{ "Event": { "published": true, "date": "2021-12-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-30", "timestamp": 1640908982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c93dce76-3ae7-46eb-88bb-f7c5465d9fca", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df7fc6c-6951-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1640855765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640855765, "uuid": "888f60f8-8f4d-4867-a080-833b469f589f", "comment": "Malware payload (Loki)", "value": "c23dc99624d0d369da6ec15958525770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640855765, "uuid": "167c238c-428e-483c-b1b6-8cc7d1cac4e4", "comment": "Malware payload (Loki)", "value": "030e60ba29cce38106d0aacef53ebc8065039c0f8905faa1c04c895aa8d0389c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640855765, "uuid": "d029698f-023e-455d-a684-8e1cabf99951", "comment": "Malware payload (Loki)", "value": "be18e6df93d9be71107aec5a9d7684471655798d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640855765, "uuid": "6fe5b984-3a65-4085-9381-48538db571fd", "comment": "Malware payload (Loki)", "value": "b6ed21ca6cb8a501d9174334ed1e8a28067f2e88e5a4defcef2ca804ed2d29b8787f5fe33def4a86b806075820600ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640855765, "uuid": "60657759-899a-4ad6-a8df-8bf5ac8c61e5", "value": "T16C54122763A8AB2BF67F4BF9141305200735BA39AC29F39D0CC554D94AB3B944690BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640855765, "uuid": "ee61a412-7d15-429f-8880-5317d0158400", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640855765, "uuid": "ff90b091-f26d-4fec-bed5-9cce839bd5fb", "value": "6144:89NkBZvqNY9Dd0h3IOdpzQk+DaNicBlD5IoYsxc:mNyZhDdcB1QkE4icLFRxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640855765, "uuid": "5371b23b-21fb-4082-8467-71c1f5ae2f12", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640855765, "uuid": "eb71d6f2-929e-4d98-b1d3-6029e6e29169", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640855765, "uuid": "b0cc70f8-2322-40f6-9f05-8700e2f3ab7b", "value": "EDC09494874355.COM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56a9cbe-697f-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640875803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875803, "uuid": "f998f65b-3fb9-4b95-8b11-d4e3a1189b0b", "comment": "Malware payload (Gafgyt)", "value": "9ca90aaa00cd1de41ab2793e408f71ef", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875803, "uuid": "2c873a91-c461-42f5-956a-7480d7fc94fd", "comment": "Malware payload (Gafgyt)", "value": "05e13a91ce9897047c3b207a319b5bd4ad199e502aa2e5364c60acc187a5926a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875803, "uuid": "cd0eac30-88c2-482a-8ad2-bbb4b86dc54a", "comment": "Malware payload (Gafgyt)", "value": "a4d6efc5befc5f41bcddbc0a8987921a3121893a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875803, "uuid": "414f86f4-99ff-4c28-aa43-ff15de9d1ca5", "comment": "Malware payload (Gafgyt)", "value": "95de30bde7d3c787823f84856722ea6d7c64fdf9ea5484900c58e52515de596edd93061ec433a3ddc716a6bc52d0f854", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640875803, "uuid": "e33dcfc4-57fe-48c9-b636-5e2dbb3daf22", "value": "T12E733AC9F593E9F5DC0506B0307ABF339E36E2BF3159EA83D7E85572AD02602900699D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640875803, "uuid": "191bd9c1-c271-481e-9445-a5805ab5bf05", "value": "1536:7hOU3twDXi4CRpIY/5bpJCB04Q0Un6jQQ/fpDcsCfO:7ECtwDXi4CRpIYbJ34Q9oQQX5dC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640875803, "uuid": "e9f6d157-8162-4e2d-9758-4baabfa797a3", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640875803, "uuid": "420c4336-054f-4793-9460-a99520603dcb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640875803, "uuid": "862d440a-08fa-4f78-8f8b-70d3a1b5bc9c", "value": "Fourloko.x86-20211230-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc79d3e3-6943-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1640850018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850018, "uuid": "88d4557f-2966-4e8c-b4dc-8faa787239ee", "comment": "Malware payload (BitRAT)", "value": "5a6bf2c5bcad6098f5eed902fd2ab165", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850018, "uuid": "21d37004-2b91-4628-af2d-3dad0f5a501f", "comment": "Malware payload (BitRAT)", "value": "06d093a1f7775df0391176bdee9e23b9856f95e0baa25c9d271e1854094235a2", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850018, "uuid": "cb756c0a-0aca-49fa-a04d-be0d5aa3f468", "comment": "Malware payload (BitRAT)", "value": "169330abce1185aad9001fd590f8ea6952234a85", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850018, "uuid": "104e8635-9ae0-4e3d-9776-9d666a0ae704", "comment": "Malware payload (BitRAT)", "value": "4a0b9397a69889976ba329dc51ddb68129acad59acb2442bd3196ca3f74ce05074577ea2eb58e9d996536c7998b8b7cf", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850018, "uuid": "898ac91c-a4cb-4783-bf39-fe4df00b59f4", "value": "T14DC53361AA795C70E2A40AF59E5160743C3E5E5361012E1FE782FA1D0E36AC729F13BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850018, "uuid": "0b15f8fd-7aa8-461d-8ad5-f3e43654acec", "value": "705cfe8aec9ddfd7803c4a2b60f273df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850018, "uuid": "06090908-7fc6-4d79-9eb6-d2a5150f84b9", "value": "49152:S6hzZnZKTeeapCf/AXxAD9l88RZVoq8rQC257svhmrpAR8dmcUtmuZbY:RhzhZheSCnAXg9RMqkQTp6IAwrUIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640850018, "uuid": "b6683d86-6d7c-465f-805e-a40d8b407cf8", "value": 2719744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640850018, "uuid": "bd469398-3258-48b4-84c8-bc978f1c36ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850018, "uuid": "03f8149b-56e6-4b6f-aee6-5160c37e0da8", "value": "5a6bf2c5bcad6098f5eed902fd2ab165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326eb7a3-692e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640840767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640840767, "uuid": "76f8a16b-0690-4faa-878a-e96a1725cca6", "comment": "Malware payload (RedLineStealer)", "value": "5367ca900ff1988ce2ee1c93b241c764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640840767, "uuid": "f471d5b6-faba-4ae2-939a-dab401e1a07d", "comment": "Malware payload (RedLineStealer)", "value": "07bb36227d8121f29c43baae188b43f3d5c4885ef4b20410fca8985235168c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640840767, "uuid": "8a73d853-24d7-4b45-ba7a-c33b6c0f69bc", "comment": "Malware payload (RedLineStealer)", "value": "9b5ef337871490ed36f31bb18b0b4d318039e23c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640840767, "uuid": "cea8820e-8bdb-4f37-95a7-783510ae4c17", "comment": "Malware payload (RedLineStealer)", "value": "022b58c5c66babf07fb4033f11e8d83589161133787c09ff8bd8c377912f6a28d1121549585a11f9f831ba685bf8963d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640840767, "uuid": "d6b61ad8-8732-4c8e-a868-d6f1a9df07de", "value": "T19EA31B6533C89914D6FE4F75B8B0519843F0F1536512DB9F5EC660FE0EB2B80AA12AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640840767, "uuid": "89945539-3a0e-4cc2-bc14-38fb8f0e2c01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640840767, "uuid": "d2fcd055-4776-40ac-930e-e21e8b3a6f40", "value": "1536:uUVrk5Rh6BuHDZIzwuZsri/zs/2ZZ8ZZZqa5ZvLAbYpfVxeRKZ3vsS800x:uUVofrHDakuZv/+qU9LQYUlZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640840767, "uuid": "0bf5cdc3-d1ef-445c-b962-8e10b7538715", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640840767, "uuid": "668086ca-c39e-4b8a-a161-380109a087de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640840767, "uuid": "44626537-9f6d-44b0-9696-46c295f96293", "value": "5367ca900ff1988ce2ee1c93b241c764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da769031-69bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640901608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901608, "uuid": "f50b2551-da88-4f77-9e83-0010f79f4855", "comment": "Malware payload (Mirai)", "value": "59e5dab2447e9f46fd36823f8ca85aa0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901608, "uuid": "d9027786-8bba-43ef-8de2-7875bfaeca23", "comment": "Malware payload (Mirai)", "value": "09b4fbdf354bb63dc39fe504ed2c87fd8d8f2a721b211be520ede8d3edd1e5a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901608, "uuid": "b2ac9276-8259-4752-bde5-a9aaca54c46c", "comment": "Malware payload (Mirai)", "value": "311237bd5133de48d262dce678b939f7d0de7db9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901608, "uuid": "3007b7ac-9374-4571-a9a1-0c61c65e7836", "comment": "Malware payload (Mirai)", "value": "17e04e6ece7061119535561d61b36181b0391bd46a1a63539fa2f8fb0a3b41fba221acf86c1839417382b8be63c69aa5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640901608, "uuid": "9c55028c-39c9-43b9-908e-2430c85a88fa", "value": "T109A309C4E253D9F4DC0945707172FB378B36B1BE223DED93D3A45E226CA1A42D8859AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640901608, "uuid": "21879e2f-e303-4289-83ef-c42043985a76", "value": "3072:oZfwBxoBfr8pNvs8jkukMb0q6Xs/zib/ahvw/Z8job79ubf:K2oBDgZBouNb0BXs/zib/ahvwGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640901608, "uuid": "0a11fcf1-da38-4734-a859-d8e71dbbacd4", "value": 103312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640901608, "uuid": "461ab2b1-ea20-4b94-99f3-76faefa97aae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640901608, "uuid": "0432aa2f-85dc-4cbb-ad5f-e1efe566fe59", "value": "meth.