2313-4a33-9f01-a1dae04d05d1", "comment": "Malware payload (RedLineStealer)", "value": "25955608c03c7ba9a228e3b4c28295fd707ac062", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904668, "uuid": "cd368f75-49a5-43f9-86a3-701e18f5ec1c", "comment": "Malware payload (RedLineStealer)", "value": "b4727ab36b363b1427d8c586d67886a85d4a3e928ef59fb00dcc494f710c504099b239c5071b6c3a8110723214784d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904668, "uuid": "5a6866a8-af19-4af7-85fd-7ad49f026d39", "value": "T10EC533A17FD181B6C1D3217151E913E528F8EE340F348AE712A63D2F5C369E2973A9C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904668, "uuid": "57ecb68c-2640-48b4-ade7-93081c5df8f3", "value": "650ed02ca4b6baad6b24f20402b6268b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904668, "uuid": "56460fb7-40a6-4d65-a996-3bc93dd037d7", "value": "49152:DdIgmsVHQSAxlaIYIds5MtPIRs14lDiPb9YP5kSSPKDz1b83K:Dd5V4aNIGuQRi4lGxYBktP8z1o3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904668, "uuid": "c8e5c393-3612-4ccd-995e-1a1061a8b16b", "value": 2568648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904668, "uuid": "c9ef3780-d1a3-40a8-8c80-cfb3ad5729a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904668, "uuid": "77c86371-14aa-4737-8e7a-5a447217bec1", "value": "0fa2600ee26e4819de518cbbc3c9d2dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f532abee-cdc8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651902353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651902353, "uuid": "512489fb-f186-4097-9708-755fb53d43aa", "comment": "Malware payload", "value": "f247772cc1f725a5c133989ce1d769dd", "object_relation": "md5", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651902353, "uuid": "45025f35-8984-4c85-8f9b-11bff2b842c8", "comment": "Malware payload", "value": "5f5ca4da261edd92a753cbc6e0813f28887f639664811b946f3f60d6ff1deda6", "object_relation": "sha256", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651902353, "uuid": "95884da6-3ed2-4670-b713-b78ee9f69832", "comment": "Malware payload", "value": "d004c1d9c5001484cfa3c1e48d989297a78d068f", "object_relation": "sha1", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651902353, "uuid": "e55ab6fb-678a-4879-9956-cccef7c10abf", "comment": "Malware payload", "value": "6a46f1717bee245339c839740b03fefc7750bf83e40fb6c1968691699f7c6610aee99c602a0956996461621bf927736d", "object_relation": "sha3-384", "Tag": [ { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651902353, "uuid": "f58addd6-6521-4eee-8713-064c8f679a22", "value": "T179549D45B39800AAEEA7C13ED461059BD6F278535F61CBCF07A0866E2F133E1753A726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651902353, "uuid": "4bbd0606-b377-457a-8eeb-c212230602c4", "value": "8c1bba54b279e939de5ccd6eab070349", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651902353, "uuid": "50493861-35d1-4d62-814e-1e49aca57a7e", "value": "6144:d8E4mjO6ddxrGywuT4UkTQzhGW2isigAqS50q1SvLz5uje:pjO6dTGXu8U/oJqJ+vLz5Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651902353, "uuid": "36e3c363-4e3a-4891-a65c-6d5df9c1f692", "value": 303704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651902353, "uuid": "a117eb72-b091-4f21-9d42-9aaed78a9216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651902353, "uuid": "74a0fb72-4539-47ab-bd01-348d28d8c13d", "value": "5f5ca4da261edd92a753cbc6e0813f28887f639664811b946f3f60d6ff1deda6.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260b0fe1-cdfb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651923910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923910, "uuid": "29c085d9-aba7-46ce-a1e2-96a454eb2f40", "comment": "Malware payload (Mirai)", "value": "12025065cca74b1fb18cc6b154a1aa77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923910, "uuid": "a8bb3a49-ea76-429c-b932-abb66081d656", "comment": "Malware payload (Mirai)", "value": "5f6b75f82cb6ad8c30ed96468873a2babffde0f1c6c9f6edc6ec3ef04764f81b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923910, "uuid": "0ebe9070-42a1-4e96-baba-9264eb7f1add", "comment": "Malware payload (Mirai)", "value": "c501bbf3cd448f23878f6c426951666b67d6d51a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923910, "uuid": "300848dd-70ab-4344-8134-7075b6fcf21e", "comment": "Malware payload (Mirai)", "value": "952c8a5ccd0ac6d4728b661dd058be0a764e7cf5e7477915f56b169b56a448cbf4df8d67a3d7431414bb199466c9c3e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923910, "uuid": "f15887f8-6aa5-4275-a805-b97c9dd2a50a", "value": "T118737DC1E983F4F9EC0216B9213ADB76AE33F13A5579DF96D798A623D801600D60739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923910, "uuid": "13b55368-5924-456a-8daf-351e2e15f261", "value": "1536:XQqrR81Ab2XHovmGw6I9ekqB8njMclCBzNN2CjvBQ3QoKBphSl7Cb:AqrR81ACXHovTwV9ekqWjMoCBqCjJQ3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651923910, "uuid": "da4b64fe-24b1-40dd-88f1-ce668d1adec6", "value": 75700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651923910, "uuid": "87ecb7f3-19bc-4567-b6ed-660816eb1602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923910, "uuid": "4886a8c1-1384-4ed1-8b69-944cc3a7e2cb", "value": "12025065cca74b1fb18cc6b154a1aa77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2432435-cdbc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651897060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651897060, "uuid": "7126924a-3baa-4df2-9ec4-5effdffd11cc", "comment": "Malware payload (Loki)", "value": "ddb2d596ed4a5df0234476ca0fba895c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651897060, "uuid": "2037bb30-38b0-4d6b-aad7-120d8373e45f", "comment": "Malware payload (Loki)", "value": "604cfa1c1f0957f81456dca9dc28be711eacdb2b64ec0023b8dad52e9627ff00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651897060, "uuid": "7f4ac3d1-85bc-4002-8094-3b446ba2ab40", "comment": "Malware payload (Loki)", "value": "13b38c9f4fcad950f9e6e8e0fc1e7fff14d23a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651897060, "uuid": "82086430-e918-40d2-b83f-07c4bdee5db9", "comment": "Malware payload (Loki)", "value": "9d1ebe161e5d82485cca3b4b9d641ea0eb624f96675968c0075087beea170352b9cefa97347fb1422371bf174c02355a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651897060, "uuid": "576c7289-1fe3-40f3-b373-dccfad2ba4f2", "value": "T1B7740C91E8535838CA244778BA7396B01CF9EC70C907E6716B207EE6F13BA20ED75572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651897060, "uuid": "6f1b543d-bd3d-49ee-87b8-5106801037a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651897060, "uuid": "165cec49-80e7-41de-8ed5-4054a53cab56", "value": "6144:TXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwwjwX:TWtWrnngnnnKnanxNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651897060, "uuid": "df2b9e6b-2c39-4f8e-871f-181fd8485c39", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651897060, "uuid": "b7ebf765-bbd9-4728-bb71-a9dac1fec855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651897060, "uuid": "926ee0ee-027f-4c69-80af-7a474e40a035", "value": "Zqgmbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45be903d-cdb3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651893039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893039, "uuid": "cd8a0ae2-0ae3-49ec-8a82-2f5a07556a09", "comment": "Malware payload (Mirai)", "value": "3ad577fdb5b303e452591ceefee82019", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893039, "uuid": "f49858e7-f15c-4434-96cc-54e1164ff172", "comment": "Malware payload (Mirai)", "value": "63082fc912602f5a069ac1a395ee77511afd23b2794bc363321e426f0571437c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893039, "uuid": "cc182666-904d-4b56-9bdc-2ad7c8ec1f7b", "comment": "Malware payload (Mirai)", "value": "6d86637c23f71da0b3ce49d1d4464812ae2b9c6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893039, "uuid": "f0e4efc6-44da-43f7-93da-5669ec961062", "comment": "Malware payload (Mirai)", "value": "21849d98a5afd2dd0a6a25a1f9aae67b28311968d81a37e3bd6c33240984fa915d9485eb83b55290c83988d2087fb213", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893039, "uuid": "270b3889-661a-436a-a086-05663294c9df", "value": "T11783750D3E219FBCFBAC963547B74E219648339A36E1C584D1ACEA025E7034E741FB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893039, "uuid": "474005ba-4cb3-41b2-844d-e1d8ab71c540", "value": "1536:r4P9bvmLVd4HKPPj8N9H1YbIkX2EMRJE/FBQ5cShN9zz86U0tN:slbvQVd4HwSebIkX2ZRMSLZQV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651893039, "uuid": "d81f5cbc-fa13-449b-87a3-9f834c4ac647", "value": 85156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651893039, "uuid": "b595053e-477f-4a5c-b87c-75f8ccb8ecc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893039, "uuid": "28ce252c-6bc4-4174-a542-b95215f1be2e", "value": "3ad577fdb5b303e452591ceefee82019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c61178-ce1b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651937782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937782, "uuid": "443b87cb-e3c8-4402-82f4-1bac35d69d3f", "comment": "Malware payload (Mirai)", "value": "d8acdd9c8724314e6c722be1cf7ca44e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937782, "uuid": "4e8b2e78-7b9d-4d6d-b518-1e5e9cab4fbf", "comment": "Malware payload (Mirai)", "value": "63666f77720393e097e4d88643e91bc7a9954ee1a0c2c1ab116e032afc951e53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937782, "uuid": "9e182cd9-132d-41d4-add6-216e22b0e392", "comment": "Malware payload (Mirai)", "value": "7b8a545c1fbf7c7f0c292a8cffdec1a94e14fd65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937782, "uuid": "f3800cca-e0f5-4566-b80e-0eebccebfe5a", "comment": "Malware payload (Mirai)", "value": "cb008df6173120e7152095a658b64b97d9ebc3d2c08f932b73dfc98a68f7125989ee02da097582bf72966cf926242026", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651937782, "uuid": "45a1cbc7-1c5b-4610-b2fc-b471e159fac7", "value": "T1CDD2F11291061C51CCE31976AC3F7E4C0A28160FC2AC99F6CFD869296FA1F63B774395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651937782, "uuid": "8d2f7c83-f143-4ca8-b63e-0aaf2ae56b8c", "value": "768:tyq/1MgZnPAhEvQTn38TOB5qZBnHaARv27eEuYjnbcuyD7Uryqgbr:tyq/1rP4r1B4Pzv275uYjnouy8mqgbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651937782, "uuid": "af58b39b-b136-48ac-be0e-f2cc47cfe84d", "value": 29516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651937782, "uuid": "eb1909ad-90f5-45cb-91dc-51cda899da4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651937782, "uuid": "084c9bc0-3b00-40d5-99e9-32c60e2b35b5", "value": "d8acdd9c8724314e6c722be1cf7ca44e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bca0777-ce1b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651937744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937744, "uuid": "4e1a1730-4e2e-4bbd-87f6-390941dd6ad5", "comment": "Malware payload", "value": "27d30d43bb6fb33c1e1ea5d7c9ba11af", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937744, "uuid": "9e653ed7-4f29-4620-9e6b-686c43a323a4", "comment": "Malware payload", "value": "63969f39c2f68fd9e5e6bce5819c79a8b07b770421e3f12438e606f69379e739", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937744, "uuid": "3e78f38d-4109-4ad2-8cd0-669992ffa01a", "comment": "Malware payload", "value": "e8351ebbda23c0a077ce2eb4056facc2ab44d2ad", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651937744, "uuid": "1a86a810-7163-4c50-9ca6-bebe41ee0066", "comment": "Malware payload", "value": "27be05afd90e16696920f1c98360c01c066ab07ac4b7154b96f1fb7d51b10f7a0a3503b52287899cc1f1dbfcde20dd30", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651937744, "uuid": "54f1a432-cf0a-4e28-9420-aca6c2f9808f", "value": "T1D7C53314A9E131C8F963943263FC419DDA37B8590BA63DAAF5043E2EC00759737B5B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651937744, "uuid": "33233b57-35c6-4ca4-b592-a08b8111b49a", "value": "49152:WfF27FM2KDIwvdsR8eeV5ip1Ra1ZTDoHRyB2eamlRwByBDUdNF:Q27FPvwvdsUVoq1hDURyB5aeRAy9gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651937744, "uuid": "3923e5c8-016b-4677-be4a-d692279ade62", "value": 2675839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651937744, "uuid": "cd0f5731-beeb-46b8-a33f-df3247b903e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651937744, "uuid": "848dfa67-91df-49cc-98ac-2a249e2d5c6a", "value": "metamask-black.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b641a0-cdf9-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651923104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923104, "uuid": "ea9db3ca-0942-4641-b633-fa81436b1b48", "comment": "Malware payload (NanoCore)", "value": "a9c42191160e02eff33040feeed6b5f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923104, "uuid": "4ed8857b-248d-4400-ab0d-48c7edb2e5ad", "comment": "Malware payload (NanoCore)", "value": "63a0aaadde3fc67e75ade5ec3840257a47981567fbc9870b30726fa93efe6a63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923104, "uuid": "d8678b48-f44f-4da6-9fc4-9b95a641316b", "comment": "Malware payload (NanoCore)", "value": "06ba0cdd3f5f34d3b430471b54c40db583eebcf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923104, "uuid": "fec72429-2348-412c-8db6-68f36c24fce4", "comment": "Malware payload (NanoCore)", "value": "11c8e0627529240f25157f183f25a51da2202120c96e30215fd22ae2c5ec3ebd63c27233e1b966c92eb35f12726c08f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923104, "uuid": "b4c88bea-c684-47ce-92fc-dd3eab4cf015", "value": "T14A157C5C3660B1AFC867CA72DDA81C64EA30B867871BD307A45312ADAD4D69BCF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923104, "uuid": "3d4f8007-9235-4b90-8636-be59be5ee2de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923104, "uuid": "c8912ce2-7f5a-4605-8594-871359a9906c", "value": "24576:N9aTR7/ZPqUdWSEVHje5ZkL6nuyfa6xS:N9UR71dWSsHjcZ06n9ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651923104, "uuid": "2710b3ec-1bd0-4f2a-ac2a-bdc59b98cb52", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651923104, "uuid": "5f4c271a-a942-40cc-be43-4a1fec897058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923104, "uuid": "245cb185-9cad-49c6-b712-9558e03387b0", "value": "a9c42191160e02eff33040feeed6b5f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad6d42c-ce4c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651958707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958707, "uuid": "a47356e1-66c7-4c30-9be3-3eef16a87078", "comment": "Malware payload", "value": "ccc7f68d2dbd6801dde30ff57e5c0c2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958707, "uuid": "ef2178da-1c33-427a-88e5-44b7afe8a54f", "comment": "Malware payload", "value": "6557f5eecf1df5c7835d2ed88f99b52503873c6307b946b15d81a1e5a885c87a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958707, "uuid": "8479220c-34b0-4735-bfdd-cb67f238ece0", "comment": "Malware payload", "value": "3899e2803ec9666b17684d1cd42931bb55a8f9e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958707, "uuid": "13caaed8-f73a-45c5-8806-ea9bdc1241f6", "comment": "Malware payload", "value": "df62fcb2fbdcdefa796c458a40ebd405b81fa41048061ea223139cec2e0986f02298f8232e7944f80b8b11746f8e57f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958707, "uuid": "32e93664-cf15-4508-ac8e-2280750bb73d", "value": "T117B4E16173B005EAF8A3147048931A06C6717971233169DF9FA2125E9F3EBE1763AF26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958707, "uuid": "7b3cddb0-9798-4ff7-a948-a5de710feb03", "value": "c1094db86dc395b7d2305ded1da1ec3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958707, "uuid": "133ae966-308d-4c0e-9f57-f3878ff7e6a0", "value": "12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRU:knmj6xK1y3Ik6TZGRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651958707, "uuid": "8859be2a-8773-4dc2-a731-3aff622a8ac9", "value": 501873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651958707, "uuid": "7b44931b-407a-47d4-82bd-5dcc64bb39eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958707, "uuid": "21e01fd9-e6d2-491a-a382-8c5564bb52b9", "value": "6557f5eecf1df5c7835d2ed88f99b52503873c6307b946b15d81a1e5a885c87a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926303cf-cdac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651890161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651890161, "uuid": "2eba34fc-80b5-44ef-b270-7a22f3c408ac", "comment": "Malware payload (Formbook)", "value": "3a455d63a14fe5d2064baeac348d977b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651890161, "uuid": "49b6e8e9-73c2-46ef-bb0f-79ab9335bd2c", "comment": "Malware payload (Formbook)", "value": "6574b76476fdc69ca469323d32b090f99f5ecddf6915daf13b812cbc77c15cf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651890161, "uuid": "3b3ca053-8061-4034-8eb4-720b638e9224", "comment": "Malware payload (Formbook)", "value": "704ab6d404e72d2bbf603c276e50f75017126a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651890161, "uuid": "4af4591c-e45d-4bbe-a6aa-ea1d04094ed5", "comment": "Malware payload (Formbook)", "value": "6dabc66d49473e3460903da5ea99aa2343a0a5fcdcdd13b7db8c8a3fdd059a149c2b6a17f99f8b6a644e41ba32ef56d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651890161, "uuid": "18014e9e-ed13-42df-8fdd-e74e0e639a63", "value": "T1F8740C91E8535838CA244778BA7396B01CF9EC70C907E6716B207EE6F13BA20ED75572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651890161, "uuid": "c15796e4-23bf-4fae-bf7b-aa2a86ce2a8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651890161, "uuid": "886f2ae7-8096-4d00-b51c-1360aed7a67e", "value": "6144:UXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwwjwX:UWtWrnngnnnKnanxNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651890161, "uuid": "84328286-b2db-4f47-929e-81a388420599", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651890161, "uuid": "9d500d5c-0bdf-4680-beb1-7e5b192515b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651890161, "uuid": "96523fdd-628c-4f08-a6fa-b5448807434d", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63b7cb3-ce52-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651961491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961491, "uuid": "7e6289af-3dfe-4dd3-b994-a4ab15756739", "comment": "Malware payload (RedLineStealer)", "value": "1e91db1c1856469177a94ae2ad0826c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961491, "uuid": "6246b3f7-4618-4de6-8d7a-51c66799ecb4", "comment": "Malware payload (RedLineStealer)", "value": "658ae14892f16363d9fe7054a515bfe994d27551f265555d62ee9fac38e9d7a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961491, "uuid": "c40e7ba8-7325-4eca-bc6a-b53a9f54744e", "comment": "Malware payload (RedLineStealer)", "value": "4b265c1ba65f980b42238cd13d1dcf7340f88215", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961491, "uuid": "e778c9da-e89f-41b5-bac9-18725b693fff", "comment": "Malware payload (RedLineStealer)", "value": "4c2d99a6c45e1840de94883aef44e7051e5846fa8155d85433f9c5215b9e482f5ea29131f2ed93001f0b72fd2c66bfea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961491, "uuid": "4b849c13-d488-4db5-bdae-e9abb494c26f", "value": "T16784CF04FBA0D035F1B712F5897AC7B8792DBEA19B2490CB62D92ADE56346E4DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961491, "uuid": "aa394819-3ed5-4db1-9588-269f905f3aee", "value": "c2f34b03efba3580b2f36c10f3cf4dcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961491, "uuid": "cf5febf1-daef-4ac9-af53-10f9336f8884", "value": "6144:+sPtsuc1JgYTwPjPoaeJPGP4qK7gwuZkdz3WpqzGpQYxPH0SkFo:91S1qqwPjPofPiouZkMkzGGYxv0Sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651961491, "uuid": "6a09db33-e0c5-4567-9cb6-ce9b330448b3", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651961491, "uuid": "7600fe87-412a-4fe9-a699-69f67f1fbe08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961491, "uuid": "204ac29a-19a0-46ce-a7bc-db8aeb88fcd7", "value": "1e91db1c1856469177a94ae2ad0826c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efb114c-ce1d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651938581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938581, "uuid": "0ccaa049-1937-4946-a500-2cf0217a5d64", "comment": "Malware payload", "value": "e5e0531502b68aaa16b8d49bb9ffc401", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938581, "uuid": "d8e7d64f-4c16-448c-a746-99bf2dea0c9f", "comment": "Malware payload", "value": "682051ecf035b6339beac8481045ce698a8b43499adf5431d5ec85c66fd1e81b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938581, "uuid": "41bde8a6-6407-4266-b28c-6ee44efb0884", "comment": "Malware payload", "value": "c236053921507e18dd878f2280217c645f4a83c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938581, "uuid": "bbd833d2-e101-4873-b244-e58d8f110844", "comment": "Malware payload", "value": "7e7a61f961d25953459f590e813b5c384a951754eb6f29bc46806df584c8b88b877bf56d038ee2091ac83bce7f0c8d47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938581, "uuid": "6a259041-8209-4584-93f0-959a785142dd", "value": "T184F2E178A61C45EAEDFB08B8016ACFD1D7E009D00879E4D432B4BF3299689A7855DDFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938581, "uuid": "87c02cbc-dd30-4825-8174-48ac96b86fb8", "value": "768:SmcnQZpUe951q4nbS5WLYmXG/FDkjdo5oDm+E376r+q+4uVcqgw02NWXa:J0Kd951vYmXuwO5oDbjrd+4u+qgw06WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651938581, "uuid": "7119be88-2fef-4242-a6a9-8f50da62b416", "value": 36512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651938581, "uuid": "11b406c1-465f-475e-8d6e-ca19ee8a64e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938581, "uuid": "fc85b79d-515b-42c4-850a-c6a5fbaade14", "value": "e5e0531502b68aaa16b8d49bb9ffc401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c159139a-cdb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651891958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891958, "uuid": "644972b3-68a2-4fc3-9093-dd4212a31b13", "comment": "Malware payload (Formbook)", "value": "7b7cb7e0741b18fb8e86c5842c49372e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891958, "uuid": "5f481b6b-dc92-4ecd-a637-9eb94a70b4e1", "comment": "Malware payload (Formbook)", "value": "6a17c720bdfb8e4939c97c9a716aef66bb983fd8ae129c532467471fa15b506e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891958, "uuid": "3615c12d-c9fb-44ba-8df4-29378a502a08", "comment": "Malware payload (Formbook)", "value": "7c83c2780e6e24911d9d1518c1552dec8d8b88db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891958, "uuid": "f3778600-dfcd-4fca-9ef6-a8739e0c178e", "comment": "Malware payload (Formbook)", "value": "00e83938b4c88d1b3f4e1d3db9d0b131cfc8408bcfff771a64ecea694b861c87e1ad9a8c1d9bf5ff4e0dff7d73981c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891958, "uuid": "04b0729b-227c-4460-ae30-f24755a855df", "value": "T1B103F55AB892561DC5D47BF869B1A19366367CE10134C18FECF97F29AD72223CCC226C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891958, "uuid": "cc5f5c94-e4df-45fd-a269-f7f41bf34a10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891958, "uuid": "efce1c94-524b-4bcf-a007-670c84a58eb9", "value": "384:kwmc1hMuWRtm5QXulaiAMwCKFH2S3dd0hUADkajf:kNVoxlmMwCK/3deVDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651891958, "uuid": "398a3874-2010-4a63-851c-ec95c6af33fd", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651891958, "uuid": "fb7ccda4-d516-442d-86e9-ac951e222fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891958, "uuid": "d199f28d-c1ea-40b3-9013-4ee36382b5f8", "value": "Quotation 2202 - 05 - 06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0140d8b4-ce5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651966797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966797, "uuid": "4e1a25db-a5fe-4acb-a856-127a0d243834", "comment": "Malware payload (Mirai)", "value": "1d58d06c9e3d0ac2785c31673b80b530", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966797, "uuid": "2245ba8e-4790-4092-bd06-e0675a96eaa1", "comment": "Malware payload (Mirai)", "value": "6a7548c1301335da4d5acd795b315c054b8a66b334919715e7f56658b74cf1d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966797, "uuid": "aaaf90e1-2f86-4829-800c-8da83f9fc6d0", "comment": "Malware payload (Mirai)", "value": "4a1fbf3d80487c356165801fd93d10a5098335dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966797, "uuid": "94e4b46d-fbf8-444d-8bad-a9c91970fd32", "comment": "Malware payload (Mirai)", "value": "47c207f1bd37ff082fc388a4359d041e7f25c03b206627714ba1266948805a097085d2951ebce096d4670eb0b7a146f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966797, "uuid": "cf4e551a-35c9-4f47-be35-bd4f3ad207a6", "value": "T16B337C65D46A9DACC1064AB47628CEB48B22E0C0D7473DF6A720C3A99053EDEF554FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966797, "uuid": "6bf5d759-d4b2-4383-bff1-720f422f55cf", "value": "1536:iaoQjDTe9iJyfs3owd1/q08zthypvNLOOlFslENC0/m4:ifQjU7f+oq1PFslg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651966797, "uuid": "496b19e1-9d3d-4450-977a-f1d1d465d73d", "value": 51664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651966797, "uuid": "44bf3b5f-4b81-462f-8c1c-dcc0381e53ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966797, "uuid": "61e86833-2cca-4f59-85d3-f2f750a86557", "value": "1d58d06c9e3d0ac2785c31673b80b530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733d5bfb-cdb2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651892686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892686, "uuid": "e7a3f847-a23a-448a-a145-bb8107fac405", "comment": "Malware payload", "value": "aad60e3f627c17ce29e2509d7b873241", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892686, "uuid": "006058fa-c8b1-4afb-9dcd-0e97096e205d", "comment": "Malware payload", "value": "6c1ac2546cd5e7a3ece5189df35c95ee8d4d51760252b8ce4ce54ac2516afba8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892686, "uuid": "c3ad0103-9ecb-416a-8b99-373f783ffdb5", "comment": "Malware payload", "value": "a779b1dbc0dc5c8ff17b2a5b53dfbeca6d63e01e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892686, "uuid": "34561d60-e728-4bd5-a8f3-e362bd2d3896", "comment": "Malware payload", "value": "0128423d2eb12a1343fa2cdb8322afaa9989f3615fbaeb47e441431d0536592382240844fe51e5afba83bf316575f88f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892686, "uuid": "d0c0f03b-9a0b-421e-81b3-bab108c166aa", "value": "T11F9533B2FDCBB551FD83D13CC4692093D29D12180967EEAF6F84D49A2C62E067B12D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892686, "uuid": "d2b896a9-3005-41b4-a0ce-377e3abf0f0c", "value": "49152:WWNawpNS5S2cztGwTjcYh6tjUOatYKczO4f5/bnJoyjKYQS4:3Nd/z2c88cYh6tjZqcf5DnJoyB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651892686, "uuid": "d1fb9e84-6777-44ff-a84f-3eb6cb6e7af1", "value": 2016656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651892686, "uuid": "34e96d89-2475-4039-a7a9-179a58635aca", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892686, "uuid": "f1853186-a560-4403-8bbc-0a6b717159b4", "value": "eblaghe.