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c685af51-694a-11ec-9275-42010a9c0029", "comment": "Malware payload (BillGates)", "timestamp": 1640853042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640853042, "uuid": "0c9ead00-3c4d-4505-93bf-3deff4bda2a3", "comment": "Malware payload (BillGates)", "value": "53d2174b2d59a5cacf008312ecc42edb", "object_relation": "md5", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640853042, "uuid": "814fbd1e-cb2f-469c-8c71-7315f6ab684f", "comment": "Malware payload (BillGates)", "value": "0f31b2b43e5a106965f948b8e525211929c3d4d7218c6ee09d28528ab70526a5", "object_relation": "sha256", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640853042, "uuid": "27e67419-5176-445e-85c9-1bdf363d4021", "comment": "Malware payload (BillGates)", "value": "10a1bbe920849464e0d6a82d598f3e76dedf3e7c", "object_relation": "sha1", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640853042, "uuid": "1847b6f8-8ff8-4c8d-9bad-24cb7329275b", "comment": "Malware payload (BillGates)", "value": "bf2d1481e067c79c1a7db2fb8507984f4353169f2e9a73a6f5738b8fc4d48439b364f1fe16814feeedbe2133c21165c3", "object_relation": "sha3-384", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640853042, "uuid": "a713e331-a910-4541-b832-501183a5c684", "value": "T1D8456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640853042, "uuid": "668c8407-11ed-4c3f-a092-83502b274c3c", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4z2y1q2rJp0:745vRVJKGtSA0VWeoyu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640853042, "uuid": "1ac65933-692f-4e6d-8b23-6d30ddce368a", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640853042, "uuid": "59608092-9be4-4447-8fab-cedd3838915d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640853042, "uuid": "1c81068d-f028-43c1-827d-f176eee3077d", "value": "abc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b100ac-697f-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640875805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875805, "uuid": "46f0523f-bce6-4d24-acd1-aa4de1ad31fd", "comment": "Malware payload (Gafgyt)", "value": "3f93a37333dedc30bf6c150f1c39030f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875805, "uuid": "ac584d31-104e-4192-95fa-9d09f5944b57", "comment": "Malware payload (Gafgyt)", "value": "10f6f9406c7a6fe0cad60bce578d2c72b180441f98580c6a501c96edff895af7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875805, "uuid": "8cf0340f-bb4e-4d1b-8ec2-baaedaab2456", "comment": "Malware payload (Gafgyt)", "value": "c7ee859d06d31f5a19e91faa3923eadea51e625d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875805, "uuid": "4d05849a-34f8-4e44-a950-b9f897c40b43", "comment": "Malware payload (Gafgyt)", "value": "e925af1377f6281def55316fc419c0b433390caadccad3c4b5a2ac80f9b3a306f0a69f7da0c9f42058c4e54bec9b1f82", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640875805, "uuid": "23d3836a-5303-4c3d-8808-f64d64e400cd", "value": "T1F4832881BCC18F16CAD012BAF66E208E372167E9E1DBB207DC215F1536DA82B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640875805, "uuid": "38033514-3fc6-4c25-a355-59914107825d", "value": "1536:7JBG2crKJRW4XT2Rco9wa1GUcwrcmBcUfueOgtG3xhrx2yBGLt5mxCw3:7DG2/LCBTPGhh5SbmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640875805, "uuid": "cace51f6-2fee-4009-8052-6cddc7597466", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640875805, "uuid": "1d5f4e92-6a51-486a-9688-e9f305893ba2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640875805, "uuid": "0597c9d8-a2cc-4576-90c6-ae9a666cac34", "value": "Fourloko.arm-20211230-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebc5a49-6912-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640829004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829004, "uuid": "48b1500b-12fa-415e-a490-b1eca712a7c5", "comment": "Malware payload (Mirai)", "value": "7b04d28d00e19c9d95f7d56293b80d97", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829004, "uuid": "3eef6117-6211-42dd-984d-238de546c970", "comment": "Malware payload (Mirai)", "value": "12f5ae14094fab2fdf4f1f7cee670f39065c0edcfb8765c34a86f69333590730", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829004, "uuid": "8552b2c0-ffe9-44aa-b7f9-c3d5ddb9b14b", "comment": "Malware payload (Mirai)", "value": "cec1ffc0f3321a46fff91be21fd05c799ebc9e10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829004, "uuid": "bb2dba38-8f3a-4e33-84f9-885bdbfcb06b", "comment": "Malware payload (Mirai)", "value": "2b416c3e61cc0bed5213623f620f0b6075d2fc8ff82f3d71386b7591d76172dbeb526c9e06e60a048c3d2285ee7d7f99", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640829004, "uuid": "f0c8983d-2234-41d5-9c62-c72410087ab4", "value": "T1E85329C8A593F8F5DC140978307ABB66AEB3F13F7035E99BC3D86927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640829004, "uuid": "cfdbdd62-d1b2-47eb-8e10-51b1b8380b4c", "value": "1536:IEX9170vwHbQXZ5+qXDEuXi95TSW7V/DjObeFt6PuQ4ZA:d917iwHbQXZ5+qXA599SWZ/XObeb6GZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640829004, "uuid": "a37a592b-9dcc-4871-b502-a3a57955a793", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640829004, "uuid": "c915cf33-732e-4459-b33b-605bcd99db42", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640829004, "uuid": "dbecf35b-a607-427f-84ad-fced6a95c06c", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d545d3-692f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640841410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640841410, "uuid": "cce68e6d-0881-4527-9d07-465519a62dd4", "comment": "Malware payload (RedLineStealer)", "value": "270cedc8deec1e1f745fd97b56dcf98f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640841410, "uuid": "80e77672-8f22-4656-a4db-406e286f1515", "comment": "Malware payload (RedLineStealer)", "value": "19469d26a781545bc0347ba1ef6d885744ec26c525eafd7034155b1095bab742", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640841410, "uuid": "368c2ef8-645e-4234-89b1-ca8ab68f0dcf", "comment": "Malware payload (RedLineStealer)", "value": "91e63d7e5deb1313c0fe53e382ed1db9e86e0f77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640841410, "uuid": "0276e57d-401b-404c-b738-10112d1adaff", "comment": "Malware payload (RedLineStealer)", "value": "af21f0cc351d971bfddd1995cbb5253d8eeb21ff54b108e8b393c833fd4daa65b80a7649067e87d6d620dbe7484b904e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640841410, "uuid": "8eb2cf8a-91ba-4e24-913f-a468fbc042da", "value": "T17616339C86CDC691C38463FCA402CF7238B75BD344A238767E359BE6D599E27312B162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640841410, "uuid": "7614f280-fe72-4d4b-b72f-ba78f1a3d110", "value": "9a4258c5d218cf6e5c500e8415d5f5ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640841410, "uuid": "7bff4a87-c370-4a0b-83b1-9866619abe41", "value": "98304:Zp9Ot4tS1LodkaWgM/idfHcLRkRsgJIb36G1xQLhrxrxbS0v:AOsLoKeXYqGYLhrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640841410, "uuid": "ee7a4cd7-c221-414a-8c1a-d75b1a172f46", "value": 4399616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640841410, "uuid": "d103970a-4a24-4d25-a84f-fe6fd5415fc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640841410, "uuid": "5908fab2-528f-4eb2-84e2-2230598b8dd8", "value": "270cedc8deec1e1f745fd97b56dcf98f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ed1d53-6943-11ec-9275-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1640849982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849982, "uuid": "4853f460-88a2-444e-a7f9-7ae02f545d83", "comment": "Malware payload (TrickBot)", "value": "da42b3f16999890ffa59a2aa10a334e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849982, "uuid": "ed8a94a0-42f5-41f5-aeac-5eba701b16db", "comment": "Malware payload (TrickBot)", "value": "1a6bef8525a2b7eded1ea8c92e65cea20a08dc2fff175e37886c7f46846bcb68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849982, "uuid": "e67e3bc2-7069-45b7-a7c2-3f933dbf235c", "comment": "Malware payload (TrickBot)", "value": "421b355c7b3311961359bea6e886a316e410bbf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849982, "uuid": "058263f5-04f5-43d2-a0d9-668474fde07b", "comment": "Malware payload (TrickBot)", "value": "5e52701ea01aec1f13be846809d29634449a2cd6b83f9aedcb683030690764eecb7ba10e7dabe37cdb50e8d49f3211ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849982, "uuid": "4c6a808f-c1bf-4d46-aff6-63e714d9ba74", "value": "T1A594F11172D4C031E19721348A76CBB10FBABC7675A2AACF2FD5467A4F34AA1D32471E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849982, "uuid": "07cec098-dc65-47c8-96a9-a1f30dcb7274", "value": "297ed3de0a49d4831344ce5a84729097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849982, "uuid": "615b4d50-a3b4-4cab-8f6b-02a93fef4790", "value": "12288:5F61k9CuRQuCBifx5ABMQ2f6OArPtMZotp:fCuGlQxDni9rV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