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949a7644-ce01-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651926672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926672, "uuid": "e72c1991-9435-49b5-8bc1-ffb5aeef2e5b", "comment": "Malware payload (Mirai)", "value": "d90985ca3f9df13a85eb9cccd4cf842b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926672, "uuid": "c9ea921b-7bf8-4e73-b196-a22c5167b68f", "comment": "Malware payload (Mirai)", "value": "6c3ec452641d27e5db6892deab24f8d4eb88ca6a9dfe244cbeab4ee596f33a31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926672, "uuid": "dd29f58e-c2b8-49a3-9378-cd7a2c2802ca", "comment": "Malware payload (Mirai)", "value": "b49e218bad9782dcd280f20f7b085ce21dca3f41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926672, "uuid": "021e6a16-3e1b-496f-8117-46cc314f52be", "comment": "Malware payload (Mirai)", "value": "1d1650ab8dd398aa72bbb38635dae26d29987f556a4d74c950424a3936af25b42493ebbd194863b8a41955d8bef94108", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926672, "uuid": "3b22e309-0e4e-4c7d-8915-c3f85342454f", "value": "T1EE330274BAE9D4D1C5504B37FCAA8319F12219EB32BC246633356E456E892CFB780693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926672, "uuid": "a91faa40-3c21-4e25-8619-ee1d91f33720", "value": "1536:tkf6XYXVHoeEQ9/MjYi1sL7114pJYbSxfCC:tc6XgVHog/XiGL71ypR9CC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651926672, "uuid": "d265e8c0-a922-42fa-a417-6160e48501e4", "value": 53628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651926672, "uuid": "63fb8953-779b-4544-8f09-c2f731ee1b9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926672, "uuid": "75fae99e-5523-4249-9873-6d88dc6fd2b8", "value": "d90985ca3f9df13a85eb9cccd4cf842b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bfec91-ce58-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651963804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963804, "uuid": "94b1b060-1fbb-4abc-b474-566b4179d8bc", "comment": "Malware payload (Mirai)", "value": "35b64ef6b85a45d127a1f3c29010aba0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963804, "uuid": "1374f39a-b146-41d2-8ddb-668e42159d78", "comment": "Malware payload (Mirai)", "value": "6d72ef5819e94ca767942c9bfe57a7d2bf4106ee89ff7e727f38b8a79c0ba7b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963804, "uuid": "26c29d31-1323-436f-89e7-d02b40ee3734", "comment": "Malware payload (Mirai)", "value": "a32ad47543208f68c20c2f0791baf309910fc28e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963804, "uuid": "b76d3bc5-800a-4cb5-8ba9-09d9bff80641", "comment": "Malware payload (Mirai)", "value": "52d66815aa165e63d02c99d7eb9f82323287a4ea404ca85e5ebd9fff913284a21d853b7214e83cbe37b3ef96ff17c2f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963804, "uuid": "ec037e74-9516-4d98-a5eb-4384be784ec9", "value": "T172B2E1896FA907B3C017423F5B1D11B626362C7A588EC7823C56E6580ABF4FAE971819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963804, "uuid": "f277845b-0363-49ad-910e-4d54c7bf8307", "value": "384:MGT44eyTGkYNxGdfVlgANQWm8JaXaTz/QGy3vlA5GjbxRGKRNaS4O9NIxNLv1Rn:Rc4VTqxufVljSqUSGlRGIf4609n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651963804, "uuid": "ab6b3bae-03b5-4611-8d90-0f4c2fd32a9e", "value": 24748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651963804, "uuid": "28385188-14c4-4be0-8610-fb7933ebf139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963804, "uuid": "ec29aad9-ee84-40d5-bfbf-1c2eaec9bfcc", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094d9c7f-ce58-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651963805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "af5d3de3-36e6-4b4d-bdbd-433edc4270a4", "comment": "Malware payload (Mirai)", "value": "4204b4d87dc091c5be9d1fe5b050f3a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "93e4ddd7-0ebf-42a4-afdb-0a11b6df97e6", "comment": "Malware payload (Mirai)", "value": "6e599881bdb07836e432d21df245a79471c8a7dc9a6292923c41ca7b81467246", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "bbad9587-b4c6-4e92-950f-534bd4794d2a", "comment": "Malware payload (Mirai)", "value": "fbfb102f29b0993156b188cb43e21e23618f5443", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963805, "uuid": "ffdd4d64-92c7-4059-ba90-12cb48dfc2c2", "comment": "Malware payload (Mirai)", "value": "efde1103eea61a6c8f789183cc819083c039ac671759611f841a68c7302f2e856bb36b64deee2b183d4539b27926c4f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963805, "uuid": "9bb9bf8c-b78f-44c0-8ba1-6d7faa18f3b0", "value": "T1F823F1D2BA1C42F5AD31F6BDA87C47E2B32A0DE465ECB823027812547BD0565B3F54C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963805, "uuid": "641f821c-6703-4d30-92df-99acbb5e1470", "value": "768:h5lpPa7bgMGjBu9oWyljtf1vIjDJnCOmqWDVzQ2Clc3fhW9q3UELUyTQPvfaYvJP:hJPa7b2ujyljLQ9CdDVzQnO3NLzQPvDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651963805, "uuid": "4da82397-7013-49f3-b144-e8dd65c99e07", "value": 48996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651963805, "uuid": "f8498319-f0ac-45b4-8984-d364d54997d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963805, "uuid": "f2e16713-50d4-466e-9709-56529e384326", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b105e69-cdda-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651909825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909825, "uuid": "64af0f64-f678-48ff-97bc-91fd02c9841b", "comment": "Malware payload (Mirai)", "value": "8196f09028807c07251ea9cef84a607d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909825, "uuid": "0d6fd7cc-7c17-4172-8791-21aa05cf9586", "comment": "Malware payload (Mirai)", "value": "7162193fe91cce7bb623df136e76de27ae7b560a59b14c07124546809c79fef7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909825, "uuid": "aad5113f-67c8-44c5-b780-c73f5c86ff39", "comment": "Malware payload (Mirai)", "value": "140772cabec1807b3279fe627aad775aeb5dc4c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909825, "uuid": "bb9e141a-f3e5-481c-8212-1465e81c13f8", "comment": "Malware payload (Mirai)", "value": "754ff4cf231ad7087c1f69c77a2001cf8e611a11eb78f09248a4ee14950e10b2e3f5ecc399c27a790d89750915bea499", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909825, "uuid": "d93430cb-cbcc-4f0e-ba3c-54a65dfbee80", "value": "T10A736BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909825, "uuid": "b5d4c767-0c2b-48d1-8488-9a888716a586", "value": "1536:f/DYQYs1ZokODichjf15UzOHIt09bfsH18ruUGDKVQSi:XDhzUkODichjXUzk40h0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651909825, "uuid": "2bab5087-528f-4ae2-8a95-15533e5cc82b", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651909825, "uuid": "33ba63fa-def2-40b8-aca0-ab10180ac854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909825, "uuid": "277bcf78-2175-4320-a29d-981490690641", "value": ".x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe2c5c9-cdc5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651901022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651901022, "uuid": "ee8dff1f-1cc6-4de5-ab4a-ee7a0f0f2289", "comment": "Malware payload (Gafgyt)", "value": "02f9b655461e27225bca89c55ffac9eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651901022, "uuid": "2e261ed8-b856-45f3-b295-5ced568fd128", "comment": "Malware payload (Gafgyt)", "value": "7207d6ebd3c8a76b59a5f9afec779b938918a428b46f329998968c8e099a4f64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651901022, "uuid": "8c930ffb-737f-4806-a261-9d769ce9eeac", "comment": "Malware payload (Gafgyt)", "value": "2e9a65b5d86573f8193467a44d1709c3b5990dc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651901022, "uuid": "fd21e833-e60a-4805-8707-2cd6155d3529", "comment": "Malware payload (Gafgyt)", "value": "861f1f4789e299024f2f35784f075c2d36581fd6defe1018b94b14f3fc4cde7ed3655be54deb254633b5314c9ec6324a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651901022, "uuid": "0913e4c9-d950-4d38-8996-55e99136fbdd", "value": "T13DD32B56BE82CF13C1C325F7FB9E4299371667A8D3EA3103DD256F61338B5DA092A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651901022, "uuid": "a71103cb-d017-4320-8943-60ce3176e000", "value": "3072:ieHRAGEp9rrJUlxPfM5dwMFs1OP6wO0qGot780f:9HRZmpExXM5dwOsAP6wuG0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651901022, "uuid": "af454917-7a5c-4078-af36-deb593215017", "value": 131016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651901022, "uuid": "7eacf9a2-8bd7-4aac-954c-dcc46476f892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651901022, "uuid": "3dab48bb-e6c5-434a-afa1-f4edc935fa5d", "value": "02f9b655461e27225bca89c55ffac9eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0aef74-ce0f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651932614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651932614, "uuid": "a7aca33b-15cc-4a95-860b-5d3408323b1b", "comment": "Malware payload", "value": "2046de6df7806482b2fc6e40c0c271a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651932614, "uuid": "7a7b68e3-beff-4448-974b-e27865a50564", "comment": "Malware payload", "value": "733e065f1471507be92caffc8c956a0479d572a51d275482da48e9815853e8ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651932614, "uuid": "8d149351-205c-4e99-b69f-c696d20ef955", "comment": "Malware payload", "value": "1954e6cb97e6473c86ff06f8a99bebbfc88466d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651932614, "uuid": "ca26fd5b-46a6-4a90-9df9-7aa065c42c20", "comment": "Malware payload", "value": "4ba0ae0f1278cbfa8e2ec4c9196d0e5210650c1ef4c8ed65d36c820467606d760dab20fb3837f0c6cc2fa97e4d91b941", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651932614, "uuid": "c5279cc1-8af3-4ff6-b2a1-2a1c7cff9068", "value": "T115F4F110BB90D039F1B716F45979C364B92A7EA29B2444CF62D46BEF66342E8EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651932614, "uuid": "943ceb24-c96c-4d04-942f-da65429b9773", "value": "76ed3e8c2fc2822f37031e8769fe515f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651932614, "uuid": "75f70c0f-2fc5-488c-8efc-1ca0444cf220", "value": "12288:yDV0ZIFkykg5HG7mRtpzaa3hO46CBgMNkChWdV89xNF1GqfwkoronviFxebO:kk2P553pbQ7WgMNkC8rq9nqDebO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651932614, "uuid": "d9f650dd-bdef-4347-9392-5b5a19c2d461", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651932614, "uuid": "14c7bcb4-0468-42f5-be3b-a1f017f9cb74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651932614, "uuid": "c4c3e0c9-4972-4aaa-ae3f-86421e0f9ac2", "value": "2046de6df7806482b2fc6e40c0c271a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8a2bad-cde3-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1651913770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651913770, "uuid": "0752bf1c-bcd6-42b0-81ec-5911e17feed9", "comment": "Malware payload (njrat)", "value": "64bd9f08a37c89f98afbbc67c31d1dc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651913770, "uuid": "150a0e7e-09aa-4356-9057-51504de2c009", "comment": "Malware payload (njrat)", "value": "74930f391391228cb3e41c67a3cea82627be6e42b16df0686a5d1ba792383897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651913770, "uuid": "7ae13460-e17f-402a-8e18-8dcdd542dca3", "comment": "Malware payload (njrat)", "value": "9991e7159224e44e5c1a8bc24543f1c51b0cac4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651913770, "uuid": "527328b9-b38f-44f9-8aab-4fb8eb6f4aea", "comment": "Malware payload (njrat)", "value": "928bc6ae4327fb5b0d4723d9cd98f0d95e7ec7d38522bfaa0a2afa5890ae3e2c5ff309ddd62db64564aef9541e016ab1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651913770, "uuid": "e128ea32-b05f-4200-805f-ac323aeb01f0", "value": "T194A3200536D28C69C9EEE6360E61F1320375DC075E22C71B69D87EA73B3B2C28A645F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651913770, "uuid": "f937576e-f9b1-4eb2-8d00-8de7a90204ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651913770, "uuid": "c8322aa2-98d4-4eae-821b-705718760594", "value": "384:ujNTgiG1CVZfursvO6yszop0n/eT3wjxrAF+rMRTyN/0L+EcoinblneHQM3epzXx:uNh5Wpszop0mzw9rM+rMRa8NuXUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651913770, "uuid": "ea31dc49-8535-4bf8-8fea-dc5824bc0cb9", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651913770, "uuid": "da3fa5b9-81a4-4ce4-8476-348ead2718aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651913770, "uuid": "4a137cc4-b3ab-4b17-9b27-49044cf6c369", "value": "74930F391391228CB3E41C67A3CEA82627BE6E42B16DF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187c46a4-cd99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651881796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881796, "uuid": "7e2fa690-8fe0-4a35-a187-6407e7bb9e41", "comment": "Malware payload (Mirai)", "value": "8961e7119642bae3a375017ae45a670e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881796, "uuid": "8b63c414-2385-4c4d-af77-9255c730b0ca", "comment": "Malware payload (Mirai)", "value": "7633d7943c4f049aff638179f8c77547b30170005d28897c74fb9171f54fa8a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881796, "uuid": "f394995c-64a1-4bdd-9550-c0fefb7cba27", "comment": "Malware payload (Mirai)", "value": "05893eb3e1ad59ee378587fb1964fd26af5c370d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881796, "uuid": "7dcb3b26-29ce-4aca-bcc1-f1ac22951517", "comment": "Malware payload (Mirai)", "value": "1992ec953c21a20ebef02b2da1ee04ea69a60f15e3838f7f7fb6647b8ca79b40abbe72cf4df42dc5f77b75ef2872d1fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881796, "uuid": "7c2e455d-266d-470c-bad7-448a23885ac5", "value": "T154733D56B8918F11C5D512BAFE2E058D331367E8E3DF72139E205F602B8A92B0E3BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881796, "uuid": "6fe624cd-f530-4717-834e-efa9664fec0c", "value": "1536:VLnQ0TnXZjk1TeTKGjwjMjJgjL5ZKgY1hjSfGOWQyMOiGyaHa4KL6Pa10:Fhwqr0INgjFcgY3jSODyaHa4KL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651881796, "uuid": "b9d5a547-6508-449c-9356-057311009c7e", "value": 76480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651881796, "uuid": "696d8c52-7dd0-4d2a-82c6-41c67d3219d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881796, "uuid": "ea42465d-ec64-4c7f-8a9c-720814c8a415", "value": "8961e7119642bae3a375017ae45a670e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e810a8-ce52-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651961512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961512, "uuid": "2cebe020-95db-4edd-9146-2e991658b141", "comment": "Malware payload (Mirai)", "value": "84e2f21c9c5b118b49304c2cc7de0b87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961512, "uuid": "5b9e179c-b13a-4a4a-b68d-f1269aefcf79", "comment": "Malware payload (Mirai)", "value": "76ff90d14b110311ed5bb66471bdf0037fbe021ac5a2641ee7da573ea86b607c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961512, "uuid": "1879d97f-593f-4dbf-88ba-97015995feb8", "comment": "Malware payload (Mirai)", "value": "996c8a8bd738ee5083cb1913acdc400bf258a8d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961512, "uuid": "642ea403-9c16-4b95-8dac-84651942118d", "comment": "Malware payload (Mirai)", "value": "7c05d7427add19127d3df005cb47d2c22b0b004b7a039cf7fd0121f431534cec3697912d09668bbe7e21b286dbaf7251", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961512, "uuid": "e1e2cd3f-f4e5-4976-88e6-73989206b2a4", "value": "T1B823F1C5242F6CB0C2F05E7AF11CB5199B0F5B38A29EF5A706444DCD5CA3A46A3DA18F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961512, "uuid": "cd1e20f7-fada-4a5b-90b1-faf2458d1e0e", "value": "768:Cc5mW4k3juBAjCGDblgKJTig+raSTtucR20hOfKsIwgrVwM3iE9q3UELlC:Cc54ejnnblgKJT0JhLOfKrwgrSM3yLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651961512, "uuid": "e6eb9306-0528-4f57-bd32-f248c460ce2c", "value": 47688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651961512, "uuid": "44e9c5a8-be47-4fb9-949c-e4da76cdf9e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961512, "uuid": "a3b500c9-6e24-449d-95bb-1bd540b0bdbd", "value": "84e2f21c9c5b118b49304c2cc7de0b87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0f19cb-cddf-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1651911978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651911978, "uuid": "8a761939-382e-4ab8-97c2-aedf8d7c5ac3", "comment": "Malware payload (njrat)", "value": "4f58ce5f6e6170fb8a1c1bac1fa13077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651911978, "uuid": "b48fe172-f8e2-477e-a3f3-b4c3e8485dd0", "comment": "Malware payload (njrat)", "value": "772c3540b507f8f87722cff2a0ab46d59c2bd72b0949e5bdec6660f5f283303b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651911978, "uuid": "3025f623-03de-4941-b478-401fa796b6b4", "comment": "Malware payload (njrat)", "value": "ecb181be8e79a50df0450897138da44172992461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651911978, "uuid": "816d10f1-6efc-4b21-9db2-71bd1c8d3c0a", "comment": "Malware payload (njrat)", "value": "5dc43d9db0e0c6404b3d763abeeea73e06016ecf4bc7c64f98508e99d2e743939919a146393c0c8c642bbcf6edcc202e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651911978, "uuid": "51b896da-9412-4b71-8f6e-d6a8c9bf2e45", "value": "T1E2032A4D7FE18168C4FD557B05B2E01207BAE10F6E23D91E8EE164AA37636C48F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651911978, "uuid": "635ce653-ca0b-428f-8211-b2ffbf89fb90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651911978, "uuid": "bd818bb6-fe63-4105-93a2-760a16edde1f", "value": "384:8euvBkiyPnDNGRn5IyUvuIHffhq/iMIWcrAF+rMRTyN/0L+EcoinblneHQM3epzJ:huy5M5jUvTHYqMpcrM+rMRa8Nuy/Ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651911978, "uuid": "e2965679-93bf-4f3b-a7b4-e41899e38c50", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651911978, "uuid": "68630728-ac7b-4a97-9641-d644b819c7f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651911978, "uuid": "f1224ff0-9115-41fd-9336-f429a56241dc", "value": "772C3540B507F8F87722CFF2A0AB46D59C2BD72B0949E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad29eac5-cdb1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651892353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892353, "uuid": "ebf83a03-12e7-4d4c-b2f0-b1fe151f7df0", "comment": "Malware payload (Mirai)", "value": "4977c2848c31835003d760641e45e9fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892353, "uuid": "6fd3dce6-16c7-44d9-8dfe-14d1e75c5eff", "comment": "Malware payload (Mirai)", "value": "77cc52f76eee8a8eb1c885c9e28bdc39b4709722488d757b0f2cdbf6d94dfe40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892353, "uuid": "6158a91e-9e68-44e9-8267-da5042e6dd89", "comment": "Malware payload (Mirai)", "value": "f72ba03adddb792811a41f12f0b449a546d239b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892353, "uuid": "0695aed4-7962-4046-96dd-6fed5c953383", "comment": "Malware payload (Mirai)", "value": "50324aee5086df345ce3facd33e5c0011ac229ee282fe9caa693dc9f6f32b5d2fe2dfc67987bb56d6fda95db87492ad5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892353, "uuid": "da7b6408-10ed-4a0d-970f-34a7ff0808c0", "value": "T1D2431845BC919A26C6D023BAFE7F519D3311A3E8C2DF7227CD241B1076CA51F1E63A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892353, "uuid": "801c3ac7-ad14-47f4-ab00-696fa2addb51", "value": "1536:K5OXHVdJbntRB8V8QXDo3YwQ+FY5Przrtg:mOXHVqzoaUYZHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651892353, "uuid": "09e25455-a2ee-4f9a-9abd-07ab8d944f22", "value": 56112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651892353, "uuid": "9b2ecd30-0c9f-42e1-bd91-2053f3b796b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892353, "uuid": "420bada7-1624-4597-be1c-5b8223afad37", "value": "4977c2848c31835003d760641e45e9fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2977b31-ce01-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651926722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926722, "uuid": "923ac77b-cb7c-4f04-baa6-3c487dabe031", "comment": "Malware payload (Mirai)", "value": "b834a1233d410dd9988ba16f316911c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926722, "uuid": "45533a62-ab76-4f1f-8d52-cf7d2ad6245a", "comment": "Malware payload (Mirai)", "value": "7879d680735c3e1dbc2232f797b6f788a76500a7a57b20f61c3c5e68b0d0b2fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926722, "uuid": "d49f3767-0a5d-4d8b-8ef2-bb710971dcd8", "comment": "Malware payload (Mirai)", "value": "1fe5016fe9f1aa954a240c8363450b8c270f4581", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926722, "uuid": "eaf6154d-15b1-44bb-9737-f017cac4ca9f", "comment": "Malware payload (Mirai)", "value": "29ea547c571d4ff054222ca57df4e89d56ab7e8c8523c20ef020b262b7c8853c090432c625fe282b21c22cb93182ef3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926722, "uuid": "5c086a7d-acd8-42cc-9825-e956481dbab1", "value": "T1B9E2D0DEF944E969CC7A8DBAE2DD13B0512822D1B2CBFF2843305D88651D51A3BC9938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926722, "uuid": "ae14b222-005f-42cf-bdb4-735ad0cefc4e", "value": "768:HAutwhoROkxI94wKl/Qr2KwhIcHH5TO1FFcXk4l8e7XuQWQN:HAun/xIY9q2Z6EHtOmXk46e7XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651926722, "uuid": "03b3cc28-8e23-4ec2-a5c9-3f45e1d20398", "value": 31672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651926722, "uuid": "98b985bc-8502-489d-ac2b-157348eb004e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926722, "uuid": "5a02cc91-de0d-46f3-8f5a-c3e773115bdc", "value": "b834a1233d410dd9988ba16f316911c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db7ffdf-ce28-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651943250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943250, "uuid": "6d8394d7-8bc2-42b8-844c-ad1e2e983f56", "comment": "Malware payload", "value": "554f6623ccd3428a1d49d1e539f98f0b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943250, "uuid": "362c6f0d-4d08-47ca-8d6c-e747caca669b", "comment": "Malware payload", "value": "7901eafc0a51652d2155476d18832bffab53ae988cf8b2d2d4dbce77bd5f2afb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943250, "uuid": "a3fe6df0-521d-41f5-9c27-331ae377ff8c", "comment": "Malware payload", "value": "0ea3bfee42b83eccf02b771e3420386ffd3481e5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943250, "uuid": "83704e24-891b-4caa-ac00-2cfaf2d2c70b", "comment": "Malware payload", "value": "43527c83f3dc6c1b56bf17d91eaf31cc56e74a2ea20b0acd453df6990e8e49a1d42ba361b15dbc5c7288305b3f0ab3da", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943250, "uuid": "0cbeb461-c4d5-4987-bfd7-83074d1b848f", "value": "T182D2E0BAFFD29034D4CA857DC48504133BEEAA10F37BE4EB25A541817ABC12406E8E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943250, "uuid": "b898f66b-6a99-4661-9c4d-9b5fb0c053f3", "value": "768:iQtp7IbOPAOCcw0Fcrdl14q8fEKa1AAxj8otLXD:TtpUbOPrCEFcrdP0EKa2AZ8o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651943250, "uuid": "6b22b70c-7844-4bd4-b6bf-786b33771f77", "value": 29028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651943250, "uuid": "875e498a-a1fe-43d0-abe1-50d160b50d74", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943250, "uuid": "a5929285-f956-473b-b3d2-4f2eaa3ad496", "value": "Rat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b820b23-cd99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651881828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881828, "uuid": "554bbefa-c5f8-4866-9e5e-25ebe72817e0", "comment": "Malware payload (Mirai)", "value": "39252504a88f69f03b5c50a2dc3ba19f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881828, "uuid": "d0c854b4-9c1d-4e95-8159-3fe89b921d8e", "comment": "Malware payload (Mirai)", "value": "7aee76eaeb996325789c89f382a989b29dd7c130c8fdb01650cf52cd659bf779", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881828, "uuid": "88558b3e-852c-4120-a060-e45b0bb71e84", "comment": "Malware payload (Mirai)", "value": "e3c90ab133a1d787cb16b4500d33c946c83e76ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881828, "uuid": "03ac3ef0-4a89-465e-9644-102f98235cc5", "comment": "Malware payload (Mirai)", "value": "f12ab5050e6efb502acc298c58cac466aa6b60cbe19f735eeb68769739042011ada1ae472438dddc0485a58f29ba8fea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881828, "uuid": "2cacdc17-6f88-4849-8003-e46002117fd4", "value": "T1C8634BD5F801AE3DF84EE176852A0D09BD3163C04A931F27A7B7FDA76CB20987906D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881828, "uuid": "62259b87-13e3-4313-8360-13fd1cab502f", "value": "768:oe6n68/zYX0Szec7/mKuc+4vtILucv5O5S1xg9HHbKYT8NmGKYDKoQLD7vT:oRkz7/KdCtIScv5Bxg9nbKe8ZKzLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651881828, "uuid": "db1e584b-b867-41dc-9658-7de6a05817a7", "value": 68980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651881828, "uuid": "80898764-abb3-474f-aad0-800e9c90ba5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881828, "uuid": "c4385a3e-5696-4938-b241-9df90d24bd07", "value": "39252504a88f69f03b5c50a2dc3ba19f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f06077-cdb4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651893412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893412, "uuid": "ee9c5061-127c-4455-985c-ff74f464e86e", "comment": "Malware payload", "value": "12ee7479ef95d0e0730e1dd564667e0c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893412, "uuid": "9ccd8e8f-fd53-4b07-af98-9e4ef11fb594", "comment": "Malware payload", "value": "7ca5d947735b205f60f5dfa3bc40e1d007237723cd1d9651c49301f6a13d46bf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893412, "uuid": "de8f415e-69cb-4dbe-b625-912fe37001e8", "comment": "Malware payload", "value": "6cb19b85c1203f50ff8896dc10a5f894158028fb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893412, "uuid": "18bf9816-3568-4f32-9319-04b5616157b8", "comment": "Malware payload", "value": "aee9b2f7885655a274d8f2dc4c94ff95137d0e8227c7b4f5022b4cc498b0b6846acc8036a77226086aa90aba104544cf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893412, "uuid": "53782060-e3d4-4905-9032-d448b1e5c221", "value": "T138C3F1952AE8CC1BD2B46D7C6B09202FD0A047EDCA9974E79CCD439765EF2213A85F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893412, "uuid": "29335495-8dbd-46c8-84d8-b0d7d8cf7ad5", "value": "1536:xqKgrLSRmolmwCL+kmolmwCL+kmolmwCL+JmolmwCL+A:sKgrG8o8b4o8bqo8bPo8bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651893412, "uuid": "c434db46-172e-463d-9d19-88b76b75431c", "value": 129563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651893412, "uuid": "4152efc7-5aeb-404e-b757-36210c027368", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893412, "uuid": "04c696c5-8287-47ab-87b8-45dfd023d79a", "value": "Rat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e522cd-cdd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651905567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905567, "uuid": "8a287ba2-7199-4954-b3c7-1ff1f90d2330", "comment": "Malware payload (AgentTesla)", "value": "38a63549c9f1f562c36bdd813063c860", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905567, "uuid": "7a584044-da48-4ec0-81ab-2374aceb4243", "comment": "Malware payload (AgentTesla)", "value": "7ce46e4271cea437f0bd55ce85034d0eee86819a4b463751798e58b416a3f196", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905567, "uuid": "4dcf10b4-3b14-46ce-990e-db2c5b061dc3", "comment": "Malware payload (AgentTesla)", "value": "a77909aa3e4de35458ce1af172e76be8849917f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905567, "uuid": "0c90e8a3-2424-473e-a265-2ab6c6dedaa9", "comment": "Malware payload (AgentTesla)", "value": "0849d2efd75f594b6d11d3ddfa2333064d9530cb4d48041d8de6fe297225aa6f520ff139debe0fbac17d0347a8e64878", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905567, "uuid": "887cae82-ab5f-490c-a8ce-82081c4e3da2", "value": "T1329423D2EB51575D621B5FB0AE04B5530789097D1AB33D923B8CAF5B30D91CCBB63A20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905567, "uuid": "591bfb75-68e8-48af-8ca5-c9c373e13302", "value": "12288:GWggPCEWgf2vyybfuj2oNZ4VlYIwJkt2eoVgLl:GWZPqyy7uamyLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651905567, "uuid": "91c8cdf0-44e0-4c3a-ac04-49fdea21eee2", "value": 431806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651905567, "uuid": "2be681dc-7e1c-4947-af15-36533abda28d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905567, "uuid": "28544216-3b39-421a-adb3-904539152ebc", "value": "Sales Contract.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7e0bb7-cdb5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651893829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893829, "uuid": "bef9a623-1264-470b-8267-8d2e72975787", "comment": "Malware payload", "value": "2aada524028ee165dc8364db956e69f0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893829, "uuid": "1bdacc52-7909-4f59-8083-7c7bf928e589", "comment": "Malware payload", "value": "82aef7e3d3ea24467454da66c042287c9ab7cc87f9cc80628afc9d3679e219ac", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893829, "uuid": "5ee1a3a0-f390-4a58-a32b-68d9d8550d52", "comment": "Malware payload", "value": "bcaa16659477540ab52ef9f82f2ec3d6a956031d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893829, "uuid": "457eec62-fd79-48ce-891a-2cea47a6ea79", "comment": "Malware payload", "value": "130b9e6d74f7cbf5b6857b2e1553af4b2570100a166d993e211d8f61f3be5b2aa4c360d2296f6f5715c37a7cb6146916", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893829, "uuid": "6942e898-1fcb-4bff-8963-80f2f9dd6baa", "value": "T1B103E123D7F7C89CDCF3AB7E535E1191AC55B0E56A20F2634321854AA6FAB60829DC07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893829, "uuid": "0820c5ed-d59c-4296-979d-503f6eed317d", "value": "768:gi8l02on1QrcqE6X81TiCj30LqD+BPZ1iE+HpFe15Rg6xdQS0ksOXZBBO:gHG2on1IREe3M30L2kLiE+nejRg8N0k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651893829, "uuid": "d7e7b49f-1f94-4bfa-9960-2e14cb5b487b", "value": 38411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651893829, "uuid": "0b8a6d44-abb7-4f16-89d0-42bfe6d4dacb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893829, "uuid": "6cdd7966-7815-47af-94ca-d46f62e93ca1", "value": "Rat (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b344e4c3-cdb1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651892364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892364, "uuid": "80fd01c0-f29f-4b8d-9adb-9e5a28ae8ee5", "comment": "Malware payload (Mirai)", "value": "720697f808d9492808a60d34bb653d47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892364, "uuid": "f0bff0b8-0608-4a43-9e2c-c57096e03aa5", "comment": "Malware payload (Mirai)", "value": "830046316d87e7a1034df3ed6dffd61c605db260e1582c50d687d83a00bc485e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892364, "uuid": "0ba151f9-23af-44cb-86fd-17fe481c0e10", "comment": "Malware payload (Mirai)", "value": "4c1cd007f4a207f1e79df70bf28a2e1316a559da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892364, "uuid": "a7152737-02c8-4fe1-acf9-09659ad61312", "comment": "Malware payload (Mirai)", "value": "e189658703d91be957b2145d0405e0c30b63eb3e3a6dee3952cc45f830829672fe85d6a4b57dd1e907b3e1fe020f05d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892364, "uuid": "798db407-a200-4bec-a8ad-e5e8753ffb8b", "value": "T108439E72C4195DC4C14842B8B824CEBD5B13E5019AB32EF15B8ACE66604BEFCF6593F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892364, "uuid": "cc368fc3-e950-4f30-9a75-dfb25eec759e", "value": "1536:S/pM8b36tUaVXDDBtZVSI251Nz0FahC4gCdyg:SBJ3RCXDDXo0FahC4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651892364, "uuid": "862885c0-0fd3-49d3-8887-55aa28606838", "value": 59428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651892364, "uuid": "d4056849-5d3b-48f5-9009-6ee47e6486f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892364, "uuid": "4dbaf839-5e55-4dd0-b1c2-2fcf871fb38c", "value": "720697f808d9492808a60d34bb653d47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf96580c-cdc2-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651899713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651899713, "uuid": "7399242d-cc20-4195-a65c-a3671719e806", "comment": "Malware payload (RedLineStealer)", "value": "e9b30d973f77b798299b55d2f2e8cdc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651899713, "uuid": "6ced4997-901b-4811-9a4d-ee1aad95a50e", "comment": "Malware payload (RedLineStealer)", "value": "84942aee42fa19c00303d63b8720e4c1f198d34802a17be38f393094f448da04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651899713, "uuid": "cb413f50-135a-4192-abbc-020418c6b1c0", "comment": "Malware payload (RedLineStealer)", "value": "e90735ca5ec1de6cce4d62f8f6459a31929cc2c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651899713, "uuid": "3b4f7a47-9c5c-4165-a612-f7e58a80e47d", "comment": "Malware payload (RedLineStealer)", "value": "3ca94bb559db06d4a6404658926288e901a4b1ca829fd66f497e95fa52dcd461f8cb548a66c3d6f43473e18af949192b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651899713, "uuid": "f2df46f6-3e62-43ec-b785-84924762c45a", "value": "T1AC447CB5EB9CD4A6CA8403789480461C31B1AF166A9BC7E274393DF52A733D2DC1ED4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651899713, "uuid": "c50a2d4c-f3f0-4ff0-bc06-9152c95123fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651899713, "uuid": "b0cab6bf-543f-4f86-91a2-01d5c432b463", "value": "3072:GYPL8gOucS1P0NsvCc/fqfGzOErP+2dOzCBWkztQbVkgyupqB3Ar5g8Y:PjOuV0aCEr7/BWetQbVFyupqmy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651899713, "uuid": "74a141ae-d4db-45bc-a771-8cf4bd4f9e29", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651899713, "uuid": "719115f2-dceb-44c4-a359-a9c2359105cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651899713, "uuid": "b5dddf12-56e6-4c10-bfeb-80b264c407f2", "value": "1.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9203f5-ce51-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651960804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960804, "uuid": "002bc022-360d-4cb5-b7cb-d6466cd3ad9c", "comment": "Malware payload (Mirai)", "value": "7a3124eae1d4a3487b6ce402cd3004bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960804, "uuid": "f1ab24c1-280b-481f-ab33-dad16eaab4d1", "comment": "Malware payload (Mirai)", "value": "84d66c411e01e733fe5d71c79f5abbfcfc4259cc8927326747654f9415d7ff9d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960804, "uuid": "e5ffc9dd-3d8f-4bbd-a974-2fc85826860f", "comment": "Malware payload (Mirai)", "value": "a212f25c2ee68c489d9349a117a26b0e83bddb60", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960804, "uuid": "a371f7f0-cd80-4a45-ba6f-3a7d6f0b99bc", "comment": "Malware payload (Mirai)", "value": "9c807f58b49162cc8ef220ddc43774051eaf12190badff3807792db0cf20def463fb1faba0f6bd372616d9fb7325f60d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960804, "uuid": "54f7df82-6f6d-4849-8322-6fc7d063d6c2", "value": "T16F732AC5B841A612C7C25673FF5F428D372A4398E2F933039D295F617B8B95B0E3A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960804, "uuid": "f25cf3f1-841f-4b82-9344-379f2c732d09", "value": "1536:nneAVH6Qooulym9zIXX5aSEK49mm9pe65cBOzVatO2OLbpvK:nne6/i+Xo8m9pv5fa3ORK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651960804, "uuid": "2bdd83c4-ad49-450d-bb59-c2834dfe3e65", "value": 79712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651960804, "uuid": "f753ba9d-5c5b-4ff1-a0e1-304423107c66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960804, "uuid": "55619a68-442c-4b3f-bc05-24038334b39c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709a51fd-ce19-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651936920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651936920, "uuid": "d953142c-6430-4230-a72b-e3624c838c8d", "comment": "Malware payload (AgentTesla)", "value": "b40cb59543c9b9adf52b265661a49b60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651936920, "uuid": "23714e23-5b48-4862-8863-5ac3f9d3a532", "comment": "Malware payload (AgentTesla)", "value": "880404dd947eaf1783893981eeae53aef821255d4f1e29ce734f16baa5b48730", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651936920, "uuid": "8325008d-94b2-44fd-8da0-121ed8c6de14", "comment": "Malware payload (AgentTesla)", "value": "5a3d8a3db7f961a724a69e5f07f74da507ed46ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651936920, "uuid": "9ef03ebe-bf8d-4fa4-a240-d241fc728b5f", "comment": "Malware payload (AgentTesla)", "value": "b9f62b9c4313879d3be6b0eacc1ee3e4739ac9551b7f8e48ba011acd898dfaf64a2db20e62cbe623ccfe385d5fc3c8c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651936920, "uuid": "6d441703-6389-442b-8461-909ed0981ffe", "value": "T12C05CF58311C7A9EC827C9718A969C74979328AF671B5133859378BFB90CB87CF130B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651936920, "uuid": "007ede1a-3a99-4587-8fcc-6f49cc33e505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651936920, "uuid": "59d3976d-de13-431a-af3d-5c7491f5449b", "value": "12288:gL7TVb2Bb8EIWvQItTf891/7mGwxE8wTqXsgRzaRctmEzV7hSBLn4EG2guQu:g3pKaKQWfE1/6qfNAaRvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651936920, "uuid": "2b4487b1-9adf-477e-834c-f2fe86974f0a", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651936920, "uuid": "9670fef7-ce7f-4ac5-ab0d-0baf2c09012a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651936920, "uuid": "478b5d40-5f06-4367-b26f-9916b09513db", "value": "alv3rArh0Ki5nhI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60572086-ce1d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651938610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938610, "uuid": "2c3dfc45-e87d-4399-b3cc-a9454cc84ec4", "comment": "Malware payload", "value": "5a0e758d19b4b410a8557347925f64c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938610, "uuid": "230194eb-1540-448e-a13d-b54cec020a95", "comment": "Malware payload", "value": "889370dedb6d78f4b6cd5dd190e0dd7f0a4abf429baa22fbc078e30ec9632679", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938610, "uuid": "9c4e652b-684b-46c6-96de-3f237416f7e6", "comment": "Malware payload", "value": "507e1741cdbf2cdd566264a338ed236898da37de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938610, "uuid": "be7dd153-dfbe-44cb-bef1-da4778967ff0", "comment": "Malware payload", "value": "ce696f87902493a3e2c14e885ca43d0239572f954ea014b02ba9ca85d3806753f15d635806aed355e1b319f19103717f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938610, "uuid": "afa702ce-c057-412a-b3db-d5a455fad0e1", "value": "T12A03F17C952D78C9CC2D8D79C2A992B6A541A4D9B41FCFCF8B41B964A692D0F3F14034", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938610, "uuid": "85b0d4ad-d22d-4c9b-8a72-7799e7caf641", "value": "768:MiJBclYzh+pkaipsdUtb9TQfdDUmuYbfqHVum40XX9HN40rYWRY:Ms2WdUi+Kvc1RBbfq1uZ0HD4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651938610, "uuid": "fc75563a-cefb-42c1-bb82-35d545961ac8", "value": 39620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651938610, "uuid": "1cd89727-02ce-4f2a-8c29-8c758dd5ff73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938610, "uuid": "a010fc6a-fa8f-418e-bc0f-304cdd2c4287", "value": "5a0e758d19b4b410a8557347925f64c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15bfa5fc-ce5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651966832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966832, "uuid": "8a62e018-cf47-4f6a-b712-a97b45d1a19c", "comment": "Malware payload (RedLineStealer)", "value": "f70936a7d936e54b21b211759ea064dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966832, "uuid": "4beba770-40cd-42e0-ae24-0aa12037474c", "comment": "Malware payload (RedLineStealer)", "value": "88a8b456d499c656577189e9a9f348f15c1469ee459c05dcf2b383bad44b89c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966832, "uuid": "2c70ee6a-db1c-497b-8ab4-b044db097066", "comment": "Malware payload (RedLineStealer)", "value": "f4f6185707f70ea614f2bfaac4dc2f3f8178ef90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966832, "uuid": "57621381-2235-4f39-8ee3-2008bd7babd7", "comment": "Malware payload (RedLineStealer)", "value": "52040b81f8e9c2aefe0a44e28423db796f549d242d445e50fd865d3ec7bf5604650f001f8d5122f4b7e5f217aed16b15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966832, "uuid": "8df1f256-e1f6-4b26-95ac-4a2a2c1a45ca", "value": "T1C184CF10BBA0D035F1B712F449798769B63DBEB19B2154CB62D53AEE62346E4EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966832, "uuid": "85dcd580-a83c-40da-a92d-4c96e33cd2fd", "value": "c2f34b03efba3580b2f36c10f3cf4dcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966832, "uuid": "6a7e36d4-8d7f-4c42-ac4a-5644738e204c", "value": "6144:nGUds+HbQgYTM/HgiWeVXizG3O29oRWk5azHokNw1cydX8UAUO/aEC4GAtHf1Uoo:GCRb/qM/HgivX19BkIzIkS1h+UOyEC45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651966832, "uuid": "a10a7ea7-6483-4eac-ac0f-d5ce912f7334", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651966832, "uuid": "27724acb-c248-4a6d-92b1-f0613682428a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966832, "uuid": "d18e7ac5-f275-426a-8a7e-41a2ca6818fc", "value": "f70936a7d936e54b21b211759ea064dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231d0f62-ce60-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651967284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967284, "uuid": "236a0429-3b8e-4797-8144-1b5206e270e1", "comment": "Malware payload", "value": "d9cad0c5aa4d9f01c8b031073e1000f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967284, "uuid": "523bb2f5-7eec-47df-9f98-3633c9098ee0", "comment": "Malware payload", "value": "89bd722b481dcfe487a56e7bd3d9867a6571720eee9ef47d82cf46274fe8867d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967284, "uuid": "5ede69cf-6543-4af0-9a87-9712f05f90d1", "comment": "Malware payload", "value": "5d75a5dacf693aa05bd5c8eb67ce40e9d08732de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651967284, "uuid": "d6e1964f-da8d-4d61-a2ce-a6f2a8874e5d", "comment": "Malware payload", "value": "f5ca7939175adf7eabab4a31afa8db7b3a4180deb2da4f8e2aac506de0eb8b5116ada47e81a7770ed14f2b0d0e44d971", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651967284, "uuid": "4ee5267b-6668-47a5-9cab-05fe1d5b838a", "value": "T1CA53BF3789E71F1FE346C39EB5DB440DD68553BF522620EA9084BA3A4F7A60CB11607E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651967284, "uuid": "8d0bb0bd-89f5-4e6c-9587-d5229acc3093", "value": "1536:aGJUSW/zf2RU9XQif+/yAWC0MDWqPKq5Vm0OHXNdl3aLuH21eoi2dBQpvT0AfkrY:a2Ud8tQPRETDh6LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651967284, "uuid": "7b31cfcc-28e5-43d3-852f-3dbde236df80", "value": 65944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651967284, "uuid": "a2fc6523-2e49-4d9f-b907-49c8a7c028ce", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651967284, "uuid": "9ebc337c-21c9-453c-94b9-af87d6601c54", "value": "kekpop.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1791a7b-ce4a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651958154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958154, "uuid": "7e852b2e-7a78-42d8-9585-631bfd5cf713", "comment": "Malware payload (RedLineStealer)", "value": "67a047f8874a44de31b0dd8cd22d7af0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958154, "uuid": "5a885581-c703-448d-9d1d-d7206c212733", "comment": "Malware payload (RedLineStealer)", "value": "8b6808765ac89ab9c790d28399049ea162c15b761328e71b671596b3a8bc6ea5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958154, "uuid": "36b4aabc-ac5c-4f8e-95db-190d7943eb9f", "comment": "Malware payload (RedLineStealer)", "value": "4a570933842d0db3b40cb7414925e2c506e61d0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651958154, "uuid": "eb5d1600-ae07-4597-91e4-c609bfba905f", "comment": "Malware payload (RedLineStealer)", "value": "788b1829d7246745c48518993289c7acf78fcb60948643d853bf9dc8884f8e60e5251bfe8058108954a8fe5b0b47e527", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958154, "uuid": "00de2224-c259-4ebf-996f-70f468e5ff33", "value": "T18884CF10BA60E035F1F726F4497AC778B93D7EA19B2451CB62D52AEE56346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958154, "uuid": "c88c1c2f-ceb1-4596-95d0-c428e0fa211d", "value": "c2f34b03efba3580b2f36c10f3cf4dcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958154, "uuid": "35852240-fdcb-4be9-8471-186868241d3f", "value": "6144:xyFds+HbQgYTM/HgiWeVXizKgnM86XWSizR+tm/qJzjeKZOo1kezbbo:ovRb/qM/HgivXKM86GSmRbqJ3egee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651958154, "uuid": "4676c473-dc53-436c-b92f-7e510cfe9a5e", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651958154, "uuid": "af1f1283-f999-46d8-b565-0cf63b99a57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651958154, "uuid": "219375ab-ebb7-4308-8e95-8fc25b91db26", "value": "67a047f8874a44de31b0dd8cd22d7af0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f282de4-cde6-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651915066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651915066, "uuid": "1121bacd-7eb2-42ff-8d1c-4ed48ab6d01c", "comment": "Malware payload (RedLineStealer)", "value": "fefec50052df3ed28ca48e6e50ec3bd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651915066, "uuid": "102aa687-96c8-4147-9888-d9a451a34b34", "comment": "Malware payload (RedLineStealer)", "value": "8cd6ebfc99ddd0714fa72780b0f3eb6780ffb06f9e49f4f9e5c1f5ecc9123799", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651915066, "uuid": "8331ce14-93ef-4742-ae73-847f88c8c396", "comment": "Malware payload (RedLineStealer)", "value": "49533938fa75da2d240049d6925e6b266927953e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651915066, "uuid": "537edcb3-c3d7-472b-b7ea-5d2c353f9941", "comment": "Malware payload (RedLineStealer)", "value": "f56cb0b905e57d6afd7f4f7a7b5ae3ce82ee6920937f2ee0789b682c19b9d3d4a1a0d5a4dc0fd237eabc157508e117f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651915066, "uuid": "8fc66aa5-6d4c-4677-8a64-928bfedeb6c3", "value": "T10384BF04BB90D035F0BB16F5497983A8B93E7EE19B2441CBA2D52AEE57346E4EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651915066, "uuid": "e283b76a-3610-464c-8b5d-993ef8f09eff", "value": "a14107a392764307cdf95bf281e41cf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651915066, "uuid": "0d0705c4-7711-4738-bca9-ba2b33c1540a", "value": "6144:DkZXha02w5GBwowHSpo0hb+6YndVMrRlMW3rqnmYCjBuTglC5ne:D6x32CqwoASpT3GGrPMRmYflM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651915066, "uuid": "e9241064-8401-4e5c-a62e-7ead233ea6b4", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651915066, "uuid": "6ee73921-d966-42e0-92d3-395a9d313998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651915066, "uuid": "a1870360-c10b-4984-ab9b-921ecafda3ae", "value": "fefec50052df3ed28ca48e6e50ec3bd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a260c9d0-ce23-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651941298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941298, "uuid": "6ce945a9-a379-46a6-adee-bd025a8fa196", "comment": "Malware payload", "value": "ae153ce68beb821055ff495ea6ba8463", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "ReversedPE", "colour": "#BE5E13", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941298, "uuid": "4b92f3fb-3910-4bcd-a9fb-5580a28ce271", "comment": "Malware payload", "value": "8ea53b7c62d81d0d7619d4ef58bfc4e18c7f11bc5a39fdc4316e5779b04c8cbd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "ReversedPE", "colour": "#BE5E13", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941298, "uuid": "e5ce28a7-22c0-4e69-8243-78fbe1aaa906", "comment": "Malware payload", "value": "ae2a7532ab2311c9661d21a15691af1d1beb24c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "ReversedPE", "colour": "#BE5E13", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941298, "uuid": "8fc17acf-1057-43da-9de7-00d9681dd4db", "comment": "Malware payload", "value": "37c8a533f7856527aa3f9df8d78e4b709bd22e56558828a9caeb66372a012c578b0b656491798af43bdbfb4f81a45bfd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "ReversedPE", "colour": "#BE5E13", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941298, "uuid": "274554ae-2359-4d09-8f52-7d4fbe3da59e", "value": "T1AB15223C5B9D5F56E79A0E32C0E1290007BEF40B6B87E31F605568F9ABD93E71982603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941298, "uuid": "eccda506-503c-4177-b276-3fce7a513d52", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941298, "uuid": "92c26987-406c-4aaa-825c-d8218cb66384", "value": "24576:/0RG/ZSaE7hgPa/0gLKcyQSrxNciMaauKptGrU3Ld:OmnE7Ca1LnyQSr7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651941298, "uuid": "d69d4cd5-be28-453d-ab7c-81046b253bd7", "value": 958975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651941298, "uuid": "918e8e14-8cdc-4271-ac89-840ef00febb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941298, "uuid": "39163d3c-2f33-435a-9588-783a86bf5937", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba0e953-ce01-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651926711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926711, "uuid": "fe17e740-bddc-4e6e-a6ed-2bd18d8c62d2", "comment": "Malware payload (Mirai)", "value": "cc1b212645c84b5dfe1d67cbcb74688e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926711, "uuid": "f7188542-204d-4527-850a-03000c7ac19c", "comment": "Malware payload (Mirai)", "value": "90a8c37282b7e7c4e0cdc61aafd25cf3aad23be0d347a8f48977f0115f154679", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926711, "uuid": "65c2b253-9b57-4a2e-8c42-badabfe54a4c", "comment": "Malware payload (Mirai)", "value": "b583ed92f95a11e93742b08a0b28fbdcce003672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926711, "uuid": "aa235463-9ee8-40f8-83cb-24fc32507ab9", "comment": "Malware payload (Mirai)", "value": "27cbcc77dd4d18f0b719896d51cd63ba29877d9b43d5645f3c4a2d68bc6730037e639fe1ff5dab3c29a2412de22dc0d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926711, "uuid": "757446ee-c621-41fc-b401-8ae07bab6448", "value": "T19053AFB2D4959EC0C609437960708EBD5723E9467A1B1EF09E4989AE400FEDCF25E3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926711, "uuid": "a5680f3e-784e-403f-888f-51d4fa23deda", "value": "1536:8B/qbw5djaesqtb43pwYr93CqWYjsKN7Co2wx:qy0NVtb4pxCYQKN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651926711, "uuid": "1d74d129-3765-4e7a-b21a-365a91329732", "value": 66596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651926711, "uuid": "08608486-6bbe-4010-9dfa-47a5fd8c568e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926711, "uuid": "100ea875-5ac2-4609-a824-997e8a729304", "value": "cc1b212645c84b5dfe1d67cbcb74688e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b06fbbd-cde0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651912402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912402, "uuid": "f0d945a0-ef26-4a9e-88d8-266844484a1e", "comment": "Malware payload", "value": "8994cecc2a46d4ae9a2f5eb6bfd179d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912402, "uuid": "e1939e2f-6e50-4424-8ec4-0780a50c3021", "comment": "Malware payload", "value": "917126ab8efb7f351d33acd15fe3ad3490da346be038b8fc2673b58ae0de1ff8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912402, "uuid": "20f9c1bf-451b-4548-ac03-6afa6f1b7f27", "comment": "Malware payload", "value": "0f61b89ac1d9a4cf662646c4055867c4adfb9797", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912402, "uuid": "c2d68579-69fd-47db-afe5-19f13208005e", "comment": "Malware payload", "value": "4a0a59a26343edeb1f47d158968af605e2a5dffbed5c8d12e279752e6dc3f901820f8a254898f67a0c856ddf4a5ff946", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912402, "uuid": "402fd7ba-1edb-48b0-bc50-d6657c4c3d6a", "value": "T16932B642B31D0867C5273FF0363F2BD0E75AAF652294E2C4726F9A8AD176D301191DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912402, "uuid": "a17f0eba-502f-49ea-838a-d41b5b399c91", "value": "192:8YJXHMV+sRDH4cDfOFsmd2IDE/BtJT4T0bdZEpSxEn9H1cThWUhK:8YdHLslhaCmYLT4gbdZKk2gwcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651912402, "uuid": "477efa03-bd49-4053-9c0f-4838cb4f313b", "value": 11812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651912402, "uuid": "8b92f92d-6adb-4f49-af3f-6f36fc329796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912402, "uuid": "433bd426-9568-4cf2-8419-99d0700c595b", "value": "8994cecc2a46d4ae9a2f5eb6bfd179d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6a9a9c-cdd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651905502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905502, "uuid": "2b1f357c-919c-4f3d-94a5-c4cdcc4b8a1c", "comment": "Malware payload (AgentTesla)", "value": "f0bc6993acaff43c22f828c16773159f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905502, "uuid": "68e609c2-6e5d-42ca-bda3-901b3585c79a", "comment": "Malware payload (AgentTesla)", "value": "9272ff8a1c398e113f88698712f1ec5f2d3a3792d3b211695722b461ab1a5846", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905502, "uuid": "b26dce6c-5675-46cc-81aa-578fa87cdeca", "comment": "Malware payload (AgentTesla)", "value": "b6eef6233c005d9f56ab1ea0ebddeb5f65935aca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905502, "uuid": "81f6f64d-78e3-405f-8a21-a8c4da7bf9f4", "comment": "Malware payload (AgentTesla)", "value": "f80f24f345c566e52b8e06290bfdf97e6d2ae15051257da82e0aa64d2904770d036ff80dc79b76e444e7f91851d54d52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905502, "uuid": "e2bfda7d-f3d7-4b97-a02c-bc3b8aa2ebb5", "value": "T12B9423D2EB51579D621B5FB0AE04B5530789097D1AB33D923B8CAF5B30D91CCBB63A20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905502, "uuid": "706e7843-2168-4f3f-b852-3466e35f8400", "value": "12288:yWggPCEWgf2vyybfuj2oNZ4VlYIwJkt2eoVgLx:yWZPqyy7uamyLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651905502, "uuid": "88f0d9ad-8111-49c8-b291-b24612491bc7", "value": 431806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651905502, "uuid": "fbf9913a-d22b-4192-9fbe-1b6d0e98b06a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905502, "uuid": "fc5507ef-82ff-4a41-af12-9f84d902f34d", "value": "VEL-P01225013B.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58498f1-cdca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651903105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903105, "uuid": "3a989f40-025d-4f47-925e-595e6fa7b1f9", "comment": "Malware payload (Formbook)", "value": "c3e4e63e8251b63be8a119e6b154edcd", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903105, "uuid": "0d561e87-e15e-43b2-883a-2f0288102ac6", "comment": "Malware payload (Formbook)", "value": "92fe39066bc823dbf07eea2193397d71a739ac15e6ce337dce29170d022e2965", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903105, "uuid": "a8af9961-3fcb-4346-bece-271911ab6057", "comment": "Malware payload (Formbook)", "value": "f20773ea616b702bdfbccd3f46ab4214a28811a7", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903105, "uuid": "eae5df7f-d1db-4d4d-bf46-6feb855bb8e8", "comment": "Malware payload (Formbook)", "value": "3c7ae0a69c705576094a83bc3cdb3c3bb99e0182c9bb0937073ec232cbffb1abe4b5395a287d6cb65fb4af5d50d9df42", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903105, "uuid": "957d8c30-525a-4e20-b81f-27647dc4169f", "value": "T14EB423D4BB0C693A05F067D16BEF4507873B3BAD7E9D8F16130E51E0629922F3B62492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903105, "uuid": "ad7f59e1-d9eb-4fa4-8f39-0b68ff9361bd", "value": "12288:h/PyUEiKU5epDIwbdrQ3hVaZDRSNH7v6FBiOpa+e8JAaZGBMYXRB:NLyUIpDDa3hIFK6BiWscZG2mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651903105, "uuid": "47799ac1-3cfe-4c23-8c55-1824f7ccdaad", "value": 515988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651903105, "uuid": "8f1ed73b-22a4-49cd-8537-ae084a952ae1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903105, "uuid": "dcc6ee2f-d046-4010-b88e-14100b0880d0", "value": "74848_858PGF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8474769-ce4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651960206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960206, "uuid": "900fd296-1b3a-424a-a460-0e01e7643346", "comment": "Malware payload (Mirai)", "value": "ebb50ae4515f493528d62b5342c231bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960206, "uuid": "8f3a809b-ab30-4272-87e9-6f2dd31729b4", "comment": "Malware payload (Mirai)", "value": "937fdce7b0d2216681002718e57d4c71db01aaae0ce8d2684fc0382ced957061", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960206, "uuid": "01a8b23d-e5ef-48d4-8ee8-9e993d556d45", "comment": "Malware payload (Mirai)", "value": "c61e8282c383aebdf1747b5e449ccaf90f3d03e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960206, "uuid": "5de2b84a-f0b5-425c-9806-1cd1572bbf01", "comment": "Malware payload (Mirai)", "value": "addf7b71d8765210f567235dcc49567db2fcecf44421d81d748f744258b54da06974d780a425a4c6ef1876a07417f131", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960206, "uuid": "9bed4a6b-873f-4e17-91d4-49ea65d269a5", "value": "T13613F12A20DB59B501F4A0794CB5E99A27A773F1C4FDCAEF7220BC15BB80B0364E4701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960206, "uuid": "242f4c71-2e99-4b9c-b6cb-1067b728e5a2", "value": "768:xxkGqKlGFftZ66CaFDrnTHBEhA+9LZ5kfLRGteM072Ktt3adocmMbs3Uozi:xxk5j9FDHBuAO7yFGtHu3aU5zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651960206, "uuid": "8008f4f6-3cab-40d1-9eba-343780d0c9ca", "value": 43428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651960206, "uuid": "497c48af-f9ce-43fe-9399-d51b0a15b319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960206, "uuid": "d60d2915-0588-49ed-9ffe-c8f7aba216f1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9a6a8d-ce43-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651954789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954789, "uuid": "192d1034-b43f-4ef6-9240-fd0cfeb3daca", "comment": "Malware payload (RedLineStealer)", "value": "af56d79783cf8772197a76475979d83b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954789, "uuid": "d85889f2-26bb-407d-9986-b4e922b471da", "comment": "Malware payload (RedLineStealer)", "value": "969226af05d45d1731c6be04865a8846890c463dae2a66b7a63030a6442cc8e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954789, "uuid": "f402c316-f972-4e7e-a61d-95b032ab22b7", "comment": "Malware payload (RedLineStealer)", "value": "03e465e528c37df03757b30d41b1aedea68a7451", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954789, "uuid": "2e033049-a9ed-49ae-b22d-ce97e9fdb109", "comment": "Malware payload (RedLineStealer)", "value": "1aa5812e8e4ac9468070dbf7569c573f811f31ba922b63de879719ba00ec175260c3ed39c430d1b9e6d293b6f6319db2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954789, "uuid": "7040ed63-deee-44e9-afee-775514439e0b", "value": "T10A84CF04FB90D035F0B712F4997687A8B93E7EA19B2444CB62D52BEE56346E4EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954789, "uuid": "366cac35-e1dd-42fc-8573-073179f8b158", "value": "5e927159b39478b740427a8589931b0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954789, "uuid": "048a9eff-ec04-4168-aa46-f8b519569190", "value": "6144:Me8s6B5UR0IZieU/shMPx+ijD+GJHxcQ+25XHnWDnyTrKGp+SF8tuDo:MxF5e1ZieRuEyiGJHd5LKs+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651954789, "uuid": "37247219-ae23-4335-8e10-5172e6f48861", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651954789, "uuid": "1aabfaf0-5240-4096-8083-3b3e8992e1a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954789, "uuid": "607755f0-75bc-4b30-8ce7-8575c0710693", "value": "af56d79783cf8772197a76475979d83b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751de554-cdf4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651921036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651921036, "uuid": "9c13ee61-5056-4f71-9c80-6ea6a55210f0", "comment": "Malware payload (Mirai)", "value": "cf1dcbd09b88c1b75ef91061005e42c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651921036, "uuid": "ad47029a-5bf7-4393-977a-a5e835cd3c80", "comment": "Malware payload (Mirai)", "value": "98bbe7fd8042e66950a0e19008994d4a52459110da54a2e42c5f54df11e9073f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651921036, "uuid": "f02c2af7-9a86-405e-a992-c3a77470d64c", "comment": "Malware payload (Mirai)", "value": "e8dbc4a89141293405b2dc483c205b154834eaa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651921036, "uuid": "88988e77-9305-4de4-a511-95a9d0519f09", "comment": "Malware payload (Mirai)", "value": "9ea58bc8be64443f73587d965550e2d5a052b7cd017a3bbb6ae6065d33249fd26abba41f73b37c70548b39494a532971", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651921036, "uuid": "800f45e0-fbe4-4c10-9fd7-6e28941efbf1", "value": "T1264302716E19FFD8FEF1C472C8798E4752BB77B5329038782C358688666148387EB141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651921036, "uuid": "124e50c3-2dbb-40b1-b334-464297ce511b", "value": "768:X4nzDX/EYrti+KDkgyVoN03cIWeq/IvmRXJnTnkDFRj9q3UEL/sjPSfyqIh:X4nXfi+OZAUIWHgeZJnTkeL/sjPSKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651921036, "uuid": "10c4ebd3-ed3b-4bfb-8786-6add40949ee5", "value": 55268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651921036, "uuid": "8295c37a-b0cf-48d4-adf3-79181e39bf19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651921036, "uuid": "bb016328-1782-44a8-b9cc-470f82475006", "value": "cf1dcbd09b88c1b75ef91061005e42c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd988aa-ce14-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651935007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935007, "uuid": "c3c47ce5-40e4-4379-9620-7c9996cfbeab", "comment": "Malware payload (Mirai)", "value": "84151aa4883454f086c2a1d348133317", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935007, "uuid": "7c8ffa6e-63f9-40b4-97f6-98820d7748b2", "comment": "Malware payload (Mirai)", "value": "9b37d793f08b2c201fd2610b460deb3fef376781ade81926648934513ab2fd5b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935007, "uuid": "0d4bfbdb-45fe-4172-b308-b8591265250e", "comment": "Malware payload (Mirai)", "value": "eca3a8002d960fa669ea308dbeb0f610fc204613", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935007, "uuid": "7c3e6bb2-04b9-4832-b2b2-9e2c72f0ad2b", "comment": "Malware payload (Mirai)", "value": "d7e61397d9d07dd6014be6606b381ab922612867d12f938607507a71994bd5092dc68959d5d5d981e09f92293fb99f01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935007, "uuid": "d26d89de-b85f-45f9-9c0f-d3ee1e517adb", "value": "T148531781B881AA25C7C05777FA5F008E371697D8E0DA73038C296FA577CAD1F0D6B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935007, "uuid": "aa7bc495-5785-41eb-ad20-6dd15c3466c8", "value": "768:ooKDq4TBh0SNlDKZHyfws6id9C7s0JVEhtRQah9kHuLwCVy/Jx+5H8hG1rmCd/5B:HuNh0OlWxYh6ivKEhtma3BeZWc0L2DS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651935007, "uuid": "8dc0dbaa-c98a-46cd-a549-3a03a6666266", "value": 63728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651935007, "uuid": "bf1c8607-4615-4718-b50a-5be0c0d41bd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935007, "uuid": "cce13441-465c-46d5-a3c3-d310fb0dab4d", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b85c30f-cdf1-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651919812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919812, "uuid": "95420051-4780-4beb-9489-3d0d9aba0d06", "comment": "Malware payload (NanoCore)", "value": "99eb84299f86cddafd554b70feddf7fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919812, "uuid": "1b277a77-c6ab-4fed-8d7e-b6918b7388d7", "comment": "Malware payload (NanoCore)", "value": "9bbaf063c0f092d248c755107f8ba10dff6739a805f9536976c809e452c21346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919812, "uuid": "f93878c2-02ab-4638-a4d8-ed6c95a88eaa", "comment": "Malware payload (NanoCore)", "value": "d92f92861b7564451dd169fed79794a3d364fdba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919812, "uuid": "4982a7e4-8499-4e5a-9586-e75a83cf93dc", "comment": "Malware payload (NanoCore)", "value": "8a11817fc30663a65b42d73468efd1f2c191625e9f297f1cc966e15f08db9885d2fd5059656316f218d0944107b8ff77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919812, "uuid": "b071279d-87c8-4223-bac2-34284e3d9d5d", "value": "T10214CF1277E94A2FE29F86B9711216029779C2E398D3F3EE18D464B34F267E40A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919812, "uuid": "557d4c52-c26d-47ee-bbd1-f90cddc65634", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919812, "uuid": "a584b17b-cbe6-44cb-b7bc-5f5d91a0ab90", "value": "6144:gLV6Bta6dtJmakIM5Ach5V7lyc3E96/evBaLH8QD:gLV6BtpmkCv7l/y62ajBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651919812, "uuid": "32c513be-b09e-48d5-95ed-9d40f0f8f19c", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651919812, "uuid": "4fd7ec3f-89f4-4643-a5c1-30f9ae0da45e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919812, "uuid": "a57376a3-5f4b-4b07-8284-313ce5968c53", "value": "9BBAF063C0F092D248C755107F8BA10DFF6739A805F95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b28e3c-ce59-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651964444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651964444, "uuid": "30b3349a-3d10-4fbf-9a1c-0a2ac85068b8", "comment": "Malware payload (RedLineStealer)", "value": "1b90ab8952965f14d99a9864173f18d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651964444, "uuid": "9885de96-9387-4154-8654-e8a2be0dbbd4", "comment": "Malware payload (RedLineStealer)", "value": "9bc7e603cd7303357761e611c6e2611b310fb03cb4323a9d71295a62479db4e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651964444, "uuid": "f0b65e0f-2417-4b6c-81b7-b03030ab09ed", "comment": "Malware payload (RedLineStealer)", "value": "04b940bfdfd552aa46f3f4c53c24836f64437abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651964444, "uuid": "2ba1d064-1a48-4e3c-9c2f-99befcadce27", "comment": "Malware payload (RedLineStealer)", "value": "fc7d1d175e1ccafb97f5c06391a96cd185c74c565348c2b6fbf4e5d0548df057c3e3532686201c83ec4dab0c500dd84e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651964444, "uuid": "2059a013-b20f-4c47-9775-22eb2fa0c6ef", "value": "T19284CF10BBA0D035F5B716F5957AC3A8B93DBEA15B2090CB62D537DA52392E4EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651964444, "uuid": "d1694020-a33f-4c21-b6b1-b297f141afc6", "value": "c2f34b03efba3580b2f36c10f3cf4dcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651964444, "uuid": "77497e84-a9df-46b5-8ed2-37d465ebf904", "value": "6144:QuH5sut6mgYTM/L6HOeGdDDWo/owPR7E2KlyzmEJIKP1nkmG1gmYIxdAjeo:lZb69qM/L6HQde2R7BKlkI41g1guxdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651964444, "uuid": "7ccc38c7-ccbb-4851-baae-e5b40a50f0c4", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651964444, "uuid": "65e182f1-9e47-44ad-bc51-9e28b7e408b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651964444, "uuid": "dec8a042-9e25-4bb4-9310-3ab15fb2d2bb", "value": "1b90ab8952965f14d99a9864173f18d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce731343-cda4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651886826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651886826, "uuid": "074a58a3-1cec-4edd-bb17-e361eadf73c5", "comment": "Malware payload (Gafgyt)", "value": "94ffc0834652c1ab89111a48a2f2aae2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651886826, "uuid": "6fe700b4-3f64-4c77-ae1d-693397abc786", "comment": "Malware payload (Gafgyt)", "value": "9ce6d7d21844683c022c0aa6a6db7a6e623a6b2af3f2d1318d41c7915801cfbb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651886826, "uuid": "21018747-a885-4396-acaf-05198fb12aa5", "comment": "Malware payload (Gafgyt)", "value": "a7e73c7f1f1d1e5098f3a99c66fc25cc991df7cb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651886826, "uuid": "dfcdb221-ef44-4d52-bd0c-7bb9068f28cd", "comment": "Malware payload (Gafgyt)", "value": "57789bddeb04f2b4d7826c6da9dd27cd9191db3bcd54ca611b7e527b6dc71a6c61ed20db09f3869054acb9a550c731a2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651886826, "uuid": "2ea0586d-98f6-4cad-b5f5-0faaad0723ab", "value": "T115836B23A651C57BC0875BF92BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651886826, "uuid": "dd23509f-c5bd-4420-81e8-e275ee6cb62a", "value": "1536:eB7cH1LhKlBqI6VhuzdPQq0aJP9sWtjG7ew3n76WODPPmoIYuOVje+ZNne:eRMhKlc9uzdPv0o+QK7ekn761DHmrYur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651886826, "uuid": "4ec96184-2a9b-4854-bcb5-01b4ff82b672", "value": 85796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651886826, "uuid": "dbf3beec-e6b9-4d6b-9cce-73632c806bb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651886826, "uuid": "6699e130-7545-484e-8746-e3224673cfa0", "value": "94ffc0834652c1ab89111a48a2f2aae2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85dcada1-cdda-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651909897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909897, "uuid": "481820e1-8d5b-43bc-8c41-bc6d85ee7844", "comment": "Malware payload (RedLineStealer)", "value": "b9d1cfa1754d83986e48283733efee23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909897, "uuid": "bed99654-cab3-4eea-9af5-2a67d0d9ada2", "comment": "Malware payload (RedLineStealer)", "value": "9e37960d51917b063826f9728d85c6bb18ea1b850058f0b72d4e863afdbe609e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909897, "uuid": "d1aae3b1-76e3-4331-bfa9-25c7b67706d7", "comment": "Malware payload (RedLineStealer)", "value": "edfe11c80f32e19901b4c6483d83f56a9f6639cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909897, "uuid": "e707eded-b957-449d-af9d-169c43a7214b", "comment": "Malware payload (RedLineStealer)", "value": "18f24cc097d0e4d95b04aea3071540608132ed7667b6019fff3af80df6869671b3049da14ffba182204432c88065706a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909897, "uuid": "7bfb8845-32bf-41d5-9d85-f19dc9881ee8", "value": "T10484C000BB90D034F4B716F449B983B8B63E7EA19B2551CB62D43AEE56356E4EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909897, "uuid": "baeb2b36-de97-42c5-8735-4b4fe30fdd7d", "value": "9129a3fce9d5378fac2c2a4063b92d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909897, "uuid": "71a8b2f1-3cf1-4791-9923-ba41b3ffb52c", "value": "6144:4sZXhShmB5GB5ZYWcE0hi7gvjSEIUOj/nbLzjLPTJL6y4z23HH:4ixWmjq5ZYWcuUugg/n3J6vzMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651909897, "uuid": "e386e8a2-5c41-4872-8dfd-f9b1b22f44ef", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651909897, "uuid": "43fee050-0569-49df-927a-7914b44ab28a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909897, "uuid": "bdd261a0-ac83-4893-9535-d14cb592c9f1", "value": "b9d1cfa1754d83986e48283733efee23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f478f6-cdcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651904337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904337, "uuid": "4922bb84-5a9e-4594-b085-2532196462d9", "comment": "Malware payload (Gafgyt)", "value": "fb994f2b9e90fd1cd0ddc05b11380896", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904337, "uuid": "fd7e2d82-17c9-45ef-ad04-dbf6000801f2", "comment": "Malware payload (Gafgyt)", "value": "9e640b4d1c4d35d817b5ececd69d71832b730a09008e13e264dd47da07d3d9f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904337, "uuid": "991073fa-87b8-4d38-8788-26537f9e5a02", "comment": "Malware payload (Gafgyt)", "value": "e690044e1cd34156cb37e0aa41ea207d6e7630eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904337, "uuid": "d9dbc7eb-4111-4fc9-b959-9f4ec2b2aa02", "comment": "Malware payload (Gafgyt)", "value": "8205ec7dd5ff8cf5f4ca71bed060c598e6d2c984ed00b5367ec512e90d55b343566143198e5f07b2cbcbfb5a61ea7244", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904337, "uuid": "5ba39c91-63d6-4980-a0d4-bc399fe57f07", "value": "T101A309A2F800DFA6F40AEB7604D74B24B630FB650F53562673173967AE762D42823F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904337, "uuid": "550defb1-e146-4367-bb9b-848c032a3e09", "value": "3072:b94m17Sx3Lp0qT3pobW5yqrbiTzmU9VqFyOfk/X:bV1Gx3LplT1yqCTzmU9VqFyOfk/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904337, "uuid": "1b9b20c8-dbc3-44eb-9875-1c150c5b41c7", "value": 101818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904337, "uuid": "31365f93-fc1a-40bd-b1c6-af83ac3a00ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904337, "uuid": "f1bc7836-f2c8-4632-8bdd-b0facc65eff8", "value": "fb994f2b9e90fd1cd0ddc05b11380896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f4d9f3-cdf2-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1651920094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651920094, "uuid": "0788c43e-3bfa-4272-9be8-741d073db7b1", "comment": "Malware payload (DCRat)", "value": "9f1f75aab178ebd66131fc2d2f52719f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651920094, "uuid": "85d20b20-7187-4400-9ac3-ed76cee4c7cd", "comment": "Malware payload (DCRat)", "value": "9ee47d035cc3a062f83063abb192617c3312cc0308d6a596dd74bb5828b9a006", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651920094, "uuid": "ad255937-1a32-459b-bb6e-6f5e43bf2e96", "comment": "Malware payload (DCRat)", "value": "1ed46ff1aeb83819f4593f09f16b1d3e0ea248a6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651920094, "uuid": "680aeebf-d72f-4510-9ef8-ea8fa4ecbc9a", "comment": "Malware payload (DCRat)", "value": "aa491638b3d331462bfe81eb52ee961b8dcb396a3a8d554bb9d7536b0af45bf5d961f51a61fe4c454ee9d88daba9bdbc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651920094, "uuid": "24525a64-cfec-41e7-972b-ee659b1f8b9b", "value": "T1CCF40906BA54CEC2E0A90733C4DFC11847ECAD62666AD75A7E4A33AD21413E71E4E5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651920094, "uuid": "2f3c898a-de77-4ac5-bcc1-65fbb4df7e9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651920094, "uuid": "04d73a45-decb-44d9-ba4b-f0162014d63a", "value": "6144:dSa5veqwvzua7ZYdpK/UhRDo9m8wQp8wBiNdrBkHxgePaMYySNnuK7W8qTL4+YCp:dvve39FUnDllrBnE/Y0MqYnIAIkFel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651920094, "uuid": "4fd5e4a1-0436-417c-bede-537437d51268", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651920094, "uuid": "22914802-0d8b-4b27-a13e-18b35ecbbe13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651920094, "uuid": "25fb65df-6220-4cac-ae78-dd11b1c657f8", "value": "9EE47D035CC3A062F83063ABB192617C3312CC0308D6A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffc111e-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651904679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904679, "uuid": "eb4895b7-6689-4367-9281-01ba21e1cdde", "comment": "Malware payload (RedLineStealer)", "value": "18a2c2e2f4a692f438b800a625499cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904679, "uuid": "8b1cbcc3-d5c7-45ca-b69c-7c64e13a4f2a", "comment": "Malware payload (RedLineStealer)", "value": "9f02e070c6910db46ce21bf64a776171d3009a905070648b7e1f43e0814b207e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904679, "uuid": "316fcd27-142b-47b0-b768-4b6523409425", "comment": "Malware payload (RedLineStealer)", "value": "8d009f30f90144d3fce80dc8a84f458b2167e570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904679, "uuid": "c0c5fb10-5f3f-4a7e-b62f-c6290e183c8a", "comment": "Malware payload (RedLineStealer)", "value": "ee4ce42ac9350324e4af5ee8913647c733764c56d322aae15a6321a81cc090c3367fee10fd6803b48246589451539d08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904679, "uuid": "e6792b76-5b9f-40d8-a6c5-69c9e1955119", "value": "T13544AF58BBEC8520CBEA4B71F4A51DF0DAB5A903B487975F21091AF81E233C4FD1646B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904679, "uuid": "744c4951-ba06-4940-87fc-0526cbdadd20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904679, "uuid": "8d747623-432b-40e6-9e24-8bcccb41e349", "value": "3072:fl8hIiub5Wih5ycGkpGDE5lhunAuxbugB8onftvLgx5EFSt0P+uFCy7glB9Nhn:f6IiuEm5ycMwTunAuYy7C6WxNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904679, "uuid": "bf165f35-d85b-4382-aec0-9b93ec33536f", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904679, "uuid": "52742f8b-0ec2-4b2c-a7f2-467805cb887a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904679, "uuid": "25491539-5683-453c-9764-8155d03f808b", "value": "18a2c2e2f4a692f438b800a625499cf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ebe37b-ce5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651966772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966772, "uuid": "14ebd893-b36f-40ea-a1f6-c0f0c73a9e62", "comment": "Malware payload (Mirai)", "value": "046374c8ed531dd708a2b1cca027238b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966772, "uuid": "53c3b924-5d29-4769-bd4a-defc20f12135", "comment": "Malware payload (Mirai)", "value": "9f85ca118ff9e24fc74270d842b28839d99f1b1e0e1c8bc738699695d8991243", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966772, "uuid": "47fbda31-b359-4ce5-a307-51db7625dbde", "comment": "Malware payload (Mirai)", "value": "d4bb54ce035ff90c0c8eeb9d977e93cb533d3af6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966772, "uuid": "a11dd62a-81d4-4f93-87f8-1ee06c3d765f", "comment": "Malware payload (Mirai)", "value": "98bb3960958243c99f22e59de5179ff58c018fef3bbb79d4d7434511a0ca9a7e18b5652da759402947aee5db1c7f5967", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966772, "uuid": "b8c63873-7a1f-42d1-b854-840e859baf31", "value": "T13592C01962557E30CB3099397D39C44B37192FFE66BB301B05648A38E18A29EEDBC1D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966772, "uuid": "738d8ef6-056f-445f-adbd-ec33dd991cd5", "value": "384:8ubJkr3cD4TeFT5G+ZsTmRnhKfIEv9jWkWAtehI2d+x2shymdGUop5hu73:sytg+ZsT80IE41x8kss3UozM73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651966772, "uuid": "1acfbf46-a237-4599-8bfb-6c158beeaec1", "value": 21016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651966772, "uuid": "96f229ab-95bc-48f3-b221-a3264fffad9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966772, "uuid": "01a1042e-e984-4a51-865a-391e8b59b87a", "value": "046374c8ed531dd708a2b1cca027238b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc2469c-cdda-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651909826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909826, "uuid": "b69b5a43-3813-47cb-a8aa-28b33ff7952d", "comment": "Malware payload (Mirai)", "value": "526a570f3d1a0089cfa482fc73cf78a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909826, "uuid": "eeebdeca-3d86-4d26-ae91-7e8f5cf61eda", "comment": "Malware payload (Mirai)", "value": "a107cc4ff311c732ff87a6f54d72089ef4323ea4e4c49fd4d86a0cd5dffa249f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909826, "uuid": "d06dd62a-92a1-4937-8203-41cdd0df5955", "comment": "Malware payload (Mirai)", "value": "f90a7c567a34697241c704873056a6b231b82ebf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909826, "uuid": "9e210775-96f5-4c45-b792-d6dc2148863f", "comment": "Malware payload (Mirai)", "value": "a841093eb4296dcbc1fa6fef831c24b58dc2f5995178879f8e83299d987be317ae1ef6bd52180544dcda2cbe49ea63c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909826, "uuid": "e72c8ce4-5531-4933-b313-e2be79fae29e", "value": "T10D42B6D1B9568A03CAC44233FB0E43DCBB265748F2EF3303671B7F916107A670AAA419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909826, "uuid": "ca196023-0f5a-4482-bc37-675f60802d74", "value": "192:mR8WfOyK5hsOag+BbcdFryaWdRGgrUkEZx4eoW:m7OyQigQcXuvhUFx4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651909826, "uuid": "723b7ac9-373d-4ba6-a03d-6a7a950fabd3", "value": 12388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651909826, "uuid": "9716b48b-4526-48c0-ac92-328277f2037c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909826, "uuid": "8f9873d4-44a5-457c-ae32-035bc5258099", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b186c8-cded-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1651918000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651918000, "uuid": "74905750-f872-489c-a0a2-de0c0b38c6c7", "comment": "Malware payload (njrat)", "value": "8b492d351f49f7b5de1a473e982a7e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651918000, "uuid": "affe1e86-743e-4a11-8316-7c5c24e84ddb", "comment": "Malware payload (njrat)", "value": "a177de2527c8fd59a34636c57c4e2c7fae771a03333f2a7a31c4c1ceb88fdba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651918000, "uuid": "54f7262e-d7f6-437b-beeb-9d85f4012935", "comment": "Malware payload (njrat)", "value": "0688d764a69b07cb16036c3b4872cc73b9bbed53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651918000, "uuid": "7843f1df-b057-45f6-8322-b1c3efc0acad", "comment": "Malware payload (njrat)", "value": "66d1c37cc0dec0b79035cd4209e092d2e1c7b4759376684fb2bd275c21c2400f6e2c8d57494f5f3bf447ce573eaf9c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651918000, "uuid": "d339cece-97f3-46c3-a0f2-6cc8a94d1528", "value": "T156057C04F198A5AD9BB22A38D704348A9BDFC6FE00E5534CBB74DBC91DE4E68CC5854E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651918000, "uuid": "fab75ce9-8a89-4540-a897-0fc1a68fb9ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651918000, "uuid": "a0fea783-b68d-4408-8325-6ae8dbdd2761", "value": "24576:PyO569rYnA2+XsZ7V0KfcKJGkJOLoqH71:9g9eZ7/ctEqHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651918000, "uuid": "179d7c6f-95ed-4906-9f06-6403db963ee2", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651918000, "uuid": "05243077-45b4-4d0e-af62-9cb195eed8eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651918000, "uuid": "33743143-c002-43f9-aa12-ee5156fc6b08", "value": "A177DE2527C8FD59A34636C57C4E2C7FAE771A03333F2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47088798-ce1d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651938568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938568, "uuid": "5e0e5e6d-3d1c-497a-83db-10128f2d01a5", "comment": "Malware payload", "value": "ab2a939507591510b973787b87ba1651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938568, "uuid": "f22e9932-af4b-40bd-80d3-4acac8eb7ce4", "comment": "Malware payload", "value": "a1b564338930b3ee7a94275ac368b1445fc4db0831c243d87ab6d389f2156ba1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938568, "uuid": "54e8cb79-b022-442f-9840-f7333c443372", "comment": "Malware payload", "value": "530028eddfca6e7059af4c6c0f779efa65cda1ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938568, "uuid": "2f0fc3b6-ca03-4514-b4ca-bfd86355a626", "comment": "Malware payload", "value": "79a831f70a76838db6face4d44311c5ae3594e6e82ccee1f615d7ec85924e0f70e08a46a924482c7066e3b3e73198eb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938568, "uuid": "09765537-dc28-4fc4-a8c8-3cedc8d1f675", "value": "T16B03F1B2F984ED1DDD290C79B0D36E8372DA1DF0C2FC7A496B2015E548A38841BF958E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938568, "uuid": "735e4a19-e832-425b-9358-d8ae37039822", "value": "768:R81plwqeMi+rmntMvRg0v7Ny2ZHNY1i8tpJUnkweGZv0iCBDfsyq3U7Aw:REpl7eM9roAx1NszpzwILDfzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651938568, "uuid": "e1118bd9-8a1f-4487-9627-d07c25a1769b", "value": 40868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651938568, "uuid": "26794c4c-981e-4e87-8173-6761e402dab5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938568, "uuid": "02850f4a-c87c-4c7e-a4f1-7bc6c1b4470e", "value": "ab2a939507591510b973787b87ba1651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7fbad4-ce57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651963734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963734, "uuid": "accf5595-10c1-452a-bd61-af2e1708e836", "comment": "Malware payload (Mirai)", "value": "5d67ec704382ff64cb019a3baf0068f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963734, "uuid": "4809c3a3-fed9-4bca-af31-c2086fb281f0", "comment": "Malware payload (Mirai)", "value": "a8d6afd5081fd5d37906e5d347fd8a770e8f5c853e25943799672c7c892ab1d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963734, "uuid": "e35f95c8-44e2-44e4-8049-d4d353a07902", "comment": "Malware payload (Mirai)", "value": "441130b727e5743786f083630221492e974be9ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651963734, "uuid": "b741893f-763e-4a76-8aaa-e4d0854f40de", "comment": "Malware payload (Mirai)", "value": "f4a65f8e2687acb50bbf9d262d66b6500dadb6c3155d9909ad6c729b406f41a3bce473b750b24c5575a24077d2195c2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963734, "uuid": "a3fd8265-c677-4664-9be6-a9824f78050e", "value": "T103330261DE27EF632CA0BCB0FCCBC152DF7EA599A0C8616BA0815214EB6217152FCD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963734, "uuid": "3959f2d2-51f6-4683-9dcc-3768eb75f61a", "value": "768:O5x30UTVAS+Y/ve2uRoQvpQvVrMpluZk6tpf9q3UELEuREbfqcSs9KqSoL:6kmP/JPRjzOLObfzTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651963734, "uuid": "90e603c1-7915-4397-88f0-5ec7647e0481", "value": 53276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651963734, "uuid": "482a4600-622b-47ea-99f7-67ba2820e4a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651963734, "uuid": "a0813dc5-39a8-42ea-87e1-010490599cb9", "value": "5d67ec704382ff64cb019a3baf0068f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aacbe2c-cdcb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651903382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903382, "uuid": "036aad34-8d7a-4f3e-95a2-6c8c99cc193c", "comment": "Malware payload", "value": "ddb7aa5afa7474424025efb74acf3734", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903382, "uuid": "9b7222ac-421a-4955-b02c-f001e208340e", "comment": "Malware payload", "value": "ab45888733950fafd1848bc41564d27ba966af9cb96fe08a44065592559f4fdd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903382, "uuid": "e304e7dc-2899-4ee6-abe2-96f894cddac4", "comment": "Malware payload", "value": "d96e9256adad9eebfdde8211c633e5d791fe1795", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651903382, "uuid": "b14c562e-6bfa-4050-b899-3ad2a80543e8", "comment": "Malware payload", "value": "4517f8219d3505864ba71484e1168a2ad5711ec389ceadb564ac119158c0123fa1be5c54768e14acf6d515c6b0348928", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903382, "uuid": "762d1773-a17d-43b7-ba15-a6d947ff2f95", "value": "T12C428DB9E608F838E3E0883C940DE2FCF7A943079352B15EA499678D9F407CF5B49499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903382, "uuid": "61a5d3a4-a54e-4381-bc62-d3aa5c06abac", "value": "192:ScIMmtPsT3V3FEyZpdk4wLGSEvQz6u5bv/0M1anJTgx90YBRunHXgITbWKp+:SPX0JF9ZpdiLdQBqvUJ4MlTbWy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651903382, "uuid": "0187dd9a-cc68-4744-a819-469744ce6677", "value": 12987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651903382, "uuid": "d9638c7c-2cd4-4a03-8a81-965e5e78b656", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651903382, "uuid": "1dfe9743-2e4f-4b29-bf64-c7ccaf2bbaf5", "value": "Ihr nicht beanspruchtes Geld.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739ddb35-ce14-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1651934777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651934777, "uuid": "f886fd17-db90-4361-995f-4429f3f98e5d", "comment": "Malware payload (CoinMiner)", "value": "416e481dc4cd24d3531ea79201d094a5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651934777, "uuid": "28918497-1171-43be-ab16-cd73434ea7f4", "comment": "Malware payload (CoinMiner)", "value": "ad9905b6998982839ca2820a0040a66722f09eb8074415143a15a8ceaaf6e5d7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651934777, "uuid": "a2c7c037-aad7-4659-a897-b5a2bebadd4e", "comment": "Malware payload (CoinMiner)", "value": "0d731b4c592ee746fae4a1d4ca7db088e83c1d1d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651934777, "uuid": "9d6e72b8-574b-41d3-8585-7e12e072e260", "comment": "Malware payload (CoinMiner)", "value": "e76ff9f17be8958dc8bcaf0408aa24a2555a8dbeed6ec0bcd6839fd1dab1604f789704e424468790073ff37cab580216", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651934777, "uuid": "9dd90092-323b-43eb-902b-eccc6866ac5e", "value": "T117C21820B3FD8620D1FDE5B64CB35B15A773B6975C22C60D0E85558A0673B848FB2F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651934777, "uuid": "714e7146-598f-4527-bcea-d8c218415fa6", "value": "768:emPcxNontlsu/RB+p/ozLClK2tk0LAG3bO/ED3+l8NkPJFZe:eYcxqnzsuT+p/ovCKQk23bO/63++Ns3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651934777, "uuid": "7953fd0d-1ee8-46a3-bf5b-c456eb7f1415", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651934777, "uuid": "3e19a539-7907-462b-8b1c-db1713818afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651934777, "uuid": "b1c02285-b69b-464b-a265-2283d3274547", "value": "416e481dc4cd24d3531ea79201d094a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd10dde-cde4-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1651914391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651914391, "uuid": "b654a36f-81fe-4742-97a0-231c9db99b82", "comment": "Malware payload (DCRat)", "value": "68ae6a925e2b0fdf157196349d69bbf7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651914391, "uuid": "18305b8f-9490-4232-8cac-3a85f77ad9b0", "comment": "Malware payload (DCRat)", "value": "ae3e931542479adec80cb6fb90f5bbb36c2580fbbdf02e9ac4b04514739265a3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651914391, "uuid": "f0411ed6-4236-4114-83f0-997b54be7c2b", "comment": "Malware payload (DCRat)", "value": "1698cea4503202e4c6dbf385fce48a1b963322e1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651914391, "uuid": "6d7529e3-4031-4c82-bdf7-8b8ed1388ccd", "comment": "Malware payload (DCRat)", "value": "adc549263f05efdf48d53c8bacc7301340e6ebb9b965f9722ba96d80a151cb5607776e9ada938aaf6d06d9f842c55702", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651914391, "uuid": "b1039d22-ce3a-4930-bbf0-ea481bb10931", "value": "T111F4E602BA4DCA02D0A91637C8EFD01C47A8AD437A66D71A7E9E339C16513E79D4E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651914391, "uuid": "40dbff43-b4d4-4870-b92a-0237ca0a4ebe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651914391, "uuid": "5daf3513-7284-4fef-8fd9-79df8e63d0ef", "value": "12288:p0nyiDdVFXA2L59vO60vgr1BNl2vJMDbkYCAtP78dy:pIxDdVFXA0Qv41BNXhT8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651914391, "uuid": "815912c8-ee9a-46bb-937c-e32d71a6b9bd", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651914391, "uuid": "a44e53a1-3628-4596-82ef-aeacdc86578e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651914391, "uuid": "f86defb2-cc36-4d86-8b79-f24cae4eca6f", "value": "AE3E931542479ADEC80CB6FB90F5BBB36C2580FBBDF02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecc68bd-ce24-11ec-8e58-42010a9c0032", "comment": "Malware payload (Tofsee)", "timestamp": 1651941721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941721, "uuid": "18f18915-9df1-4288-94ec-2ef5b4f8cfaf", "comment": "Malware payload (Tofsee)", "value": "36146d75061dacd10ecfaaef0d2c4c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941721, "uuid": "40cebd4b-a6a8-4bbe-b1d9-c443720874aa", "comment": "Malware payload (Tofsee)", "value": "afac7896cf21983233c533eeaec870610856969d98218b0ffdfa11c6f57a8420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941721, "uuid": "a29e4f6d-5970-4b56-9806-817d86962122", "comment": "Malware payload (Tofsee)", "value": "f6141869a9b47a102af844a1d27c75b5b19821fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941721, "uuid": "f4804af3-0a8b-463d-9ad2-ad69bcda4202", "comment": "Malware payload (Tofsee)", "value": "95c704d82b528bd2c8465a22f2be9f20af55b4279546d90046d67f537b1e02cfd065682bf4cfc4f6a0ec22f94bfd3e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941721, "uuid": "f4f15c4e-3add-4dda-97af-1edb69215fd3", "value": "T139E53320BBE181FBE755143528543FB6E5FDE36D1A341D9B3FA09A0E4F38E60403A56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941721, "uuid": "f832fc18-e974-4b9f-a3fe-10f2ab8722c4", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941721, "uuid": "f7de2125-b5cc-496b-8e9c-6b7f939a5787", "value": "49152:xcBiPkZVi7iKiF8cUvFyPx8pFiaTWlat3mdRLaKFIAPurkJqDU2Z1kYbEwJ84vLq:xsri7ixZUvFyPWpfT2a4LalA2r6qDvZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651941721, "uuid": "ce93a482-7d66-4384-8fdb-6ecf68c0722c", "value": 3107729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651941721, "uuid": "1ec6cce5-a01d-4151-af8e-1a59c689fa66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941721, "uuid": "36a7a6d5-5d89-45ca-b1fa-1861d1ff90d2", "value": "AFAC7896CF21983233C533EEAEC870610856969D98218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580a4b3f-cde0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651912397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912397, "uuid": "068dd49f-58c0-4eee-b997-6cd90af82ea8", "comment": "Malware payload (Gafgyt)", "value": "3ad13074c2a4f9c58606672b1f0e6090", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912397, "uuid": "2f801369-aff1-4461-a776-24d4e0cf5646", "comment": "Malware payload (Gafgyt)", "value": "b23ec4212e0b5f3851239a99d991e5560f3f5842a7aa7334be151587f6b2f1bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912397, "uuid": "0acf1109-0c08-4ae6-9792-961da719a43a", "comment": "Malware payload (Gafgyt)", "value": "53066a1618bcf80540a54ab6f81c32eeb5662edf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912397, "uuid": "52d6c3a6-c5cd-4454-b422-4729348b2dcd", "comment": "Malware payload (Gafgyt)", "value": "c1ffcdcfe3290b60b327fe073e709f0294378f05686b933a6beb565bb4484412e8f90698a0f8b2d52cb17ed98e96c5a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912397, "uuid": "56818d6c-e560-40b9-84df-5262f3505d59", "value": "T1D632E8A38E693F94E248D17271218E3D5323D516A64B5FBA12378664D003ECCF6563F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912397, "uuid": "d72b6466-bb67-46c2-b96e-e8867605db06", "value": "192:A80D+qFge+RQaMzPEX06X6DlUqhQpqnodYHJ7hvsDU/BkqBTEGra7PXa71EbYBcq:ACqFge+c6X6DlUqhMG7l/iqBGw99L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651912397, "uuid": "059af930-03a3-4022-836e-43abca4f7fa9", "value": 11008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651912397, "uuid": "89041038-8a0f-42a8-a517-422b89d26d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912397, "uuid": "ae9a954f-70ff-4350-adbe-c2a6f091b809", "value": "3ad13074c2a4f9c58606672b1f0e6090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f50a64-ce03-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651927394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651927394, "uuid": "a4bc8d0b-82a4-4759-9bf9-c689a8b077a0", "comment": "Malware payload (Mirai)", "value": "4e7978f6b54ebc9750a839ad89071b39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651927394, "uuid": "6a28825e-1b0a-407b-97ee-1e16cd833b06", "comment": "Malware payload (Mirai)", "value": "b4923448dea4fd97a59f88bc1460f7cf3ddea357aea4cde77780cbca99394bf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651927394, "uuid": "d309d97c-de72-40d3-a2a8-cd1fb113a97b", "comment": "Malware payload (Mirai)", "value": "fe63654a2b724abb6d0cc17c9a1605b5622b4a67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651927394, "uuid": "dff7841c-c298-4c3d-9dfb-eeb4fc093194", "comment": "Malware payload (Mirai)", "value": "d709faa91a24f55ad7fc115a4daf3c9614035f76512248f4eb9261f05f22c41752e526c8f27b9fa417599df1f4a9c283", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651927394, "uuid": "43dab4c8-e5c1-4141-ad5f-b82ff0897c40", "value": "T1E7B2D1C835086DA3C2731D34D5BE8206E34545B9A3BCF5578D540268CBCF15D917FAA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651927394, "uuid": "ddace60b-2dfe-453c-b151-cc26fe436499", "value": "768:raIiZFQg90ZfAJO7FOHwO51Z0BcNs3Uoz9q:rfiDQ61J4YN5bEcQzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651927394, "uuid": "cdfd745c-cf00-4eb5-89f2-5322a7be9e86", "value": 24792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651927394, "uuid": "df51faad-e2d7-489e-ae85-3f848eb9b705", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651927394, "uuid": "348f548b-f6ea-4857-945d-0167d289070c", "value": "4e7978f6b54ebc9750a839ad89071b39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c6b030-cdf1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651919772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919772, "uuid": "c0593577-910e-4d54-b925-79fe30297631", "comment": "Malware payload (RedLineStealer)", "value": "50e7d0f5623f1955f2b5de72114ebaf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919772, "uuid": "10adc544-bfc7-40b0-86c7-8e52b34a4add", "comment": "Malware payload (RedLineStealer)", "value": "b79037b76c1503954797d791368597aca92908cb9ee809b2e2122ed8a04531e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919772, "uuid": "91cc0733-f590-437a-ab9f-d738d2efaaeb", "comment": "Malware payload (RedLineStealer)", "value": "7c7908ac1c26261b1afda2414e94356b86fc5060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919772, "uuid": "31daa2b6-bae0-4c55-bdfb-7199bab8c8d9", "comment": "Malware payload (RedLineStealer)", "value": "851beaad6a147f8c02f07518cf2de1da5adb02e193ce11afdd9614122df3d2333906f49ba7b3c4587f3f2403a4ca3423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919772, "uuid": "055bcb39-dc3d-4d5b-b805-308856bdcca5", "value": "T17984CF10BB50D034F4B712F4897583A8BA3DBEE19B2554CB62D52BEE16386E4EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919772, "uuid": "bf53433a-913f-4ccf-9d22-92b05290f58c", "value": "a14107a392764307cdf95bf281e41cf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919772, "uuid": "f188fcf3-4aea-43e8-9657-d40cb4476ce7", "value": "6144:ct8XhHZHO5GB0aIqTw0h8Vy6bI2+nFg2UzZgpG62IJU86szf4z5Y5R+XwHs:cCx5Hoq0aIqTsUScFg2UmG62IJJ6C4zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651919772, "uuid": "a9004e78-d77a-43a7-b28a-2d0e7a059705", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651919772, "uuid": "c7cb1815-fce9-4840-b64c-56f99434f71e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919772, "uuid": "3635229e-610d-470e-9f40-c1a9c2ce54e4", "value": "b79037b76c1503954797d791368597aca92908cb9ee80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503deb35-cdb3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651893057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893057, "uuid": "aaf990a6-a467-4ab8-a723-5b9a665549b1", "comment": "Malware payload (Mirai)", "value": "43f382241b32b141d83fe5ac8524417f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893057, "uuid": "6de2b43b-ea76-41a8-878c-dbe186b0c2d2", "comment": "Malware payload (Mirai)", "value": "b86686ac2cbf61d08607df0f3e767ea9324a09c3605a8b18e503e912d0a326c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893057, "uuid": "1bf51749-0f14-49ef-82b4-fe703a71a9dc", "comment": "Malware payload (Mirai)", "value": "6e201d5ea081138e4cfff7c01478d8e760af1841", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893057, "uuid": "8e2542ae-e68c-4860-bedf-66fac6333bc6", "comment": "Malware payload (Mirai)", "value": "5f2ec6318d6eb866964ee4f301932ad146d2fd06ff13b45d0bb864e437be44e5e9e34488fe3043ec5dc98969cb262870", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893057, "uuid": "bfc0367f-8107-4ccd-806f-a1de3f2c4cd4", "value": "T118534B0277680A47E0A61BB5253F17E193EEEED020F4F588260FDB464636E37558AF9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893057, "uuid": "e1ba9f18-db36-4647-ba49-026f8b87c0f7", "value": "768:ECIJ/8veWXRGtohQCz2RJRR/ow76lH6pYUAoFVHOJN1yhGW6YR7cO66MHmgj:Zejk2gwGgpYEYPWJcH6imgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651893057, "uuid": "e26c50ff-5665-45b0-b68e-83ba2434473e", "value": 63224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651893057, "uuid": "93b28566-745c-4e07-b091-cf832ecabda5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893057, "uuid": "42b60341-1f94-4a12-a50e-f235847d6696", "value": "43f382241b32b141d83fe5ac8524417f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5960d3-cdda-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651909827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909827, "uuid": "405d3bf9-a781-42c3-9a63-c527a481d91f", "comment": "Malware payload (Mirai)", "value": "ba13f54284330675ee15c263cf230504", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909827, "uuid": "39ed5650-f1b0-46dc-a0f6-f90baf44f225", "comment": "Malware payload (Mirai)", "value": "b8e9a129468f8995dbcc37ed943801a50755f65476d49e0ff04baeb280065b61", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909827, "uuid": "b82eac1f-287d-4979-8311-b4792abca887", "comment": "Malware payload (Mirai)", "value": "314ca99c55e69fb791883188f91c72984ce4f0f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909827, "uuid": "edcc7428-b545-465b-ae22-e23cc9b499ab", "comment": "Malware payload (Mirai)", "value": "354b2aaabbde1af3a239ef2729186320f95fae5f683f4cf87d4c4a35f4662477f297b4e5e3d980f9a0d2aa702089d8bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909827, "uuid": "e789fc05-0fab-4dce-887d-89333fe025b1", "value": "T172833881FC41A622C7C11677FE5F018E371553C8E2EA32079C295FA03ADF95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909827, "uuid": "4a09ab1e-d1dc-4594-974c-514ff1e8d475", "value": "1536:ROMd/8Bg9CMlOCB6T33eZtP5PiomSH3KsUHcbvn:ROMd/8I6T3wJmS6J4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651909827, "uuid": "db66bfb6-0c5f-43bf-b632-c04b1298e3ec", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651909827, "uuid": "be213483-6211-46d8-a344-ca320b17ac06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909827, "uuid": "81700cee-3c64-4ee7-9f55-4a2e559b40b8", "value": ".arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2bf741-ce5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651966786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966786, "uuid": "ade61354-4456-46fa-86b1-f2e03993c723", "comment": "Malware payload (Mirai)", "value": "378bd55e67fe9566f071aac20bc51b57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966786, "uuid": "0ddae29d-9679-4027-96ba-06d008186149", "comment": "Malware payload (Mirai)", "value": "b966e6f5f325ce3ef74f0bcc3ef7310a358afc0201a0d118f7de94159cdb0ee4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966786, "uuid": "a3826389-c5fe-4125-8684-8acbad3ce2d2", "comment": "Malware payload (Mirai)", "value": "9d0d63412ecb7c67fad22ccee9dccf067bd391d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651966786, "uuid": "b1501c3e-b7f4-44bb-a176-44cb9fd8f333", "comment": "Malware payload (Mirai)", "value": "449a019373efaca70639b1022f2dbe525c7a946dbf7734ac43c144b4f4f5b89028e95c1f0154dee732486f29dfb0ba46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966786, "uuid": "c05c76f7-2f12-4dfa-a127-0874946f6133", "value": "T19CD2E020626CD421C4B69C368B861847AA4D7F7CA0FE391229949BBCECD4D1B53FE083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966786, "uuid": "ac30e692-4847-4bd5-ae8a-589db5739b0f", "value": "768:eh9XbjWynxtxtk4s9GUBl+D3VunsZ/9q3UELw/:ebuyTk5xBUDknsZuL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651966786, "uuid": "a9174af1-9204-4b99-ae01-7277f7a17a39", "value": 29476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651966786, "uuid": "b2aef4b2-1baa-4f72-9f94-9565b83bad5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651966786, "uuid": "58a5311e-397e-4ce4-92b5-fce1d35c889c", "value": "378bd55e67fe9566f071aac20bc51b57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3b0789-ce38-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1651950384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651950384, "uuid": "905abc3b-487e-442b-a4ce-7bb43dbd1f06", "comment": "Malware payload (DCRat)", "value": "b01e71436ccb703fbf02bf0e171f77ac", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651950384, "uuid": "5e099ecf-a829-4340-893c-c20a812a61d7", "comment": "Malware payload (DCRat)", "value": "b9e8d2ae255a3b585cd17cbfad39037f0bb9a7691b4977e08d248841017b1b2c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651950384, "uuid": "20598c45-ae5d-4f38-8b55-c56a831f85b2", "comment": "Malware payload (DCRat)", "value": "9acda7d69832cbfc66881302b5ab2691ad342c78", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651950384, "uuid": "620f6535-3289-4bf3-9906-7284a8fadefb", "comment": "Malware payload (DCRat)", "value": "7c7388a7636ba38fb75247b6a7c123fda89d547de3c7ce6ec42ccf59601350958a270955ab75eb9993fade3b8b90f06d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651950384, "uuid": "5123365e-3fe2-4173-8b22-a9048208470f", "value": "T1D805E7027E44CE13F0095233D2EF585883A8AD516AA6E32B7DB937AD15053A7FD0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651950384, "uuid": "17c31297-fe66-40e6-9616-0b0381018d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651950384, "uuid": "bc468a7b-ed91-49fb-86dc-1744a0c64ca7", "value": "12288:Oq1uSssc+Gx81NWhiwLdlyoCGPThXBpsK9lozl:OkuAcVjhiwzRbhXBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651950384, "uuid": "f7f0ffe8-85d6-4d33-99c8-57e19e467234", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651950384, "uuid": "dc76a921-28c8-46cc-9ab5-4be9e26f51d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651950384, "uuid": "e55ad1be-b3e3-4075-9ed7-12b9c7c414e0", "value": "b01e71436ccb703fbf02bf0e171f77ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2bb9e6-cdb3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651893046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893046, "uuid": "012af949-0999-4f98-8102-322cd73dcc1a", "comment": "Malware payload (Mirai)", "value": "c91964a7f3c85e8e87902382eb2e1556", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893046, "uuid": "81c6d30f-0854-4be7-bec7-4c03deb4e631", "comment": "Malware payload (Mirai)", "value": "ba3c79a66c2fa6afb48355cd57af6df1214716110c5bfa2cf5eaca0b4a446127", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893046, "uuid": "96cb2140-2b39-42db-96b0-c417d0fe75fc", "comment": "Malware payload (Mirai)", "value": "db3039c0b341139e2f20e2dc4bc6da291dfc9655", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651893046, "uuid": "ef43407e-dd13-46b5-beb2-7cc1659dc68f", "comment": "Malware payload (Mirai)", "value": "b38b7d44bf82f318966f229283108bbd75ec2f0f2855911dc7bc02e9e893fd47f69bc4b2e83f2db6d9ca3f0b154facea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893046, "uuid": "2089196c-340c-4a85-95b7-328811f7e7de", "value": "T137535BDAB8029E7CF89BDABF54170A0DF521B74445930F27B62BFD832D720A58C16E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893046, "uuid": "f5dc5b72-3e46-4b48-b47c-bdfd13d52e79", "value": "1536:ycWkGlKJJ9F1OnlhWCtZMHBqUrrlhhTGIspL6Sr6lK8OQJ:hB0nlhYh3rhhtpArA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651893046, "uuid": "8fcd111f-5881-4b50-a17d-1527e725f67a", "value": 66068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651893046, "uuid": "f91a2ead-e854-45e3-b7a2-2a7aa5aecbde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651893046, "uuid": "cf198371-47fc-4e5f-88c4-f0d6c6882bdb", "value": "c91964a7f3c85e8e87902382eb2e1556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb8d5d3-cdd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651906102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651906102, "uuid": "df86c4c4-e489-4943-bf2f-2f833c73bf43", "comment": "Malware payload (Formbook)", "value": "0b0378bf9c4aae223e196b1e7a1ee05b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651906102, "uuid": "12b11ca8-2231-45bf-bf18-1f7d6eab29f9", "comment": "Malware payload (Formbook)", "value": "bbffff976d444db57bed39a3a8fd6b23ead78cee51a7c482ff5bcbdf12e6cb93", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651906102, "uuid": "f58a806b-b8a8-4928-9de6-215b308ab420", "comment": "Malware payload (Formbook)", "value": "f731f3ee740c9d2cbe0a84656a0d3dee67241cad", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651906102, "uuid": "cc481386-601d-4e87-a6a3-9c35dd1f50aa", "comment": "Malware payload (Formbook)", "value": "962db80d08ee75171a151dd80cec8773b1a5a8a9dd33b6ba92a6c00f31d800dbc6bb971601758db3e85dfbec36945703", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651906102, "uuid": "a51cbb0d-1c87-44f8-ba13-e0f6a218d457", "value": "T1D415331D81D3600FBEACF60141E7611EDCDA8B088F2CAC7E6EE45EA1D5D91E971443EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651906102, "uuid": "685833bb-1ec4-4f08-b2e2-73137cc8adec", "value": "24576:sNR3c73TzO2wbuIhkpekB45c4SmjCRwQXSBVZESQvR:sLMDfvwCnB45c4kBCXi55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651906102, "uuid": "c3c40da8-f115-4d4c-ab6e-455980f6c907", "value": 938966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651906102, "uuid": "e29ba5af-ddd9-4664-aa48-14ef4b7a1632", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651906102, "uuid": "084eaabd-909a-4c9a-bf69-15ee42b8c5ce", "value": "DHL DELIVER..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738a60d8-ce3f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651953245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953245, "uuid": "471dbc10-acdf-4811-abed-03f672ae8c48", "comment": "Malware payload", "value": "5429d417de7dd758f94a4cf2202df67c", "object_relation": "md5", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953245, "uuid": "16c128ff-3e01-4cfb-8ca1-371e74ed18d3", "comment": "Malware payload", "value": "bc9ff32af383142fa7e9cb62e69d5ea8e8613b21e691f75f86a9c3578278562a", "object_relation": "sha256", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953245, "uuid": "684a7c84-c984-429f-8fb5-c65a00eba76f", "comment": "Malware payload", "value": "42ee84cec2e50e092eb50ab910dcae77de60a5cd", "object_relation": "sha1", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953245, "uuid": "6b446ef0-d17a-4289-b9dd-7a8b1b99e7af", "comment": "Malware payload", "value": "615293747d3d9e40dc2cc7d5eda65ad6d121db74f4d4500e48124e480d7e144cd9e5eb8b268e24af03fc5f93fa73dd98", "object_relation": "sha3-384", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953245, "uuid": "c4bf84a4-16c0-43f0-b270-bc9b3bb1c0e9", "value": "T17911126578045153F1F16D71543E59147758638F7300EBFA26AF103A15149C4F2B91DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953245, "uuid": "53696fa3-bd39-404b-beca-5f0ace3ac134", "value": "24:enCJVeuV40+Oyf2sVAFA8V1Pt+094pGJz/OaFS/6cfL9:AyVRgROnzEoJDON6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651953245, "uuid": "fd9233c8-eeec-4bc8-b56f-32efa38497fb", "value": 1042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651953245, "uuid": "74d7c7be-024f-4c6d-b626-66e157471aa7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953245, "uuid": "d947a6bb-2033-4873-948f-58bf397f46e6", "value": "G0nnaC0peRansN0te.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3583037-cdd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651905678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905678, "uuid": "7469dab6-bed7-4019-8254-7492badae402", "comment": "Malware payload (RedLineStealer)", "value": "2b4dc16f1ca404b30883f8cfa5361edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905678, "uuid": "919f985f-66f9-467b-ad80-ebdd2c3b4199", "comment": "Malware payload (RedLineStealer)", "value": "be2eb0d61ede44a79352ada5624ba6b3503a8d5412adedac12f48dd69a506685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905678, "uuid": "11a13acf-db04-4b16-b882-f00ed74a9ea6", "comment": "Malware payload (RedLineStealer)", "value": "2bdca3de844df737f1aa515152447165cb74d297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905678, "uuid": "fc2a4f41-7051-4e80-9ee2-60c54d0cd368", "comment": "Malware payload (RedLineStealer)", "value": "06ec3478429a8357447417043eb48742820a6dce12252cbf57141dc22ffb36c6d1389c5a1fd1ae6da4ca08be191bba59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905678, "uuid": "5224eb82-cf82-4d99-828d-a73ee0ad42da", "value": "T11734AE017AE1C832C2975D718834C6E0593BFD625B77A24BFB44EB5F2E323A19662353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905678, "uuid": "b46c6e49-2301-499e-ba4e-27deff164edd", "value": "e77df1061a47040e786b91ac2fd00278", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905678, "uuid": "cf1b9375-315d-465f-87b0-26ebc45b88c7", "value": "3072:trVYy3atKYr63dRvLVF+bNNLsxkgaBChyPGer2b:1Yr6dFosigaweSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651905678, "uuid": "6936dda2-d493-4869-9c0e-e284399770bd", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651905678, "uuid": "4f41679a-c286-4574-bd2c-ac759a4e422e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905678, "uuid": "dd764d46-d660-43eb-99af-cdd583945cd9", "value": "BE2EB0D61EDE44A79352ADA5624BA6B3503A8D5412ADE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2b3aa9-cd99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651881804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881804, "uuid": "68c0f425-ffc9-46f2-a342-31ad9c490d1d", "comment": "Malware payload (Mirai)", "value": "8b0ce1fd1400dc1c3dbc0dc07210b889", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881804, "uuid": "045c2b06-abbc-4e26-8f49-f58305074dbf", "comment": "Malware payload (Mirai)", "value": "beeef2e2069c84e828f700952d00931184bbaf4b4c1e0f2ff3c3c4a05f647c27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881804, "uuid": "c740fead-260d-40b8-99f0-fcb23ad25009", "comment": "Malware payload (Mirai)", "value": "282ed36212f7d599893553ec60454a1e52f73889", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881804, "uuid": "df6b4e7c-6f12-4e85-9c88-1675a88cf589", "comment": "Malware payload (Mirai)", "value": "6d69c9339a25ac68a3fcf30227eeeae7da08dbaca8c08d1bb561cfc98efa1275de79df9f110c5e7bb78e03a6d19582ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881804, "uuid": "6a13b422-ebd7-41bf-81cf-cfed6cea060b", "value": "T15C438E71E0196DE4C19643B46834CF794F23DAC092A31EF75BA442B1948BEADF609FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881804, "uuid": "1069e9cb-d89f-435b-a933-dc29909d5e5c", "value": "1536:aaYU4kPfEHHJyVgpisUfweCGR6Pa10nA:atgc5UfweJ3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651881804, "uuid": "14b29cb4-146a-485c-ab81-427e6a9d18d2", "value": 59932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651881804, "uuid": "35556a51-9411-4ef2-b726-6cfe1c660ffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881804, "uuid": "d0c90cde-348f-41ef-8867-faf25140f7d1", "value": "8b0ce1fd1400dc1c3dbc0dc07210b889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6959838-cdb8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651895403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651895403, "uuid": "f5637649-0275-4491-ab0e-594bee9572f5", "comment": "Malware payload (Mirai)", "value": "5fd9be59ab3531eb78df2ddd4d3fe8a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651895403, "uuid": "78c1d335-3038-4163-b100-be4372b17ede", "comment": "Malware payload (Mirai)", "value": "bfcbac62bf0caae315ed564d253f031227a42396fca7726265cb6ed988f8b514", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651895403, "uuid": "9ac8c14c-282b-4d86-9c28-e596ceb47a93", "comment": "Malware payload (Mirai)", "value": "c314ba1520e2b4cf7c4234e02c1008dc7f2c4f28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651895403, "uuid": "0d68dc8f-43c5-48b0-a03b-2fa1ac96451d", "comment": "Malware payload (Mirai)", "value": "575a22717d5dafa32653fe74de0e391b16f5593c9d7b1fb0e2da1fff1894ee276c3ff2f72d06ac22507dd48e9e18a363", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651895403, "uuid": "fce57d23-ef40-458c-828f-4b03d7877e3d", "value": "T1C8D32B56BE82CF13C5C326F7FB9E468C371657A8E7EB3103DD256F61328658A0D2A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651895403, "uuid": "bc3856fd-93c6-4d2c-b7e5-9f6241434028", "value": "3072:/LwLYdy77WTpyMwwrVC0zIfGhMb22dT7YKzS:DwLYdc7ZMwwpCYIfeg2NKzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651895403, "uuid": "dac695c5-be63-433a-a51d-8e073d9c76c3", "value": 131032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651895403, "uuid": "bdb1e547-cd27-4a51-8725-1c826c76222d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651895403, "uuid": "a3190a95-bc17-4dde-8941-2c821acf9312", "value": "enemybotarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8403cf0-ce15-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651935429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935429, "uuid": "702e859c-2c3e-455d-b08b-44cf7b15e9e1", "comment": "Malware payload", "value": "a50fb75de858fcf4b78c7fe21a912fff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935429, "uuid": "632cd35d-c647-4cb4-a423-d11da54f3c6b", "comment": "Malware payload", "value": "c00579a5a8641a59cee9de14effa4ca2dd3f993a320eec55044110056d8e51d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935429, "uuid": "99600ba4-5ba9-47c9-9ca7-04e864d56014", "comment": "Malware payload", "value": "32afbfefdfdd2e44ee2af6757843e6fc8d28a154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935429, "uuid": "995a904c-de6a-4e76-99df-aef48e79b089", "comment": "Malware payload", "value": "f85426da3d9d89ee7b380bf11b7131fb456083cad1291c13815c0d2b77def2beb6af92499542e630e1102f72f4761f12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935429, "uuid": "2961763a-3271-4200-a5cf-501fb1fda9cb", "value": "T1144613EA2251331CD016C138D433BE18B2B6521E0EE6D5BE72EBB7E1779E825D941F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935429, "uuid": "29b5f282-b5a1-402e-93c3-c2bd5a532e5f", "value": "fa4a9fa6fe71ef395a4fa57617dc72fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935429, "uuid": "056ac13e-bb3a-4274-ac2a-5b86ed5426e2", "value": "98304:KMDKFDc3QNTq36jJF179rAj20zA7gWZ0VAGwKJ5jVnMAax:KE4A36dD9rAi0rWhKBMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651935429, "uuid": "7ae8dfe3-71ab-4fe8-abed-b7394d9384d9", "value": 5761024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651935429, "uuid": "1537af47-f125-4f06-b3f2-08492e221f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935429, "uuid": "3a8305d4-5eb0-4beb-8e7b-bc21b359f19e", "value": "minecraft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b359ed-ce01-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651926704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926704, "uuid": "bb7175c3-cac1-4e15-8746-7ad3dbf7e3c1", "comment": "Malware payload (Mirai)", "value": "15487632a2dbebe295a2bd26e7459985", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926704, "uuid": "24c2dccb-859c-4e3a-8fe1-66d12748250e", "comment": "Malware payload (Mirai)", "value": "c011a4025f5add85c3080b16ee727e292030f05933b3f3d73ee51f1fa4453901", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926704, "uuid": "7c726201-1a9e-433f-8a13-3f6117fd52d4", "comment": "Malware payload (Mirai)", "value": "763b71a83f6862afa9bde1040723ddf9ba6b48f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926704, "uuid": "9e0bc855-8460-4db4-bfcf-4fc2f356ec3b", "comment": "Malware payload (Mirai)", "value": "a39a9d03a8172a5e9a9b5f3c9320416773b8f1598297765fce5a51ef69014bf7c3c4cbcd05e8e4326a171f0617d194a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926704, "uuid": "229e69d0-ade8-448b-9e3c-3e9b3883e6a3", "value": "T147D2F19C962D08C5C5E890FC7D6B175A3DED0F42A142AC0819E9EEC7DCE316C8A1B7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926704, "uuid": "00bc373e-51eb-43bd-b491-bd41b3c76560", "value": "768:dIhDBeQo9r5jriFr/vNlXG4urC0pJQ3caEhR0klYmFga9JgGlzDpbuR1Jq:Qe79FniV/vNcC0pPhRBY+/VJu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651926704, "uuid": "3cba37ad-0098-4df0-9d99-39a1b170a472", "value": 30684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651926704, "uuid": "9968a51b-c891-4401-88a3-3b36f56adf53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926704, "uuid": "5914465f-d2c1-4d60-998c-e70a2350d8e4", "value": "15487632a2dbebe295a2bd26e7459985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa30ae38-ce47-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1651956773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651956773, "uuid": "56807564-77d1-46a7-bc16-8180ff2c5fbc", "comment": "Malware payload (Stop)", "value": "e427f8df904890eb454d06b9f5d96ace", "object_relation": "md5", "Tag": [ { "name": "enfp", "colour": "#FB6941", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651956773, "uuid": "8589cce0-7902-4b1c-9ad4-e80c6787ecf9", "comment": "Malware payload (Stop)", "value": "c1ae256c64e09895b3b81fc03d85390eb233363c5acfb547e3879f46f80d04a8", "object_relation": "sha256", "Tag": [ { "name": "enfp", "colour": "#FB6941", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651956773, "uuid": "380dbd6d-66f9-4bb1-8568-9f4a00b9430d", "comment": "Malware payload (Stop)", "value": "e4b983c1249b8753a186b62c2889419ab6c0117f", "object_relation": "sha1", "Tag": [ { "name": "enfp", "colour": "#FB6941", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651956773, "uuid": "93f11681-a47c-4784-b874-5c5574d4edad", "comment": "Malware payload (Stop)", "value": "5f87e488b625b77f04a6615d3dd47533ad402a441367613861f50124a86bc4ff42929dbe47796ecdb2a574cc5bc078fc", "object_relation": "sha3-384", "Tag": [ { "name": "enfp", "colour": "#FB6941", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651956773, "uuid": "af75f0f5-e9d0-4739-907e-2698beb801ca", "value": "T1E8F41200B2A5C473E0560AFA8456C6B52931FC71BF259AD777D13B2E1E21AE0CF3664B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651956773, "uuid": "4e7c8c12-5d08-4a19-b228-b80175fbc6a6", "value": "fadb03432906cb0b1086222508551a23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651956773, "uuid": "e3b54015-3ab8-4d6b-910b-01e456777a4f", "value": "12288:xgzgR1xvd+wlVC4/YOJtn7DX+JL8gycwAwF7sGC9rrvnwHf8FgYT2b1px8WrE9:xgzQzV+wzC7OJtnOL8gEAUBkm8ST7fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651956773, "uuid": "fb2da5d0-25c4-40a7-bd49-169f6f750973", "value": 731672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651956773, "uuid": "2310cc30-b575-408f-bfb8-52b54b218170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651956773, "uuid": "d8ce99f9-cab2-45b9-b469-d8651baded1f", "value": "new.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2dafc9-cdc8-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651902366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651902366, "uuid": "e779187b-c4a3-4a51-9d86-1c16922361c3", "comment": "Malware payload (RedLineStealer)", "value": "09e858d9e5314b4b22fc2f49d6e352ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651902366, "uuid": "e824013b-b345-4563-a005-8fa1f02dcd50", "comment": "Malware payload (RedLineStealer)", "value": "c2ab34d5d47e149931a9f3ef34efc97684609d08ca72dabdcc2c4c273008b83a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651902366, "uuid": "0e2cad06-7885-4b38-878d-5dc4ac94c437", "comment": "Malware payload (RedLineStealer)", "value": "edda75c2d3e957aeeb13f1c216cc4cd3243ff2a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651902366, "uuid": "88ffc396-23da-4803-9d00-16214d4194a5", "comment": "Malware payload (RedLineStealer)", "value": "9b42740b2ffbfc898992ea4979a80061b6622a6eb75827f488799749605e3251d272a98fb49c5248aeb5c547eb87cd90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651902366, "uuid": "8ec1f29d-01a2-4c5b-b0e8-cd28b76dc71b", "value": "T19BA35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC194E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651902366, "uuid": "d12ea212-3b59-4dd4-8186-b3fb1c365c29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651902366, "uuid": "bca7e94a-d0a2-412f-b7b3-efdf2f09c330", "value": "1536:5qs8bqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2EtmulgS6p8l:XOwiYj+zi0ZbYe1g0ujyzdQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651902366, "uuid": "2b1ea2cb-5f2c-428c-8065-e84ed6707334", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651902366, "uuid": "201dd2ab-062b-4448-b20a-638cc1ba0d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651902366, "uuid": "fdceb186-92b9-4267-9928-6934e5d4387c", "value": "09e858d9e5314b4b22fc2f49d6e352ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40daa19-cdcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651904364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904364, "uuid": "640c75e7-83c0-4128-9f0e-9a96c14d5802", "comment": "Malware payload (Gafgyt)", "value": "25a9ae7d96cc0441ce74799098c8f13a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904364, "uuid": "71cb2368-df86-4ecb-9ac6-caf30bfb4b4a", "comment": "Malware payload (Gafgyt)", "value": "c47738872d9ee6ba4c06e1d4cf7aa4071823e5ffea9654764fe068ce81f86906", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904364, "uuid": "0ce5eed9-17cd-4b1c-a9ac-fbf3861557c0", "comment": "Malware payload (Gafgyt)", "value": "d4809f67f18459992ed737876c1d0619196be1d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904364, "uuid": "ac0d0974-7c66-4f38-b4d5-1ce0b6f4869e", "comment": "Malware payload (Gafgyt)", "value": "d42136de1b8ede7717054e9d33b48428af3ef9fff524511642b2d2c7c52d8b221168d9b9a57b13e4662fd5f06fd2987e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904364, "uuid": "bf6aa5c7-9616-4934-9ed7-3086b5537cc9", "value": "T1BCA31744F8448767C3D327FAE78E439D77351A6457DB33116A39AEB42BC2B982E29130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904364, "uuid": "ee9befd3-e2fa-49fd-87f8-6051f6cd0d7e", "value": "3072:Plf1jKRi/VYf84YUk7XTRUmpEqQ45vVXY0X:vjdVC7YUk7qmpEqQ45vVXY0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904364, "uuid": "55fa441e-2f0e-4b14-9770-73b3b8268150", "value": 105111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904364, "uuid": "861e30df-9291-4642-a4d0-301bf30bbd21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904364, "uuid": "5028ddfa-3e54-4ce0-b5d4-77d9cf466283", "value": "25a9ae7d96cc0441ce74799098c8f13a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130b9ad0-cd99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651881787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881787, "uuid": "4dbb15b9-b0b8-4555-92b2-6876cdca7d7d", "comment": "Malware payload (Mirai)", "value": "d7a949c18a1dc2f80f92e52761f61026", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881787, "uuid": "e5f3c080-1a21-4855-b74f-9e6eb69ca421", "comment": "Malware payload (Mirai)", "value": "c516aa862935a694323d598ad7f25d7fe6d7727c8ced2b3416c53f5a888a1298", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881787, "uuid": "853dadae-3aa8-4368-a414-ece48e5237aa", "comment": "Malware payload (Mirai)", "value": "f554b26bedfd2c39c41a4927008aaafc1ed39411", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881787, "uuid": "01190dcf-78af-46b2-8f03-7a269e9cc833", "comment": "Malware payload (Mirai)", "value": "b789422440f1b0aa68cfb1dc8150b5face4fef11c9d180e396c40d1c688e93b05cc96c016efe3028aff7876271b4e4bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881787, "uuid": "52f31d66-9523-438b-8e96-f775e7464fcc", "value": "T1B2635B31BE722E13C0E1A07A11F34725B4B697CB31A8C61E7DB10E9ABF546506613EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881787, "uuid": "178e9782-2229-497e-8597-16ef0f467b75", "value": "1536:BOM1BhoPq/mZffxOi5hk4/4erG/Nwu+66fiV0Xs:LBC30s/M/+z2Is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651881787, "uuid": "42f47e15-fda3-45b6-82c6-eb25aec3e324", "value": 68584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651881787, "uuid": "250fc43a-eeb4-4dfd-a274-fd7e2cd7938e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881787, "uuid": "ef422e00-3be2-422a-a681-e31d57efabda", "value": "d7a949c18a1dc2f80f92e52761f61026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6011ea7c-cde0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651912410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912410, "uuid": "7983b191-7249-4d7a-bd9d-c3839947d87f", "comment": "Malware payload (Gafgyt)", "value": "7c4526ba7df99203a76cbb8c7ebaef1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912410, "uuid": "03c0d3af-910e-40d8-9f9a-84b04a78865a", "comment": "Malware payload (Gafgyt)", "value": "c7362729377b9fb164129a2dacae319efa38745f79dbd92b983e3965bbe53c2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912410, "uuid": "33472238-ab19-4677-86bf-e28d27389b86", "comment": "Malware payload (Gafgyt)", "value": "31a27d189845e96f8f585302f87bfe8471418911", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912410, "uuid": "41de5d6c-8d35-4c8a-9176-c2c5e1c21337", "comment": "Malware payload (Gafgyt)", "value": "924d73ae204770cbd05707e90fee0cfbc0034bb93c9a5ff04de853641be0c143cb816a114bb51b8a7b1c3c0e8ea61695", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912410, "uuid": "6f082a8a-4209-4097-8e8b-f12856e6c947", "value": "T18742E9567A81CF11D5C08239EB0E228937135B2CF2EB771737156B54A70797A0B7AC1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912410, "uuid": "40bdcfb2-0e55-4f6e-9065-ac2ab57df2b0", "value": "192:5cTncu5iH9uIf6rIRgdhHoz7glROjirDGPbV24/w1gmEZx4eO:5Encu5iH9u+Cg/kOji2w1gXx4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651912410, "uuid": "e85e4f8f-6201-4c55-b2e4-45f4e234e427", "value": 12604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651912410, "uuid": "802190bb-f7bf-4ff2-852b-507607cdb520", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912410, "uuid": "141793e5-a2a6-4da9-a45d-2bd44dda5c60", "value": "7c4526ba7df99203a76cbb8c7ebaef1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef663be-ce3f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651953238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953238, "uuid": "75818659-585a-4730-913d-ce4d8984407f", "comment": "Malware payload", "value": "f9b75e64ffb4537b381cdd9d77c135fa", "object_relation": "md5", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953238, "uuid": "8d9d776e-0bbd-473f-88e6-8f1905576c54", "comment": "Malware payload", "value": "c762fb4f8fae88d40bc478a859340213929c06e6d20ac61d5e443ce4f462b671", "object_relation": "sha256", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953238, "uuid": "84aca367-7fe5-4cd5-ae1c-04f6f3079c82", "comment": "Malware payload", "value": "0d9c89ed81120e540b16b72e91dd266b3625367c", "object_relation": "sha1", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651953238, "uuid": "45c884e4-aa85-43b6-be44-e97b24095420", "comment": "Malware payload", "value": "c888612b6444a54adca27c9bb22992615df4479cf0c49fbe585c409fbc6f4c3b481e5e13d34474739cd3fba5a602f058", "object_relation": "sha3-384", "Tag": [ { "name": "GonnaCope", "colour": "#6F874B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953238, "uuid": "b8ff58b4-80c2-4c48-aaf6-161bd4c59e1e", "value": "T1EA02A80462EA5DC1DAE5F37526837B00934C723D7514BD8C3DDBA242F8297A962F748A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953238, "uuid": "e680a7a4-6926-49fa-a1a0-bf8a5ddfd7c4", "value": "24:e7JVeuV40+Oyf2sVAFA8V1PtiTDsgxPxzOFoBQ3bEV2/oZriRApFGlFSja+Hs967:EVRgROnzSRPxUYcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651953238, "uuid": "764f4ec5-6630-470c-81e3-89fd7d7e8e1c", "value": 8669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651953238, "uuid": "60a1292c-e466-4d90-8240-4a3f46f91168", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651953238, "uuid": "142f96ed-8223-466f-b258-e54e0c58c478", "value": "G0nnaD00r.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767d6dbd-cdcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651905147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905147, "uuid": "966b315f-ce3b-4ef0-9f69-c8d099fc1644", "comment": "Malware payload (AgentTesla)", "value": "ab86774b80fe8123ef5a8e7a524c20a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905147, "uuid": "2cd345e6-00e0-49cd-b769-0270e8b278a7", "comment": "Malware payload (AgentTesla)", "value": "c7ed6f7f01ed4827ef75cfe29e6471b90de806f4cf42ba047a0942667db0d256", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905147, "uuid": "1d135844-6a2f-44b4-9e11-ad98bc9c8802", "comment": "Malware payload (AgentTesla)", "value": "47754a3001f1ee393e3a5561dc0aead24b118cd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905147, "uuid": "4bbc7954-fff7-4742-848c-0b276f08f2ca", "comment": "Malware payload (AgentTesla)", "value": "f0dd5f8823988c8297c5e6ba2bd460d093db07a315ed4a89b63878bc3be23acdae228163837adfba2188a8ce4c691694", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905147, "uuid": "719f05ef-bfd1-49bc-a4b0-ad4c09ec4c2f", "value": "T19BF42327A82CF77D577D2ECE2657149EEF480084DC584606B5762AEDA84EEC78E0C6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905147, "uuid": "ce18beeb-f721-4f38-9be6-57e95a525e55", "value": "12288:BWU9yGCcyTYt9a0DXtncF18uI8SCVe1noobEc80NBcRmY4s2IPyU80b:N9OrklO8CUlZbEn0/c74sf00b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651905147, "uuid": "4532ae05-0ede-4776-849a-954f85a35e68", "value": 748288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651905147, "uuid": "f333ba4c-330a-4a2c-b866-d757216ba490", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905147, "uuid": "65336bf7-b398-4dbb-b632-e920ccdb22a5", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6093276-ce01-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651926728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926728, "uuid": "51b3bb3a-dae5-4830-9a8f-d30b4f3cc63d", "comment": "Malware payload (Mirai)", "value": "22ff6e28247a29a4384ad01027edcd9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926728, "uuid": "36e9bda7-d25e-4e7f-b48f-d1b1466ea3d1", "comment": "Malware payload (Mirai)", "value": "c8ffec614934627e5fc621c6f6a6fd6965680e633e843cbe3a0b07f14a1d9eca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926728, "uuid": "8edb8fb2-4dcf-4570-9c88-0b20e81a7f02", "comment": "Malware payload (Mirai)", "value": "e17d57ba0fef1fc7978c011a82469d91688e10a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926728, "uuid": "8a0896a8-0508-4d56-a6be-3e91ce77f732", "comment": "Malware payload (Mirai)", "value": "ef73aec11fe19b4b248b5196e5454c6d15b5944629c9b8029455a6d36de556a25a608e35accae814ad854a4803bdce43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926728, "uuid": "4ff65f81-481e-4e37-9b9d-61427e221eaa", "value": "T164C2D0E2E0395E8ADB7FBEF00CD1D147BBB25FFDB6B4C9C616856701A6A15412922CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926728, "uuid": "a63b9fab-8ad2-4965-9ecf-3ed6cdd4300e", "value": "384:/CQA8MnPVMycBG/9rRKMQFEz7vhytIGb8mHy0Gs9h8LApIv+eM1HlM4uVcqgw05K:/CHRnCGKe7v8+cTN2+9A4uVcqgw09+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651926728, "uuid": "5ea102fd-45a2-46b7-ba28-c9692e077457", "value": 28136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651926728, "uuid": "8e403645-733d-4e12-b70f-fa92fd2c8541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926728, "uuid": "2542394a-2472-45d8-9cd3-927b94f2b379", "value": "22ff6e28247a29a4384ad01027edcd9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58e109f-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651904796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904796, "uuid": "1228e36f-70fb-45af-a183-d762129fbb10", "comment": "Malware payload", "value": "a9a844146a779247979051b596b0b77a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904796, "uuid": "461dd9a6-c977-4774-8b4c-56a37f05fa4e", "comment": "Malware payload", "value": "ce2fc1237bb3ebec866ed1599830a910e51df647b547821b07ecf752388466a0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904796, "uuid": "51cd6f4f-ace2-4395-a0b6-a9fe5df4f2db", "comment": "Malware payload", "value": "8360c0eb0488de53533338b6cb986b85f13273a1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904796, "uuid": "47fd2483-4291-455c-bea4-b8fe5a2518b5", "comment": "Malware payload", "value": "2d970f58f82962209cd8c202270295317109e3b41828fcb861fe784f8daef09f43f9503696342b602c1f2884c89d605b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904796, "uuid": "b4d647b6-c6b0-41a3-9c37-cc23ffcace71", "value": "T1C181B59D403EF18C2756D98A9FC8C8082CE94BFFA9B4163B723355825219AC5A21B5F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904796, "uuid": "fc914283-79b9-46aa-bb7e-926982fc0c9d", "value": "48:FRHY7u4Bes/J1/VnYGFqDdwh++gCkdmBe9b+gD/J1/n/ZGknktYUN5nE2q376/Wk:jy/G9TNx/EYRbXf9RIUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904796, "uuid": "f714650d-c863-4ceb-b485-cef1e35dfb13", "value": 3869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904796, "uuid": "1d630d85-d469-4098-9700-67aa4f599b55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904796, "uuid": "a499bc55-281c-487d-a8a9-5b71a0f7a9b1", "value": "VUDVLKJBTD_PAYMENT_COPY.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0446cf1a-cda8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651888205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888205, "uuid": "492d381f-b0c2-4aec-9336-16e0bcde742f", "comment": "Malware payload (Mirai)", "value": "5b5a42cdfe7b8cd4ebf31169389c9477", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888205, "uuid": "316be088-0ad8-4bc2-ad91-db3b2ef6357a", "comment": "Malware payload (Mirai)", "value": "ce5b20267d4403c5b61ae7b7ddc07ebccf87fad99e5a04963ddbed170ba29a86", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888205, "uuid": "9811a072-9001-4073-bf2d-1a1d4bb9b763", "comment": "Malware payload (Mirai)", "value": "b5e13b16a1b870589ecb04f203ae56643a039cf3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888205, "uuid": "3166c8ec-3517-45e2-932b-852e4ac3a44b", "comment": "Malware payload (Mirai)", "value": "322b113a4e370c882adce23a3e00fbcb03cd79cb23cd256c1d94b0acf3c3d31d16cea4fc3b8247a20ed3301e4f7d85bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888205, "uuid": "6ff87eae-07cc-4605-b039-133835fe5738", "value": "T1CFD34C57AA92CF12C1C325BAFF9E818933135BB9E3DE3113DD246F6127865DA0D2B112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888205, "uuid": "bc938abd-908e-4cbb-bd85-982829de65fc", "value": "3072:LYEpsSlzc0QktLW3HQMaFvPg73n+hF/L7+Me:LYKs8XtLWX9alPmOhgMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651888205, "uuid": "1557fd49-4042-4832-a8da-5f0b5cadfd94", "value": 137304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651888205, "uuid": "9de73c0d-15dd-4e7a-8b23-f7a8337869c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888205, "uuid": "85921b82-8ebd-4624-b6d1-2b389ed8b34e", "value": "enemybotarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99372329-ce0c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651931404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931404, "uuid": "63fc5251-8552-4968-89cf-513db8dc5352", "comment": "Malware payload (Mirai)", "value": "4d60136ce5fa32af551c05d25e2a5776", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931404, "uuid": "f2083d3f-d36a-461c-a177-6610a63b5c85", "comment": "Malware payload (Mirai)", "value": "cf3a89843ff33559c91401e377e44bdbfc839231df97fabec7c93f8862d08f4b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931404, "uuid": "d68b38a8-ddac-4e22-ba9e-85a3219294b4", "comment": "Malware payload (Mirai)", "value": "da96d6c2d661287e97d81230e53c50283e7dfc9c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651931404, "uuid": "d15b3b34-5c6f-4983-bdd3-86da08d7163d", "comment": "Malware payload (Mirai)", "value": "0c4480171ea9766b1c2dbf9b910812fdd12015bc15e0d573f8caf5a1b83e6ef31b7de64d8b51c4e60484018d10a52654", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931404, "uuid": "2db76cc9-579f-4d14-a62e-95f3165427eb", "value": "T119F2F13B67956AA6CDD0113176FE5940325273D6769FF118BB2085FCF6D00E39AB8882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931404, "uuid": "7bf21f27-9139-4882-a8f9-1c659d056bfc", "value": "768:yVr+3tefFdIwJi41i24UWqVbEPU3kLZLO9qoK5bAQ3Ut:yVagf9Jiu94ULRUbZLO4mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651931404, "uuid": "118dca9e-21f9-47f0-ab2d-e57d6de7cc41", "value": 35144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651931404, "uuid": "10ad6af8-f729-441e-adf2-5fe7f78a7726", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651931404, "uuid": "1acec0e0-2321-430c-906c-f52030c10d27", "value": "VIANET.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fc16b9-cdcc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651904050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904050, "uuid": "f037b294-9de9-44ab-8ddb-eab6ca895e7f", "comment": "Malware payload (Formbook)", "value": "0264c7dd5c382dde4039f80577a11aed", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904050, "uuid": "064be7d1-e8c7-4e74-8092-44f9260635b2", "comment": "Malware payload (Formbook)", "value": "cf5ba51ee213d5950185415523f87403ecbd6b1715a3cb9dea04dbadce5eaf04", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904050, "uuid": "7222d23e-6a64-40cd-8416-c96e36c80ac4", "comment": "Malware payload (Formbook)", "value": "2a1dfbb3f35273749a82adbc340069c33994a0d6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904050, "uuid": "aa734703-6023-4cae-bd4c-a566718653b1", "comment": "Malware payload (Formbook)", "value": "c34cc95b9df7a9fffc0a72ac22efd63164a7b69bc5e713697dc854627b54a94922ccd39693c6371e48aa02644bba2340", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904050, "uuid": "d0e63f25-9787-4492-a1ab-b4937a727a41", "value": "T116942302E29C5CE42D1B927249A572F5E7E1AE61937024C59D4336FD44CEA27B3E90CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904050, "uuid": "df6f2224-64b8-4ddd-832a-dc63c8ba9207", "value": "12288:273DCyVSTj8n0JDVJ+m/pFfJlOMNCJkMcuSQ:E3dUgnMf3/plOi1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904050, "uuid": "6f49148a-88b2-4e46-a31d-d9778fb8a43c", "value": 427938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904050, "uuid": "790a1d8e-71ea-4731-a049-2ea07342cb21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904050, "uuid": "80e76ba3-e23a-4042-b32f-31e1350ab508", "value": "attached booking %0D%0A%09price list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a646c0ff-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651904797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904797, "uuid": "e6f21bc7-eba6-46f6-8b06-aa1daf9127c3", "comment": "Malware payload", "value": "a1031bbb3ba801bdfe99429e0fcb1c18", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904797, "uuid": "38b371c2-e828-408c-b0c1-e77a5d696d2a", "comment": "Malware payload", "value": "d1d697329508e29b711aa1c83aaa4bc900c00059ccb71cef935e0bf6dae3f5e3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904797, "uuid": "8d088be0-3ba2-41ac-8e2d-176314a13476", "comment": "Malware payload", "value": "adfed282b2b153d57644240a6e4092be27dfdde8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904797, "uuid": "6e2f9c23-a8ed-43d3-8f60-39f1d25698e5", "comment": "Malware payload", "value": "74e7db907d2c6962c645a96492703338db52e818a217ddc2f63850a9f156efe5c6c18cc6a393afb64fe5896e92a18a25", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904797, "uuid": "0d92206f-7ce4-41af-862d-e5d7a37fe217", "value": "T1E981FE0C657DF15C3B50E90A8FC9D80C6C8913EFE9B4273B397B00665258AC6A55B2F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904797, "uuid": "64197188-dcfd-4b54-84fd-9fb7350731a0", "value": "48:jJwTsfnMInXE1Ilt72V++gCyTsfVpgamM0mHeW1hdmaQUNDeI8lta925hHArRois:juaU0VhI0CYmGw8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904797, "uuid": "5f05a42f-7010-49ad-9510-87a8007db89b", "value": 3841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904797, "uuid": "96c825fa-bba0-42ae-9708-c396e2e75d0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904797, "uuid": "80a1b618-473b-43d3-a3a2-20f32739c620", "value": "YBCZJVVOFILQ_PAYMENT_COPY.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd94ff19-ce29-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651943947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943947, "uuid": "e212aa15-4d61-435b-8977-c9a7a039c3ac", "comment": "Malware payload (AgentTesla)", "value": "2c0a3372a2f9e34e28b064d607e24a33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943947, "uuid": "cf1f4c2c-abd7-410d-95c6-f4721ac588da", "comment": "Malware payload (AgentTesla)", "value": "d2f664aa7e1c825e57e359a03c8fe92c703559dec4c95fffbb3ff804670dddf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943947, "uuid": "3b06f124-d294-4c5e-97fc-84ffda565436", "comment": "Malware payload (AgentTesla)", "value": "240fa7b1d93873a5f7d79d371a6e47abce05b3db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943947, "uuid": "bde22c31-6bac-4625-8acf-79f5a67450a7", "comment": "Malware payload (AgentTesla)", "value": "e84c2070bd3f1a9cc7e7fd92ded165b015a60437f5d033e54df77b0fe6fed6bac3c26a4674ee7f67b84db0783bcaac2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943947, "uuid": "65ce17e9-e6f6-4911-a9a9-51709665c135", "value": "T16D05BE58351C799EC867C8718A968C74A7A328AF671B5133919379BFB90CB47CF130B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943947, "uuid": "63968283-2e7a-407f-badd-3498e8e4a656", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943947, "uuid": "2bbba495-8392-4387-b242-f47a9cf0b0a7", "value": "12288:8LOBQVZ50bWhQdqjgPax/qTubQp1FC5/7Zta9atKW6gyG3ABZgKIXODe9quWsxKN:8YQTO6qBq/pbQpzg/uOKWHABZgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651943947, "uuid": "45809a59-1050-40b4-a721-685f9dcbfce4", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651943947, "uuid": "35948cb2-9b66-4f5c-9648-3f00b62f121c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943947, "uuid": "c911a2b3-e014-45fe-a29d-bc636670286f", "value": "VEL-P01225013B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0e201c-ce01-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651926690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926690, "uuid": "45fa9734-441b-4046-a265-7c191d0a69af", "comment": "Malware payload (Mirai)", "value": "27e7a984b86d184cced079fc2fb8ab55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926690, "uuid": "337b976b-2600-4b46-a196-7afb49479e57", "comment": "Malware payload (Mirai)", "value": "d2fa667e06941974d2830824038ab49fb781119c1d5592d2b059e9791dea5165", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926690, "uuid": "b4e45f1b-ab92-4800-ae24-09c50160e6a3", "comment": "Malware payload (Mirai)", "value": "a3d5ee67fc2975cc97cc09dd5e54eaeddf0a4c93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651926690, "uuid": "c85608aa-4147-4bc0-9af3-4849ad50eb51", "comment": "Malware payload (Mirai)", "value": "917ac62eb2b088fc232c3ae1f9661e7c9b5a33c5af4e1878f04b822376b2974d0397e6932216eaac90beef6c83ceaca3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926690, "uuid": "7496f3e5-15f6-496b-9350-787504e8e1d6", "value": "T11D635CE5B8019F7CF44BD6B685220A09B522A3454F930F27F367FC976EF21548A57C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926690, "uuid": "7b7a499d-6244-4277-8f14-059c968e566d", "value": "1536:DsT5VI4vIS2ugw2j3upL3+KS9hdbobmrz0U8sc7u:Da1gbupL3NsMmo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651926690, "uuid": "0cbcfca0-f8d0-4a28-bbcb-5c2f52a72ecc", "value": 72392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651926690, "uuid": "c8c12140-7645-46b2-aed8-6315258e756c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651926690, "uuid": "a36425f9-463f-45ca-b638-22dedad6bba2", "value": "27e7a984b86d184cced079fc2fb8ab55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c868aea4-cdd5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651907861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651907861, "uuid": "839b53f2-bba5-48ff-8923-01d06711dd79", "comment": "Malware payload (Formbook)", "value": "a93568fb679e22a78c60817e0fbcd103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651907861, "uuid": "b473f395-e0f9-4776-a885-b1a948bdf388", "comment": "Malware payload (Formbook)", "value": "d4228fb80428de5db9495b19ed4a9366bd3120ba5889eecd82f4a0b1d827f81a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651907861, "uuid": "acb7d058-883d-484b-a0fd-55c05d5c37cb", "comment": "Malware payload (Formbook)", "value": "06b29718e4a38bbd00ef320a6937c860faa0226a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651907861, "uuid": "3b779418-5381-4e36-b13c-6a8547ec7545", "comment": "Malware payload (Formbook)", "value": "0c38d911b22ff036812c452bb1152f69ead7398c3829cb256686b4f0aa427eaeeff762ccd60b984e4abb9cc7f6c022b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651907861, "uuid": "b30e88bd-c469-4585-ab95-3d6ff9fa156d", "value": "T16E03F51AA892561DC5D47BF868B1A19766367CE10134C18FECF97F29ED32223DCC126D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651907861, "uuid": "4e5a78cb-dc3b-4f2b-9cb1-e553e99b2430", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651907861, "uuid": "f1a74069-9d51-4aec-a921-40b840788761", "value": "384:+QtCZE3WRtDSwnQXulaiAMwCKFH2S3dd0hUADkaro:+LthxlmMwCK/3deVDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651907861, "uuid": "fc31ad96-0a91-4609-aa24-d5a56de99391", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651907861, "uuid": "d9650a36-9775-44bd-b9f4-0592383c22e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651907861, "uuid": "dc6da74e-bbbf-47a9-9556-2464e1aa9666", "value": "Invoice_ME_VAT_4_21-2022-133.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafc54d1-ce14-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651935004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935004, "uuid": "1e6f798f-628c-41f4-bed2-9743eeb63450", "comment": "Malware payload (Mirai)", "value": "ced11372942fc1695af5591ad96b5d2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935004, "uuid": "05c9e3c7-c894-4125-b336-ab57d8c96e7c", "comment": "Malware payload (Mirai)", "value": "d5bf1c37832d7c918b9a285531f1a02590b966d68b4c3be96ef751d3caa7f32d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935004, "uuid": "4174cfc9-ba19-41a4-8449-9b98e610f86a", "comment": "Malware payload (Mirai)", "value": "0bdc67538b7f4979464076f811c58cd1f116c449", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935004, "uuid": "8b897280-810b-4829-943f-c4848d8309d9", "comment": "Malware payload (Mirai)", "value": "32643cecfacdbefc368d79bca3196952d54f4b14176ef9aaadc6169643227600aeb2d184b6c5f9921da56c0e06cb213e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935004, "uuid": "a3e480f5-ce40-4172-8d57-34cbd6aeb334", "value": "T1EFD33A46FA408A13C4C617B6FAAF41493322DB55E3DB73068D185FF43F86A9E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935004, "uuid": "0ef84ecf-3c0c-4834-adcd-00b71c75a1a5", "value": "3072:OAfRuiVUkjSv4d+TfJvWaFdCAnhsJhL+HeBg4xKql2TVvHbhj6b5M/9FLW3:df0iVUkjSv4d+TfJvHFdCAnhc+sg4xKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651935004, "uuid": "35d6c390-3c0f-4028-9b10-2e2f62a31860", "value": 136657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651935004, "uuid": "e85681b2-455b-4003-9fba-00bf86419838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935004, "uuid": "385b0473-6349-4ba8-8140-fdd2c75f21ac", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03515d97-cda8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651888203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888203, "uuid": "58dfca83-91e7-4de7-92c8-c57c24cd8d65", "comment": "Malware payload (Mirai)", "value": "0e30d3ac3590d239eebd8f7ad3ef2f08", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888203, "uuid": "29510c5e-9cbd-4284-8912-bd3cba64ac0d", "comment": "Malware payload (Mirai)", "value": "d694d9b8b61a7e6826bc40d7acb17a3d0c35fbc7d4654bc07f16c6c9ce830ba5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888203, "uuid": "36f232d2-a506-4eb7-9f91-6064763b1a75", "comment": "Malware payload (Mirai)", "value": "8356e8e31e776ccf258dd98403b1903bc45ea39d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651888203, "uuid": "bb72d457-e93d-496e-80f6-8c18cdd825ea", "comment": "Malware payload (Mirai)", "value": "362feaf2a527a6d2ca52064f552a557cbc69788a16a21a66f719d0578ed74dd8de29cde3017b1ce7d198cb8596cd415b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888203, "uuid": "4eea921f-7d5b-4197-9c83-a7748d1c8656", "value": "T179B35CC6AB42DEB3D45326F112B7AB718D71FC7A1823E442FB6D2EB099241C1DA1536C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888203, "uuid": "16a20b9d-3070-49b9-a869-8888f2bd0d0f", "value": "1536:f2Ow5Itk/wyU1aAaYvmpIxv3lNuxcLE1xIKoW0bjfQiUCUnOZRY+aQLd8UEOzcjR:Oj2tkBseyfocLE1mbrUOZzaQpA0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651888203, "uuid": "cf449107-d338-4787-9702-e4406e2fd999", "value": 114668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651888203, "uuid": "3e79750e-50cc-4ce6-a0da-08e8164be341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651888203, "uuid": "2b6ce570-8b83-45ec-b9ff-7fd4962cd060", "value": "enemybotx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfb5928-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1651904730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904730, "uuid": "4e181f68-1da4-44cf-ab20-6c608b8a281d", "comment": "Malware payload (AsyncRAT)", "value": "6c47d1638d8cfee9fff6a6c62c5e258f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904730, "uuid": "c943b9a2-6ed1-4b73-8565-c065b76844ca", "comment": "Malware payload (AsyncRAT)", "value": "d815762e218cb7c08e94f4e51d0a26f5ad10b0a38724462d2c53d3760cb51e19", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904730, "uuid": "de6d4132-ec83-496f-a1c3-a634600e4f62", "comment": "Malware payload (AsyncRAT)", "value": "f6e6e64dab674e53bf373f8045080f2008d56d9f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904730, "uuid": "48b0861f-d9b5-4897-992a-e69137857131", "comment": "Malware payload (AsyncRAT)", "value": "bf2714ff46d6f9aecfe8d3aa349ea31166b4a2b8fb2c6c00ca5a34b07c32ffdf98d3874e94dc6f64efa927919b1b9e08", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904730, "uuid": "80097f2c-5f80-4f18-bfc4-8f11c033cd67", "value": "T1F224123A79C5A075D4DB36353B390A0DAA38FD95184DA2DF2007F3A9DBF8015CC64A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904730, "uuid": "2d5e1f08-441d-4ed2-b0ec-d1685dce022e", "value": "6144:nXT4QF3FC/lBXDmTKrh1LLU23Qw+54YDYjZk/Ahk1:nNF3KlN3rh1U2AwUYdIAhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904730, "uuid": "26170c95-80d2-4dde-aef4-1ad7ed53752c", "value": 211832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904730, "uuid": "66520522-c8db-4be1-9e65-e82ce6a96d80", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904730, "uuid": "793bc7b8-3e58-41d9-b7a8-ce2253cae370", "value": "Swift Potvrda OUT210073640.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59844fe6-cdda-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651909823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909823, "uuid": "2f0d6efb-ca4e-4997-82a9-7d6b13d4088a", "comment": "Malware payload (Mirai)", "value": "32350b3658a9156e1a094c41e137ffec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909823, "uuid": "6b920810-710f-40c4-bff9-dd924dc7d8b3", "comment": "Malware payload (Mirai)", "value": "d8e4d1825590066e2fbe9b2db2bd4762e0aa4fed839ba7eb069ba9f486d3a6a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909823, "uuid": "da64acf6-be98-404f-b970-aca8d1bb9276", "comment": "Malware payload (Mirai)", "value": "8467c0fae6faf6c37abd95d2b4048b1df5605606", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909823, "uuid": "5ec5ad12-1dc2-4471-956b-1098d0af94be", "comment": "Malware payload (Mirai)", "value": "d4566fbf2ef65f5782b9d085ea0f41c6a2d336985bbf563fcc2b2b91a474b758aa4eba2dcb95883d9be8ce9d5c1fa66c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909823, "uuid": "6d33a282-ee9f-423b-97bd-a10709454e07", "value": "T1F8F34C46EA418B13C1D71776FA9F414A33229794E3DB73068D286BF43F87A5E0E17A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909823, "uuid": "2e8b9e2c-ea34-4168-8f95-c16d35099d86", "value": "3072:JrE0wQVv7hMM+tKXaRGLKW3Sfz8azYEBPFsleM/9gDM:JrMQViZsXaRGLKWCfXDBPFsQM/9gDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651909823, "uuid": "390f1157-7553-410b-98c4-d282cdc8a1ce", "value": 165345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651909823, "uuid": "12959b57-7990-4d26-bb47-bf86dad88c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909823, "uuid": "d0c6b8e4-b813-41e9-884a-94daaaddef1a", "value": ".arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db8150b-cde0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651912380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912380, "uuid": "b3e10845-044e-456d-8795-30bd52e2c991", "comment": "Malware payload (Gafgyt)", "value": "8f6325f24217eee9778acdb5dad37ef7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912380, "uuid": "0d1177df-d87b-49d2-9f5e-eff802392f25", "comment": "Malware payload (Gafgyt)", "value": "db6a488463f773427b0e0cd0b735cf12192e746e404842e618fffd352eef32f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912380, "uuid": "82993a39-c941-4272-a347-436c64cf63b8", "comment": "Malware payload (Gafgyt)", "value": "d0e93294153566353ce895d48d661bb44d84b666", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651912380, "uuid": "1a75b1ec-f936-4b67-8c6d-a7545f13fa2f", "comment": "Malware payload (Gafgyt)", "value": "36862406013527f3abaef0dfae304580e0d6fafd935625d620e741f74a777e3ddff5bf1b312edb4efc1ce685daf3b202", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912380, "uuid": "7a1d73d0-fe90-4309-82a3-e48f0b9a1c32", "value": "T1DF5294E2B54AEDBDF80EE33E84564502B172B68A11431B366377793BDDB72841472E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912380, "uuid": "9db3fb1b-d411-4461-8fd6-ab4fe4019704", "value": "192:bbjY3SQpu7mkmp18kb8MvkG7FOpgykBDoWG11/A9ywAwInz+LkwE4:rqHb1homkGBLN+8HAhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651912380, "uuid": "785d3842-3c1e-409c-adc6-1a633744b836", "value": 13456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651912380, "uuid": "2f1a9952-b97f-4015-8c0c-f916567f2ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651912380, "uuid": "0f6318e5-d97e-4b30-81e2-57429d5384c1", "value": "8f6325f24217eee9778acdb5dad37ef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e6e78a-ce52-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651961517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961517, "uuid": "845006f0-337c-4b25-94cc-6789b6980fc3", "comment": "Malware payload (Mirai)", "value": "47d794ae914b7fe349abf77dd0ec4ab3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961517, "uuid": "65e008cc-a641-4083-97a7-0bdc14aa4516", "comment": "Malware payload (Mirai)", "value": "dbbcf2a50a623de336f14b8c0a4313a0614083c7022546e944f3e7f6e4e0a079", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961517, "uuid": "5d2b4ab6-6f58-4b4b-9d2e-e6d8eb3b0615", "comment": "Malware payload (Mirai)", "value": "5fceba8a59a0b292a1b67ee55edcad7230c98765", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961517, "uuid": "7b36d948-fb99-4b32-af9f-f36edc2fc8ed", "comment": "Malware payload (Mirai)", "value": "17b334ebeb9b6c27428da648e9d55b0d41ce4552b77502d856d9b4967c478608afc2abf1907e1ff2346831dcd2f498ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961517, "uuid": "c6239da5-3f57-4e27-8c7d-7d71567bf470", "value": "T18C23F26DDE9A1913CA8FACB25C9D0AD1E95831813370065163B48CC87AEB7D3F78D4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961517, "uuid": "cec088f7-9ff0-46c1-83d5-2da28971f6cb", "value": "768:2btr9kK23TPisaLwrzaDjURMatlJPf9EJbzj4J0UUQm3/v47SEIyeR7lRWS:2pr9kK2ms3CMuatlBVEBv4J07PaSEIyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651961517, "uuid": "4c44502f-5b6d-4a10-8e72-c5716f173fe4", "value": 46284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651961517, "uuid": "fb3c684d-66c3-4536-a49f-7f0a2cd3a251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961517, "uuid": "465dde6e-0d08-454c-8eaa-50a197948152", "value": "47d794ae914b7fe349abf77dd0ec4ab3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0267f20-ce52-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651961481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961481, "uuid": "f55f673b-7bda-4cb4-a142-9e1968c60c82", "comment": "Malware payload (Mirai)", "value": "31f7147ae58ddb6c91cb55aaf5093419", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961481, "uuid": "2267d9e0-a253-4d67-9420-88f0bc32a06e", "comment": "Malware payload (Mirai)", "value": "dbcf5cf47eba5ab9791b6726a772980d4eb0efcbc86d4d369834ee727a431445", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961481, "uuid": "536c1fcd-9552-49ac-bcbd-7f50e88f775b", "comment": "Malware payload (Mirai)", "value": "77a977d8ac8f741302c19008aa06ea416c45b1c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961481, "uuid": "16418f67-6e25-4678-b8fc-3d659a28a762", "comment": "Malware payload (Mirai)", "value": "fbd9e947137ff60064643994b6da7dfebe352681aedb7c0ee6187b797ad2136e0b304a7514748be26c5d0cfbd3c582da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961481, "uuid": "1fcab8b6-3378-4ddc-bb7c-b18f904e8d29", "value": "T11913F274E8856D80EB3D3EFA9D40FFACB7525B2A405E8B887845D78212318368717DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961481, "uuid": "497846f1-fbdc-437d-b316-479b798d1052", "value": "768:IF6gT1jF4WO3sB/CVxmML2IGVSeyLm8/THB+0JBUfyx5JdkNRRf5un3ta6L+a4u8:IFPFFIl3CSja8rHw0Hh3I/xuka4u+qgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651961481, "uuid": "9333d380-3b64-43dc-a73b-c3f4c41ec090", "value": 42332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651961481, "uuid": "c9d6c12e-9f93-4e04-b29d-52449eb20b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961481, "uuid": "fc0e7b2b-79bf-4e46-adae-22ed9b31ff70", "value": "31f7147ae58ddb6c91cb55aaf5093419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fa55f1-ce1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651938600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938600, "uuid": "102d85fa-228b-4752-905f-9ebf897fb542", "comment": "Malware payload (Mirai)", "value": "929a300a32ff0b99b720313864fd8291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938600, "uuid": "691708e0-3967-42e7-b1c8-2de7e24a0896", "comment": "Malware payload (Mirai)", "value": "dc60be6959c1682f537ffa158ec6643f6e2181bf6c895c4256ad2692592c2e06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938600, "uuid": "a0f30b42-a70c-4f37-89f5-a33d9ee08fef", "comment": "Malware payload (Mirai)", "value": "bb06c2c634ca0cd92f30a34669f13692df21a988", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938600, "uuid": "faf139c0-9c01-4307-9574-22922958c32b", "comment": "Malware payload (Mirai)", "value": "01d05c29d8b24f552802c2b5e2b943e2bfc733831d7802dae52f0f6db2e33412f93eaa2d05bf9c2ae3245ab8d21bad4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938600, "uuid": "4fe520ff-e5f6-4497-8c39-86fc38401543", "value": "T1AF834BD7F800DEBDF849D73A8553490AB230A3A00A921B3277137D67FD761E45827E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938600, "uuid": "3d57fba7-5102-4c00-8afe-190ca656cfb6", "value": "1536:bQuV35QnlsmcJJs+4Eam8+Bmp8tBq5TEZYyKI111Z8YjL3uwKfDfj:bXVWnOmcnBo+Yyq5TEZYyKI1rZZcbfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651938600, "uuid": "9249d319-0a39-48bb-9963-8ef0b88c16cf", "value": 82828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651938600, "uuid": "d47fd1a4-b1a8-4dcf-9aa3-5c6003d1799e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938600, "uuid": "8396f281-1629-486c-8719-a38dff64ed04", "value": "929a300a32ff0b99b720313864fd8291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3928e6-ce52-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651961498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961498, "uuid": "4026d93f-0b21-4dbf-8ecc-e7c98bf4740f", "comment": "Malware payload (Mirai)", "value": "316ba178ba7e23694ea9ba4f7bc7cce5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961498, "uuid": "966e4550-f99a-4df1-8ab0-b7afcea33da8", "comment": "Malware payload (Mirai)", "value": "dc8a17a0fd9f5ad7cc4a41300097f32517dc0fc2ef634958fa3f13fe10e4d0ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961498, "uuid": "7a1a0a9a-e3c2-4cc8-a4bd-15901dc29246", "comment": "Malware payload (Mirai)", "value": "6690365dfcd47cc8ff13a6874d18152550463268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651961498, "uuid": "81b3821a-2e99-43ed-8920-d177d54e4e1f", "comment": "Malware payload (Mirai)", "value": "bd0030569f74690d277213f574fca3c66f3419a3ce8e617cd06caeb2fb51b21fbf377aca6294f8b48f3428cca54d7dbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961498, "uuid": "532f0ea6-bcea-4957-9e90-92c43680e5e0", "value": "T11813F16D0EC8C0D7CA11D1B93C561BA02B709EA1D381CA287163E05B6F428A63AE57F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961498, "uuid": "1c89d1a2-f5d9-4129-8a5d-c5f7aaf684ca", "value": "768:5HRrpatUi0e64R94A6MDK7VtT5sUvIEnNDWj0LzXRZCcxOhrBw5dd/wV5rY+tDnY:5pstWHc94AbGptfm0LzXRZJxOhrBw5dT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651961498, "uuid": "4fa4477d-5325-4016-bbf5-a4e514e950bb", "value": 45552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651961498, "uuid": "8877d372-20b5-4809-949c-b5bd7fd3cad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651961498, "uuid": "dff7196b-5b83-46f4-b5da-018f5fffae58", "value": "316ba178ba7e23694ea9ba4f7bc7cce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9956433-cdd2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1651906628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651906628, "uuid": "3af2c0c4-da80-4a6c-8ca2-dd5c95c7487e", "comment": "Malware payload (AsyncRAT)", "value": "133ac94671b822dea493ba2c0786a797", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651906628, "uuid": "5d959a44-409f-45f7-b70d-9f8e7645ec93", "comment": "Malware payload (AsyncRAT)", "value": "dcc2b7fb9992cb2c8ebc4c833161602ec430f3647d87fa7beaad069451b6c9d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651906628, "uuid": "ac21d63f-c2e9-49a0-9ec7-b5b6c17bd40f", "comment": "Malware payload (AsyncRAT)", "value": "3a098bf4049adad1f84edc0adb5e0de90ed53b5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651906628, "uuid": "f3060355-73d5-4c14-a00f-db3d11a1b4f4", "comment": "Malware payload (AsyncRAT)", "value": "be22c40dcab367233d022972688e2dac18b41db6e49c0cf9a9ba86c9270449a4965cc6d08027d45fc20c6002340a0ca9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651906628, "uuid": "4879615c-713b-416e-85bd-8c25f01ab893", "value": "T112849D86A398A955D2BF3775F95C7024C7B1A0C766B7D78F8880A1E533763812BC06E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651906628, "uuid": "a08df8be-af3f-469a-96dd-87f16fd83228", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651906628, "uuid": "d5a71cc0-fb43-4660-96a8-3c4f0da95cb3", "value": "6144:ttd0Rv0gxiX8kmp0K6zEjsnwa0yF7Gm2A/gD6tU2xjktAD7uV/thHVD:ttgJbkc6wjJy5RoDW5xjktAD7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651906628, "uuid": "65f43ceb-8c36-46ba-ac5e-ce614d925d10", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651906628, "uuid": "ffe6e211-83dd-450d-ae12-4217cb4530cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651906628, "uuid": "9a5ec6ec-34b5-42b7-b0ff-8c326cf46d35", "value": "133ac94671b822dea493ba2c0786a797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cd6d9a-ce1e-11ec-8e58-42010a9c0032", "comment": "Malware payload (OskiStealer)", "timestamp": 1651938999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938999, "uuid": "6bf8321d-c9e2-41e9-9b95-bd83fd862b46", "comment": "Malware payload (OskiStealer)", "value": "ce8100a15c7a41c3acabcae04d15e15a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938999, "uuid": "2452aa38-dd15-47ec-8111-99b81cb693a5", "comment": "Malware payload (OskiStealer)", "value": "dde4d506651aaeecbf2757f36c6b1d4dbbe4da1032de416e8739d808c06a5645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938999, "uuid": "0061d663-5bbf-474c-b5eb-945100f7f8c7", "comment": "Malware payload (OskiStealer)", "value": "7cd87edb337dba34c5a5f6623049ad61d7a719db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938999, "uuid": "07964066-2572-4721-987d-fe7951aecc29", "comment": "Malware payload (OskiStealer)", "value": "bd9757bab45784e83b092486111c77ab638852ee4246c47743b064d1edf41b7f7b717257c676dd20389c3630922db863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938999, "uuid": "50b19039-5e86-4885-aeee-20e9804a9a9b", "value": "T15B2523027638ADF9C5F82B7922FE68041BB1D7C31855F59C6BEC114A7222B831913B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938999, "uuid": "d157bab7-37bb-4773-b161-abe636f6b8a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938999, "uuid": "abe3f86c-c4af-4baf-8640-0a5f9bfb4e67", "value": "24576:kKvK23AOP1RFjNFz3G6mAxeBrTBkugRm0p:kKNFP3rPHQVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651938999, "uuid": "c6960bf8-2158-4555-a6da-52fc27c9996b", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651938999, "uuid": "48070b79-d69c-4bda-ac8b-c690d9b4484b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938999, "uuid": "03200a17-1620-4863-b4a4-47c181ccb066", "value": "PO#1809027.eml.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c884a55-cdcd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1651904298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904298, "uuid": "90897d8a-0d4e-4e0c-b6a3-0aacaf700ae0", "comment": "Malware payload (Gafgyt)", "value": "7c052794ba3e7837a8d5e6b1257cd109", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904298, "uuid": "f91ae503-5ed4-4ce7-b169-35e1fe07fbce", "comment": "Malware payload (Gafgyt)", "value": "dec711e4b3a69199606fe3d9adb6fea5dd28202b0e9ace13df1133d2ec25f819", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904298, "uuid": "295dcd25-081a-4379-b7f3-9bc0c3375f73", "comment": "Malware payload (Gafgyt)", "value": "3f165200c4e76e6979115bd747d349723ae039d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904298, "uuid": "3fdd5b4a-1729-4f80-afde-8b17bd4343c1", "comment": "Malware payload (Gafgyt)", "value": "93ffaf91655529199a3f4368c60f9bc3e7b73bd2f93fccb4cdb3523bc2a2e9f7d0b929fe01890ba679394aafc596bf83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904298, "uuid": "c79d9431-bc00-477d-83ca-a1112b3b592c", "value": "T1E5A33943A72D0F83C4DB99B12DB72BF1876DB97112A361C1690BEE9003739B81517FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904298, "uuid": "dda094e6-8d4e-4093-b7af-e1f3a517c8dd", "value": "1536:7QQfckMzQzgv9OtAC0QptczD3z+FavgyTXvEmL49VqFjtUfkjX:7xH/JFDtczD3mI7vEmU9VqFBUfkjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904298, "uuid": "a33480b8-5143-44a4-be30-85d0b925b8e5", "value": 99023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904298, "uuid": "ced6f4ba-dcec-401c-b2d0-8bf8daba1145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904298, "uuid": "b6a8ef41-734d-46ca-90ae-a75e43450e5a", "value": "7c052794ba3e7837a8d5e6b1257cd109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce9cff5-ce42-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651954711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954711, "uuid": "148abe6c-eacd-4bf7-a380-054eaae959b0", "comment": "Malware payload", "value": "74e59045649bfe80a5a1455ab4bb3329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954711, "uuid": "4744ccd5-53a8-44a3-8f62-d8f31b571f6d", "comment": "Malware payload", "value": "e081465f75b5fc1a981ad522ad595642d28c19df648d26c2694f6d09d8035872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954711, "uuid": "b9878d1a-e395-43a6-83bf-5f5744a0b491", "comment": "Malware payload", "value": "8483bc9aaa617c3e75493f706e6b5a8fe9620ee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651954711, "uuid": "31f6db5a-9bae-4187-9490-27cfa389c584", "comment": "Malware payload", "value": "b8d377e6c077d5a3203f67013892932ed127bb6039c772b96009546b2f37308086152068cae122b9b42b21ce39207646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954711, "uuid": "919fa3f3-03be-46bc-9e6b-40283f583345", "value": "T14305BE58311C768EC867C9318E968C74A363686F671B5137929369BFB90CB87CF134B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954711, "uuid": "5be3cddf-4cfa-418b-956b-cf9298b0afb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954711, "uuid": "c2b73273-211c-4864-ac0a-eb9bf66d5431", "value": "12288:YLIkkZ7IagI0edUno0I1tx5xm9KpYmk92bFFEfMIxF1LWS0p1ZDOkLnIi4kGE0NB:YVkMdQ1lI8k92bjEfMsPWdp1ZDOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651954711, "uuid": "7b6af8c9-306d-4f6c-bd21-4760a58f2d6c", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651954711, "uuid": "780b437b-0b97-446f-bd91-36c77ac62705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651954711, "uuid": "0c0ededd-d39e-40fa-a453-e0e8565ed14e", "value": "oNa78lkbqXOi2dZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8de2615-ce26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1651942624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942624, "uuid": "d1bfab4a-2244-4da6-b738-7998f27f4862", "comment": "Malware payload (Amadey)", "value": "2e5816315adcf88c8a527722a6590ed6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942624, "uuid": "ccecc3c2-d931-4a85-9957-28ff4ee79eb7", "comment": "Malware payload (Amadey)", "value": "e17ae6dc6b124cbcb453e0e5bd5319d8cb9dc4df70972b50d91e49cccc7d2f7f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942624, "uuid": "c2ae6100-a919-46f7-a234-c9ecd02d373a", "comment": "Malware payload (Amadey)", "value": "e6756efbc30a0af6d55a64f0a3fefe3cea45293a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942624, "uuid": "a6ff75e0-7e5d-45a8-8158-ba99fe1b26f8", "comment": "Malware payload (Amadey)", "value": "96d25bb6e33a993a78fb0834fec4c2c10d6e8d7912ed397f1af81c89bdc4593e06855092ea5c63f0ed990dda43458da1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942624, "uuid": "3ae7ecd3-c9b9-489b-8552-9c400ad7bacd", "value": "T1C72418643912C072D66065B619F4BFF6C19DAD15ABB049DF2B800F77DA212F33921E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942624, "uuid": "3b7cee68-3b4f-498f-af9c-1df052186bd9", "value": "6b56eb425bb7dbd4f686b84bebc7ef49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942624, "uuid": "bd53123d-80a5-4dcd-adeb-c10ac99ab942", "value": "6144:Rus1jc5MI9AyPca9nMtaiVvdWAu983qJlz:ROy0AykEMMipdWAu983", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651942624, "uuid": "47ce328b-0d1b-4d46-b8cc-83f73a8751b9", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651942624, "uuid": "4ac39e1f-9a1f-49a0-ba6f-f6c779db2920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942624, "uuid": "f8771510-b818-4676-b57b-b59722875880", "value": "E17AE6DC6B124CBCB453E0E5BD5319D8CB9DC4DF70972.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881ad7f4-ce26-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651942542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942542, "uuid": "7a7a58b9-2a44-4ec8-9c3e-3fd19123c7d8", "comment": "Malware payload (RedLineStealer)", "value": "5530f803e9d84362d2776ef1b32547ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942542, "uuid": "1bccd340-dc9e-45ca-b928-24383b5014c5", "comment": "Malware payload (RedLineStealer)", "value": "e25f30195621d1fda7b9981355a45aea95381ca10f456e478bfbfab84e6ce946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942542, "uuid": "42a63c7c-268a-4678-8922-91755e945df9", "comment": "Malware payload (RedLineStealer)", "value": "86808d04b0a2edf8671c13ba05e37c93eeac638a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942542, "uuid": "c90b0bc2-efdb-407d-acfb-609cb3a03a96", "comment": "Malware payload (RedLineStealer)", "value": "4d9c4c3e8d3389d5e71dd75851f94dc95d4ef05d8efb8b44c4c4846a4f041c869af4caa0f3f5e085268525e9f9a167d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942542, "uuid": "e0a6db30-532f-483a-b946-a27ecab2d2f1", "value": "T15684D004BBA0D034F1B726F049B5D2A9BA3D7EB19B2554CB62D02BEE56356D4EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942542, "uuid": "3f39ace2-719e-4b7b-8577-0da5853a0677", "value": "bd6c087e94180526f5f9f8579d4f2ad4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942542, "uuid": "ec82a7f6-0080-4671-ae83-dddd52329170", "value": "6144:4j8X2A4lBh9dniN2zY6Wg4xmH4zXvWN/wrSSAwTyJo:4IGdl3/niNr6WRw4zXyor5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651942542, "uuid": "d6a59e50-7701-47dc-821b-1a3be55c803e", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651942542, "uuid": "f8934052-4f8e-4bfa-9c3d-5b42c095a9cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942542, "uuid": "5a64e881-548a-40f4-a651-fc7b246b7779", "value": "e25f30195621d1fda7b9981355a45aea95381ca10f456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccc0d7a-cdcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Tofsee)", "timestamp": 1651905077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905077, "uuid": "6ade3788-3d35-4612-808d-16c37dc8a783", "comment": "Malware payload (Tofsee)", "value": "181c934f98c03d7017764daa0ddbcba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905077, "uuid": "81dda4b4-6943-45fa-9428-3cf7421f7b36", "comment": "Malware payload (Tofsee)", "value": "e2e7294a6fee9ef6372897f3bebffb0d17bc31b9cf8c663181e192a608057061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905077, "uuid": "7d151ff5-18d3-4893-9f41-03e73bea959a", "comment": "Malware payload (Tofsee)", "value": "d8ca1f407d519dbcc3d212bc5f3926172ceedc08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905077, "uuid": "3382616d-a3f1-46fd-bcfe-0818f60c1ec6", "comment": "Malware payload (Tofsee)", "value": "09f2a82434ccddaabd4b18768c4ccedfdd2dd5a4574c08cc0a0b947217c61be7ff9bb53c2531d705d8cc3c1cec91e676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905077, "uuid": "97843633-4fa7-43ff-bc0f-b645b757a429", "value": "T1720633537FC1A576E6310C364979BB24673DBC219BE4C75B27C00A2AAA31DC0E631B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905077, "uuid": "8bb36104-1623-4abb-a3ec-5f27f2b80f33", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905077, "uuid": "6c21a960-178d-4c5b-a987-5dcc21156048", "value": "98304:PbkM9bR/DpjdXApg4nexS4Y3hq4t7Lo44/woPD3ic:PYM9bRJhXSH5JLo44//ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651905077, "uuid": "b71ac3f2-c6d9-45c8-a42e-aac5d3efc460", "value": 3736065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651905077, "uuid": "e23c5a6b-eea9-486c-a7f9-1f309e8aab0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905077, "uuid": "1883c496-0be1-4f2f-98b3-b243c886928c", "value": "E2E7294A6FEE9EF6372897F3BEBFFB0D17BC31B9CF8C6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82356d7b-cdf1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Tofsee)", "timestamp": 1651919769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919769, "uuid": "2eb8808c-8186-4fb2-80e3-1aa41ca9cb68", "comment": "Malware payload (Tofsee)", "value": "9bd02920844e365715aa3272c3a537ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919769, "uuid": "33b55ad1-2eed-44ed-9340-e1f1e65d77eb", "comment": "Malware payload (Tofsee)", "value": "e4fb57012d7a31e6511c4bac952323093e8bb51f138841f994f58259162dfd6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919769, "uuid": "0bd4a28a-b741-4ab8-b582-1ad8c20ff149", "comment": "Malware payload (Tofsee)", "value": "59e81aa962c210df2005766230ff9c1a5a6cb3c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651919769, "uuid": "f6c3f710-2b2a-4819-b064-4b7e4e12d0e0", "comment": "Malware payload (Tofsee)", "value": "749e1853418327576609ee431f4cacb6fb63fa90af34aacb584fe1bb9607ec158d6278ca9cd48cff4171c84dffd45fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919769, "uuid": "0ad63f88-55c9-42ca-a8a6-a0708dc2d57c", "value": "T145A63331EF419554F67FD7B4FEB64C44AEB91470C623E73B0AA98A50F212FD2806D922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919769, "uuid": "f541d7be-6a69-4094-9010-203e6a3ae01b", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919769, "uuid": "73e857f5-844f-41d4-843d-9b8729ebd449", "value": "196608:JK0xzMtDuGCsKhw8EsUdcQ2DrPzq3dxVl6XxTjVW8jHrA/y71ov5inaL:JKEMpuGlh/3dcnPE3leFjVW8jLBosaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651919769, "uuid": "8394e41e-8ba8-4512-8039-69e3b4a90be7", "value": 10278323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651919769, "uuid": "160ef3f8-47e4-4482-a940-eb7234f8c07b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651919769, "uuid": "4755ed61-a8e0-460e-8580-9ddad45acd0d", "value": "E4FB57012D7A31E6511C4BAC952323093E8BB51F13884.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c759574-cdd0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651905532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905532, "uuid": "bbcffb41-d0b3-4907-a8a4-6e73156c2915", "comment": "Malware payload (AgentTesla)", "value": "0ae44ce47637a943c3c1a1d26c937061", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905532, "uuid": "0e4e6deb-e616-4e75-ad8e-d36a5ab8d97e", "comment": "Malware payload (AgentTesla)", "value": "e5e0446b7eb97241d4c083b137f6e3dbc5a333083851e799c62d26a5b26eec98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905532, "uuid": "6c0aab0d-49b0-4aa6-8156-d4724b1d9252", "comment": "Malware payload (AgentTesla)", "value": "21720a76ee59d501e8022580f128d864b86de933", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651905532, "uuid": "6ab9f47a-f97c-41bc-999a-566dfb883db2", "comment": "Malware payload (AgentTesla)", "value": "1a8085621d8f82ebfc35f8d5250cc6c3e16f7e73a73d1522bf023d4555dc05d902287f7de66e801b1d9d24a8317af84e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905532, "uuid": "d991acb4-ba68-4638-b05c-9900c40112c7", "value": "T119942339D33F995CF4C0C6E2085079E520AE0E6D9C8586D9BD831B35ED317DDF8A2AA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905532, "uuid": "0a0b57d4-704d-4a71-9601-5d314a350150", "value": "12288:yv+7dvIiC7IMb4cZxs3sRaomxAxew71Bo959c:yOJCn4cdaomZO1Bo9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651905532, "uuid": "f0d179dc-9b80-429a-96bd-b5a66a321f9e", "value": 428555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651905532, "uuid": "3318b911-bb57-4624-b86d-8b5cd15308d2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651905532, "uuid": "5c76e421-673a-4c1d-bbee-4d3e661171c5", "value": "PO#7A68D20.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7872e71-ce4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651960205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960205, "uuid": "5965eeb8-23d2-49d8-8559-d4b93f7e8eb5", "comment": "Malware payload (Mirai)", "value": "2e13cd92beb83c90093a8a80fac6a863", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960205, "uuid": "faf6b687-d22f-41b7-ae71-59a267d94f5e", "comment": "Malware payload (Mirai)", "value": "e6a8d9fc258c839fc20be7bd42d0becc1a6af81d156eeeb0a1919630aadf3307", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960205, "uuid": "43179500-bd23-4abd-9b00-78579c99e995", "comment": "Malware payload (Mirai)", "value": "3205703af1e825887cac94e245cb2beff81d6c7b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651960205, "uuid": "b6a0439d-bd6d-41cf-a82a-e7c8513d63ad", "comment": "Malware payload (Mirai)", "value": "9995cdc4c9d4876adf7da89b88252d224283e10076bd785f0cd02e2192e7a28287ae96471887e72fa35070a2fb80e70b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960205, "uuid": "2bd9f3c0-9faa-4165-bd2f-ba8d889f878a", "value": "T1D1F2F1A6D29DE740F69E83396EBFF13F544E052C819D8B78C2C8251E71BAE1D67281C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960205, "uuid": "124d5f29-ca56-4eef-ba1c-c53c3544b9b3", "value": "768:28ElvTpUgoRSpQ7mMxT95v89bDCtplYJ0StpMPFDui6qYBnbcuyD7UrQRjyH:28El7mR0Q7mMxTrvQbDW0GqmFDN6xno6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651960205, "uuid": "d3cac5ca-dd3e-4f0b-bcb2-4b148ddcab4f", "value": 35212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651960205, "uuid": "5aa150d9-98df-4897-a346-7ad9a26bb9e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651960205, "uuid": "996c238d-4964-487a-b506-719f46784600", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4625bc12-ce4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651959182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651959182, "uuid": "0e4c5871-6359-4d32-88b2-9c423d8f8705", "comment": "Malware payload (AveMariaRAT)", "value": "f0214431b0f604d3bf2ecdfd2b929563", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651959182, "uuid": "7e444e38-33c8-4a51-bb43-a54a11185750", "comment": "Malware payload (AveMariaRAT)", "value": "ea29a81c6a5f31d383ed07c1efe7145266b0964bef02d4b99c66ea92e16f9059", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651959182, "uuid": "042e69c3-2b92-4a10-a8d3-4c0d9160513a", "comment": "Malware payload (AveMariaRAT)", "value": "fc6800c04916f1c0a4f77908c97c6f470fe2f8e7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651959182, "uuid": "ae0c5552-a052-4980-a05e-b9696874c46f", "comment": "Malware payload (AveMariaRAT)", "value": "16752cc58d09acddbb00caee2ecf80d947b58248233d138bb9d8a9cab0d6e73caa9514dfeb1248b4cc6df834ce160c7d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651959182, "uuid": "bca18660-23a8-48f1-9257-ce035ade1aca", "value": "T15E94ADCD762071EEC867D431CA685C74AA113DBB970B5103946B3DABBA3C99BDF440B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651959182, "uuid": "44321fba-a4ae-4c07-b2e5-115f3298ce92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651959182, "uuid": "5aa523b5-b47e-4a4c-bf07-ac7889156cf6", "value": "12288:kOFtW5MvlS0mzm6E7I+qoz3DcsWLKijS+SW3C:kYtWYlLoSFn3Po8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651959182, "uuid": "cf4b12dd-d4d4-45a8-ab98-5f747239172d", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651959182, "uuid": "6632495d-1f7a-4c3d-b842-e6554d05f6ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651959182, "uuid": "c61027ac-711f-452a-a24a-41609b3e2e1a", "value": "SecuriteInfo.com.Variant.MSILHeracles.37619.29691.12491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40c2cd5-cdc5-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651901035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651901035, "uuid": "2c72f0ea-a6ee-405d-9be7-e3414ca6c859", "comment": "Malware payload (RedLineStealer)", "value": "213d33ab09649db5e496d18a75391b67", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "ReversedPE", "colour": "#BE5E13", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651901035, "uuid": "5218302e-af22-4a53-b3ff-88ffba5e2dd0", "comment": "Malware payload (RedLineStealer)", "value": "ee42992816cb03d4d3b8ac64f3fd1f0d34be6b30896560153518f6c1fd1c002c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "ReversedPE", "colour": "#BE5E13", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651901035, "uuid": "51895b44-092b-4125-908d-feb0013225fa", "comment": "Malware payload (RedLineStealer)", "value": "4dc2f7f9dfd4bc5b2a4d0e75865d17c4c3ade3a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "ReversedPE", "colour": "#BE5E13", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651901035, "uuid": "46585581-fbcc-4bee-92cd-f32740f0be79", "comment": "Malware payload (RedLineStealer)", "value": "bfff48935b5f47e88c01c53667503f54633f50f8f2784a43a8be406cbd5fef4014b65e68505b632d4ea63c3dba796095", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "ReversedPE", "colour": "#BE5E13", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651901035, "uuid": "ca9b29ce-a184-4fbc-af40-8ef58935f5b4", "value": "T18875298BB593BEA2C2851736C49F1A2807A0D7517613F72EAEC9133494C33F95F89987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651901035, "uuid": "845ed00e-325f-44df-a4b5-56e7175afd54", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651901035, "uuid": "e4e9f5cf-2cb2-4174-bd32-efa1d5b4fb54", "value": "12288:sOBpsE2Jnw5ILmoGVnV3nVTly95FJSiF4hVlKiVp2l6aaSVg0/GqVkbip58rWLY0:7xQwzo98y4hpz3SvsWLYvtnFmkHCXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651901035, "uuid": "8ee4fd5f-d761-47f8-9022-885f6be649a3", "value": 1626623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651901035, "uuid": "65e567b0-27cb-42b6-98a9-5923b09cbc90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651901035, "uuid": "bc32425f-9eb1-4630-827c-fce3b401148f", "value": "RedLine.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298af8bc-cdfb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651923915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923915, "uuid": "2f625747-d160-4340-821b-190aa55e73ab", "comment": "Malware payload (Mirai)", "value": "6b8a807d0984678982b1571e5b2c7db3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923915, "uuid": "b0e5db70-c373-4003-be6c-f35fc08c55c0", "comment": "Malware payload (Mirai)", "value": "ef4c6364e9547666404d55b95b5eaf5023e22ad44add4a4294fd82cb934dc6b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923915, "uuid": "d3bfbe1a-80e8-44de-9e0e-8485e468e33e", "comment": "Malware payload (Mirai)", "value": "0991957f185adbaf7641aadb3ab5f4bd948270c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923915, "uuid": "b8ae2b93-10f9-46ee-be9e-69f15d020300", "comment": "Malware payload (Mirai)", "value": "cd570bfebd2e6662a8c22aef22d4d327e0039809916d6735acab376476467bc17e3e41f11f9d36ebe514ad12d10810f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923915, "uuid": "71c11169-2109-42f6-af9f-90e53fd316c7", "value": "T12C633A92BC819A02CAD412B6FE5F518E331623D9D2EA7207AD15AF2037CBD1F0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923915, "uuid": "39c0b70d-e198-418a-8b73-331a8e5b89ff", "value": "1536:/WloK05nJ7xkC0ztNrB28kgEWwq04cVW84lx1RVvH:/WNY7635qwEfXbVWp3dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651923915, "uuid": "76d8af56-02ce-4bd2-82b3-a254aae66fa7", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651923915, "uuid": "6e27e836-3601-4f6a-bc8b-5d9f6d7e1641", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923915, "uuid": "5a621b60-3f80-4d2d-b080-60097e6f35d0", "value": "6b8a807d0984678982b1571e5b2c7db3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1eaff6-cdf9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651923386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923386, "uuid": "cf7cb394-87d1-44ab-a29b-9e79212dab99", "comment": "Malware payload (Mirai)", "value": "2c5fe247b7551747871ba3f369ae7b55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923386, "uuid": "4f59a036-a916-494f-a4b4-6643f4faabbf", "comment": "Malware payload (Mirai)", "value": "f10855751adc66a7391e2aed514dfe34fc4a8425472a7662d05e544c075947ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923386, "uuid": "7dceb3c1-8fea-49b0-9ec1-3842402d38ae", "comment": "Malware payload (Mirai)", "value": "ddf5c4f6aaf1603f7f89c54cb0a9a4bf16b7b690", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651923386, "uuid": "b81bb3c5-b445-44f4-994d-8bcdc3e8a3c7", "comment": "Malware payload (Mirai)", "value": "15d056780ea1b0fd53b15254acd342012ccb9ef7f97bac4bd50abbf01c6217861099bf92b9d915de0114c76e40f9db6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923386, "uuid": "98e4d831-9f81-449b-becd-9b013ae87dea", "value": "T169536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923386, "uuid": "e97b93d8-30ae-47de-9dfb-b50b6fa341d5", "value": "1536:Z7qARubgzY/bEJynRcpU80LDHhklv4JQC9DSW:NP+eY/bEJtoXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651923386, "uuid": "e6e5b365-ee2d-4abd-80dd-1f25c1be7d3a", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651923386, "uuid": "daa4b975-f86f-470a-b6cc-14f9292e3339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651923386, "uuid": "974de812-c143-467d-93e2-f9301cbacfd9", "value": "2c5fe247b7551747871ba3f369ae7b55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddd5de7-cdda-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651909803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909803, "uuid": "c346ee2f-b4b4-4235-9313-8a37198f73af", "comment": "Malware payload (Mirai)", "value": "92c3073bc930f2cbaadb91b9feca7067", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909803, "uuid": "22d3eea5-4080-495c-b80e-69d94cfa384d", "comment": "Malware payload (Mirai)", "value": "f1a7272922370084b5d2f341f47b5ec312a90bcdd1fe0741f466ade782a88010", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909803, "uuid": "35fec91a-b86d-459c-92fd-3ebcd5c6024b", "comment": "Malware payload (Mirai)", "value": "8ce14128291c62a4119cfcfca346166210251141", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651909803, "uuid": "71b1b750-e44f-4dbb-88ba-f56281ac475c", "comment": "Malware payload (Mirai)", "value": "0494d51801c70d56df527ff21690e7ecef9f8967fb3b0b9c1bc80877beca23b8a321aa5054793f59df01de4de7c26b0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909803, "uuid": "4c279fc1-f128-495e-84ab-3b53f76da623", "value": "T142F1E686D883EAF4F82311B5A0766B768632F93D3518EA43DB29CA35CC92410DB2735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909803, "uuid": "87881c06-15b1-4316-8c43-8d06e8d8116d", "value": "96:fdqCxtdey7D5Ocz+AQC+Oazl2xUYYf0pOjChgX7hZcKM+9OgUO0R+50wiYeUbuAK:fs6Eq9OTVxwk0pWfXAKMv3O2miB2fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651909803, "uuid": "47edfdf5-5b82-4ecc-a7a0-401ab803f5e8", "value": 8136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651909803, "uuid": "63ca4854-4c6a-40cc-bd68-2470751d9b23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651909803, "uuid": "38fb996c-6045-49a9-9aea-6fc53104d204", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13971d91-ce29-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1651943635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943635, "uuid": "c0d51aa4-bbe6-445e-8d13-1fc5ca2afc5a", "comment": "Malware payload (BitRAT)", "value": "a3aa56ea0d055b327db1ccca22fc6bfc", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943635, "uuid": "c7da76a6-00fd-49de-ae8f-c518b8d596d9", "comment": "Malware payload (BitRAT)", "value": "f1aea885141ff01f8db0c1eeea40190915f79a43d033c2e0f58784d87d540bad", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943635, "uuid": "642efb5a-b827-4c34-ba43-15a083c48c1c", "comment": "Malware payload (BitRAT)", "value": "c8e62b37c9b96b7cf32ba5843b6f9242fdef6075", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651943635, "uuid": "900af38b-2ae6-4e4e-890e-65513b0894be", "comment": "Malware payload (BitRAT)", "value": "f6ee6104a54ea054ee2c0d6af8e122184817269a107427e95df5a7145588c15f365cc8aa3b1af6c69d7d50289f721237", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943635, "uuid": "5e196352-844b-430f-89ca-018ef045d7ad", "value": "T129E5AFDD9A4DA4D07F81BFC9D8862DCF26204731BAA120295E7BF8468DA74FD904BDC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943635, "uuid": "98fde3b8-7d98-4763-94ea-c7b672be747f", "value": "24576:f33eITsPXOtpncI+YvuBYriu44yzXMPFz5hJRZF20iuLC+JjGsh1PV0jCF4/8kyN:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651943635, "uuid": "a2732e15-5d99-4f52-9fd4-c33e67c69876", "value": 3294493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651943635, "uuid": "f4e6637a-9db4-42a9-86a0-19ae75cc0650", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651943635, "uuid": "2a787d36-a3da-401f-ac12-c35a06897b82", "value": "NGBDNGIICPYAAHTTNHEHNQ.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1c1ca1-cda5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651886934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651886934, "uuid": "70fc819f-6290-45f6-aabf-80c771a27b89", "comment": "Malware payload (AgentTesla)", "value": "afa5354cdf64d834d9c6ceae51c6f1eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651886934, "uuid": "85f0157d-30f6-4806-b2b3-348d0036df7f", "comment": "Malware payload (AgentTesla)", "value": "f21e160622c66dd3353295070f05a5806b02413942306f99f4313222386b5d48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651886934, "uuid": "6a74fe1c-868d-440b-8eb9-e2f4ecff1844", "comment": "Malware payload (AgentTesla)", "value": "6770326b4134061dd232ec34c31d0c4cadb7f8ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651886934, "uuid": "f095d767-de7b-469e-a777-f9b6d3e4e5b4", "comment": "Malware payload (AgentTesla)", "value": "bf5a3bf8bcc8cc51cb66be305252b6b75ccae4ef7effd17f4db09f1a0019e99340769d1c3f995aa15649c82b92950c1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651886934, "uuid": "a7faf8fc-26e3-4f60-a654-aa05df875840", "value": "T17D15CF58311C799EC827C97189968C74A76368AF671B513391A379BFB90CB87CF130B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651886934, "uuid": "5ee326b0-58f8-445c-9a6d-54263400410d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651886934, "uuid": "1ccf2540-5d0f-4982-97c8-8e65b44a13d1", "value": "12288:aLPMWEFhnUXHeH/5K7ArBsEdMzMxvnFD/oXO+AAx03aIEfHBPnLAeMkswVe3YFWV:a4V6gd6MxPF8XXxQaXHFLAMswsMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651886934, "uuid": "c9792d0d-2ff8-4663-b51e-407c910a9615", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651886934, "uuid": "566bc2bf-07d8-4ebf-aabd-e66a10c6dfae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651886934, "uuid": "a0bc0845-3eaa-4620-9d44-efb6f0f6f0af", "value": "SecuriteInfo.com.Trojan.GenericKD.48992267.2003.4150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5067164b-cdce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651904653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904653, "uuid": "eaf5291e-c4b3-40eb-9de6-4d57fedc7048", "comment": "Malware payload", "value": "c05db85e35863caf884bf65c62413ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904653, "uuid": "0677b553-84b3-4be1-97d7-3aa90683851c", "comment": "Malware payload", "value": "f40a47af762b5f2270be9a10058551c5a134a2f22210422ab53481569e08ac00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904653, "uuid": "0c85c987-92e8-4141-9286-00389803c13f", "comment": "Malware payload", "value": "ed2b9cfed1c017e1bfb52a73a4a697fbe33cc406", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651904653, "uuid": "085f9ff7-01c6-498a-935d-0c8adc5755f8", "comment": "Malware payload", "value": "b2516b0d369da21a66fae1243db42769a00cba0e2132acaace98e2428a33879d8e20cac6b8a99630213aa4b32ed1d3fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904653, "uuid": "5ee974a1-126a-46d1-b461-841a31817db6", "value": "T1D3D41202B191C971E2A34E726830A7A2297B7C566E76491BF3BC772F2E703D14A74353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904653, "uuid": "e111dbc8-b56f-4c4b-8ec4-2f3b9bb98b9f", "value": "8bb30d9f519912fcbc010d3de8eb06b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904653, "uuid": "8c31d80d-f093-4665-a6e6-a31465b313ab", "value": "12288:Hc6Xc1CjRcVySJfqk2fp2TApc9b5Bp7FMoSgB+T5rIxG:Zsbyqfqk2frc9b5CoSgB+1kG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651904653, "uuid": "d016e412-6bb6-497a-b4c3-44871c71372a", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651904653, "uuid": "9c6de538-7d1d-4af4-93fe-1be12211a7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651904653, "uuid": "67816257-dafe-4288-9f19-216f68c51c90", "value": "c05db85e35863caf884bf65c62413ded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66405e26-cdb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651891805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891805, "uuid": "9c579d81-523b-4fb3-af81-a46300819788", "comment": "Malware payload (Mirai)", "value": "a4a7dd8c885f92f0b0391cf8ae0bc490", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891805, "uuid": "1319b0ce-a923-4040-a779-fe25d0e39015", "comment": "Malware payload (Mirai)", "value": "f58a097d24059e934c8dc46f925a3f55471ea3b4de2ee92122ae67f669bdf4df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891805, "uuid": "44824728-0145-4bc9-b217-4f16e749832f", "comment": "Malware payload (Mirai)", "value": "1009595746e21e30563525df463e657f4d4fb9f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891805, "uuid": "6b7a2f0b-20f3-4946-8f4e-897959773b98", "comment": "Malware payload (Mirai)", "value": "d5eef02e198a69a019e858b9e26414d81afb56158bde7cc270c1272cdc42ea39e020f592d0464a699caa7570f10304cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891805, "uuid": "5477327a-0c22-4ab7-9c46-b8b55a91663a", "value": "T1D8532885BC81DA52CAC4237AFA2E41CD371563E8E1DF72139D221F5077CA81F0E6769A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891805, "uuid": "756057a1-5218-4043-9b92-750dfe573508", "value": "1536:kcwwG18KzXiFrZ4mH0o6ayT/Ymb2PgPrpXfuYSg:kcwwGoUGy/2PG1XfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651891805, "uuid": "dee0a0bb-d17c-494a-8c75-99ed26948fa8", "value": 66556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651891805, "uuid": "962880da-59d3-4570-af7c-e05923c1682b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891805, "uuid": "d388ef11-295d-4015-86ab-7e16e170a6a8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d0d940-cdb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651891803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891803, "uuid": "dcad628d-ad25-4ee8-aeba-7b904642edaa", "comment": "Malware payload (Mirai)", "value": "e0f23a07683d6978d8740e508f37a967", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891803, "uuid": "8b02158a-9140-4c6c-8227-500223ad9197", "comment": "Malware payload (Mirai)", "value": "f7e85864adf356d84832e9994582595b4e010fda1d9e8286444e75ba067ae8d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891803, "uuid": "5e9756d1-f8dd-4686-9e58-4bda9b651eb8", "comment": "Malware payload (Mirai)", "value": "c7bc9131dbfdc6778505e8ce5e7c4e5ff6020f94", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651891803, "uuid": "505ad29b-f571-4f3a-b244-f4114a672f19", "comment": "Malware payload (Mirai)", "value": "6bf95ff2ba82b11b687f56d77a1896c4159a28d34f5479c8000a5a0c9564dcbd7ad63e34555504fceac70725b9aa8237", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891803, "uuid": "5dfee8d9-0b34-46d4-970d-26ac30e08b29", "value": "T154D34B46EB418B03C0C5177ABAAF42893323A754E3DB73069D186FB43F86B9E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891803, "uuid": "21987932-f079-40a1-958d-32af1a86dc42", "value": "3072:+lUSsBNomFsflhl5KZ2nHjfod/Kdo3WVbOprrrcM/9vRGM31Lyh:+l5sBNo0Olt5Dfod/KdWWVurrQM/9v4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651891803, "uuid": "e507d42f-f9d7-450e-9ac5-640ae90f02fd", "value": 142566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651891803, "uuid": "3e0c16be-075b-4cf2-9379-63efce95180e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651891803, "uuid": "1c2c6b64-e269-4632-b325-95b98ca0dfd2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec05e2d3-ce4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651959460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651959460, "uuid": "894530fc-81f9-4f69-9480-7645c045c569", "comment": "Malware payload (RedLineStealer)", "value": "b516150d13af2c0ed92f21ffaa86ad53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651959460, "uuid": "3e0316e4-c409-4d11-ab35-0a93eda525fb", "comment": "Malware payload (RedLineStealer)", "value": "f8836908ca99f66289c94aa2f71948d9edd985d4320116a10c8d926af67987e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651959460, "uuid": "03547676-03dd-472e-a93e-a28b8a1c3c42", "comment": "Malware payload (RedLineStealer)", "value": "ef1700b444abd2fdbcf9df389947047bd8d4b73f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651959460, "uuid": "a6a952a8-6c5c-4dcc-b8b0-597efb0b79fc", "comment": "Malware payload (RedLineStealer)", "value": "2ef49c5b3a760db2281341035837736b87ec13cd06d9af9c86431f5c2fef7f8f12f8e07b71f1ab665f720b79df4b5265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651959460, "uuid": "d51975fc-7119-4b7f-a0a6-119126eb270a", "value": "T16864A63C3AA84A33C2BEC6785AD06817E1B0C09B7511DE594CD353EA5B226D539C39FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651959460, "uuid": "b3dd2cfa-4118-4b85-842a-6bcdf0fa8807", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651959460, "uuid": "f84b5a45-1f46-4617-bd0f-3b9c8c1116c0", "value": "3072:e0ctQy29niy0T5S1g2BLCRXDaEqxfSJYcas879b93y3J8c25Z4YNd4JGajxRXTgK:RR2U1Jt6lIVs879b9ye9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651959460, "uuid": "5a283a96-5d20-4f56-a641-bde0ab494f6a", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651959460, "uuid": "3677795c-c3c2-4b3b-a9f5-c3d3461e1c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651959460, "uuid": "bd4bd929-3556-4812-8eb1-0a60b0f93956", "value": "F8836908CA99F66289C94AA2F71948D9EDD985D432011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6aa2b2-ce24-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1651941718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941718, "uuid": "980c2087-9334-45ad-876b-35548860b3be", "comment": "Malware payload (njrat)", "value": "5304be0f1a3b9cccd95e40f4fd233f81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941718, "uuid": "fc47fa0c-ff1d-4327-8b1d-59af9488f1af", "comment": "Malware payload (njrat)", "value": "f8d0609debf08c60070fef13599aa2b10d66f43ddc904a8176d2ef0ffa01a8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941718, "uuid": "b4fe8cd8-a364-4c18-94ff-24f986303329", "comment": "Malware payload (njrat)", "value": "83fba9f975d992e8b53efa8dd1be59f7d801fdf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651941718, "uuid": "9fbe6a6f-8c51-4d2c-a56b-890aff0cc645", "comment": "Malware payload (njrat)", "value": "2c6ea95aab315e6700219e576fb514603babeb30bfef1a70874d3d2d7ace0cefeb1921f5944bf430b9ef1362ad802d0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941718, "uuid": "3c79cc77-2d1f-4f25-8709-2c599f1470f3", "value": "T100E22AADFBE64466C1BD0AB50571951043B8E143E513F77E4ECA24A62B3B3D84B88DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941718, "uuid": "79ea0da6-ed23-48ea-bd98-2734fa84df74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941718, "uuid": "43093baa-3e02-4708-a0b5-904380121af6", "value": "768:pujCcKdTtrUzxf6voo2DT39vhvXQmIDUu0tiZZj:kaoZpVQVk2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651941718, "uuid": "39a70675-bf5b-40d4-be91-6917f3cbf209", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651941718, "uuid": "e4419ea1-c6c2-474b-9cd3-e53de6e81878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651941718, "uuid": "98892d20-8d35-4ae7-a2e7-8802f3499e6a", "value": "F8D0609DEBF08C60070FEF13599AA2B10D66F43DDC904.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11a55e6-ce26-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651942638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942638, "uuid": "fe74ccc3-c2b7-4612-b3c8-cf4d8f09b69a", "comment": "Malware payload (RedLineStealer)", "value": "e40967df051e81b88b363d22a7d8a3bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942638, "uuid": "82c59d9b-97d8-4a09-85a0-e6c8c0b45a40", "comment": "Malware payload (RedLineStealer)", "value": "fbeb61dffc09d8b3cea9da82530a91e34b33e41773cedcad488e3f83a4cb4cf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942638, "uuid": "0cc12ffc-8f46-45ae-ab9b-f93d1c821b57", "comment": "Malware payload (RedLineStealer)", "value": "d3ab0550078d323a974fda5f51aa618fb85ea931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651942638, "uuid": "f273d3be-ca21-4eae-8a30-243af19f3478", "comment": "Malware payload (RedLineStealer)", "value": "d327cdf3f73de95e37132715011aa067427d5e98df5137c589260a636ddf054893e0d06865722b16728df48fe159080d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942638, "uuid": "0124ccd9-56c6-44e2-a1e4-cc172a19e510", "value": "T12384CF04FB90C034F0B716F4897593A8B92EBEA1AF2450CB62D52BEE56356E4EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942638, "uuid": "28ffb568-e9dd-4cf4-9f3f-c9c2c30e3358", "value": "a14107a392764307cdf95bf281e41cf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942638, "uuid": "ceb5b77f-d511-4f29-ab71-4ac77aa75f2e", "value": "6144:7jZXhnVfW5GBzCSqrw0hEdCIbhA9JVUz8FwigCHWjsEpkXgsP+29QdmolD:7FxVfQqzCSqr08wO/F1gC2jshdP+29s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651942638, "uuid": "d7f84167-431e-4a77-818e-599ac023deaa", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651942638, "uuid": "778bca35-8534-4dce-9065-4b9a8068d5b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651942638, "uuid": "eb54d78b-7dfc-4c0b-9daa-ae7d8b958a51", "value": "fbeb61dffc09d8b3cea9da82530a91e34b33e41773ced.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224bbec8-cd99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651881813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881813, "uuid": "38466acd-2788-43cc-ae1c-3cd7c3d90a6f", "comment": "Malware payload (Mirai)", "value": "6df30b10298ec936c4254f9af157c62c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881813, "uuid": "6c963af0-e465-423f-b32b-16648ee44c4a", "comment": "Malware payload (Mirai)", "value": "fbfc98da73c25b6ad43ef243f13baac48ae48f9e2c80b4a550dc8e1f4e52a12b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881813, "uuid": "79faf0e6-b658-4078-b79e-83ab55488264", "comment": "Malware payload (Mirai)", "value": "ce4fe5a26f8c07e0ee17fde5e013df96949047a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651881813, "uuid": "97940fa5-3b7c-4e45-88c1-adee6e977424", "comment": "Malware payload (Mirai)", "value": "770b043df94ba0841c53679f2342cf5e64ce5dbfcb14ca18ba2b8a40452c75d1a19ae47db3706b24ee8d4f1619569c5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881813, "uuid": "adc3ac3d-63ea-49bd-925e-832e6c87a4e4", "value": "T1CC83D949BF610FB7D8AFCC3705A91B02288D555B22B93B327D70D918B64B24F5AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881813, "uuid": "8bdf3b17-3e19-4ad2-bb10-8171607ccfac", "value": "1536:Hm+fQT5uDTWTG0L2kEgYuYkMc5QrWGsst0Zq8UUB6xa10:Hm+fQT5uDa5RYuNXU0F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651881813, "uuid": "1c65a240-e565-4789-b7dc-3d7c0e76574a", "value": 85652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651881813, "uuid": "2eb6b730-aadc-40e0-b378-5ec9dcb830f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651881813, "uuid": "6371f7ef-00fb-44c3-b2f5-2d433545aaf9", "value": "6df30b10298ec936c4254f9af157c62c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc77f4e1-ce14-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651935007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935007, "uuid": "1b488cdc-a428-4af3-91c5-87d0ac05533f", "comment": "Malware payload", "value": "32c5bc8b563e9b64af620c4a1b5ea3d1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935007, "uuid": "292050e3-1789-4dff-98c5-ec94c97ce7da", "comment": "Malware payload", "value": "fd4d650feea11e89d5f60367a39bf60e93b42e7e7f993f03053a4e3380bbd951", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935007, "uuid": "168648c2-6551-43cf-89f1-8906b8162da6", "comment": "Malware payload", "value": "1ac06b01821e89efc9f824be43e9989677bbde82", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651935007, "uuid": "3150ef1b-97c8-49b5-8a2e-d24cbcd55f51", "comment": "Malware payload", "value": "6e5e64ac16a0af19f2180545b7eaa4eb72f0e432ac108463ab5a0fe5208383ee2c75d3894fc917ff0783454ada296f02", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935007, "uuid": "02ee3af4-dc76-416b-9216-3a91427c8789", "value": "T15AF2E132A3018BE2DBD35CB1FE8C954116427B9CC5BC64B1168B9FDDA98B41672B2863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935007, "uuid": "dc265241-49a8-46d4-b310-b0eda18d2d34", "value": "768:jNXHyuTXY1TkBQZoD9xn4HsnmRi6Pg/Vq4alkVfd/8crXMvqoA7Xe3US:jNXSeXxBmEwEMPgdqDQdjrXMvqoEXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651935007, "uuid": "564536c6-0cbe-4b96-91b9-8e965b4796ab", "value": 36936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651935007, "uuid": "1c55efa3-b7d9-4a83-b167-673e38c65a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651935007, "uuid": "c1639e06-10d9-4b35-b460-4d23ed457677", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfa8d6f-ce1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651938605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938605, "uuid": "fecf1747-c1b0-4781-b925-47b7149af4fb", "comment": "Malware payload (Mirai)", "value": "56c61f4443facceb308df9253de630a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938605, "uuid": "2d0bb759-91bb-4ab5-b1cc-3d1c97b40b81", "comment": "Malware payload (Mirai)", "value": "fe032c06e78ec4258754fcaa876808935f5edb5cb97c73b9ba6b7b6e96299a27", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938605, "uuid": "1bb04c2b-f99e-4ca7-acc3-d86bc4365032", "comment": "Malware payload (Mirai)", "value": "d807d5fb36fd579ea7de3e8c77cd270f11716040", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651938605, "uuid": "9f06c512-72f7-411d-b899-42411576b843", "comment": "Malware payload (Mirai)", "value": "5133ca7fa9a7bcb2b5754a8a9a627ac21b6477cf2cd0d28bb4767785c5aaf73e80e4d8254c44a34f94e53d4c4823a1a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938605, "uuid": "7b20d690-d480-4d61-8874-33b655c5c626", "value": "T1AD73A409BF650FB7DCABDC3709E92B0528CC550A61A97B397930C858F64B26B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938605, "uuid": "fdfbe497-7310-4773-8dfa-edeea736fc80", "value": "1536:cQZi0NucPEgmOiTIPKAe/KElBGsZhzFBt1:Ri0NuC2OGBlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651938605, "uuid": "348dd9a8-ad09-414f-8621-046a2755b787", "value": 73624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651938605, "uuid": "2633c876-847e-41a2-8476-1181d5a9aef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651938605, "uuid": "6e404e31-4f68-4b9c-88a8-1271bfbf5103", "value": "Unitlife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99c2321-cdb1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651892348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892348, "uuid": "38ac4ab0-a460-49ca-9b19-9e46d1e619d1", "comment": "Malware payload (Mirai)", "value": "37a67ba8cd3d8724fb4591181100c49e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892348, "uuid": "923e9695-673d-4e18-94ca-b8ce2e48e826", "comment": "Malware payload (Mirai)", "value": "fe6a4d7ef1839173dcf12cb7a97935ef5129900d733c517d165c4d843fe4dca2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892348, "uuid": "0120554c-63ce-44fd-b3e2-237fb27aeb1a", "comment": "Malware payload (Mirai)", "value": "5e759260d6b95dcd69c4f5385141f0de95647b26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651892348, "uuid": "dcaa7d43-94e4-4f77-9d00-21874aa85b86", "comment": "Malware payload (Mirai)", "value": "11f3ded12c78f629a01492f1ea71a82ef95745bbebcb2adb07bb11d7f3986a8bbc9d4f093cbfd7ecfe581ef8001081ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892348, "uuid": "fda9dc8f-a325-484d-bfb4-7e78a26859d3", "value": "T1F5731956BC818F11C5C913BAFA2E118E331327A8E3DEB2229D145F2077CA96F0E7B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892348, "uuid": "7053d682-ff4f-433e-bc9f-9bc2d7aef09b", "value": "1536:LEnMjZbxKRv4UBgQK6a3Y7EuWTBmR9hzzGGMWMEhXu6MIPiW+41LPzBg:1ZdqhBxKJoIuWVmrz3MM1+41LPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651892348, "uuid": "c8802abb-eb3d-4281-982e-7cb06d2cd9a2", "value": 76148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651892348, "uuid": "ffcba07a-42f6-4315-ba0e-d99ff4262953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651892348, "uuid": "553b90bb-72e2-492d-97ca-d63adbaa8ee2", "value": "37a67ba8cd3d8724fb4591181100c49e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }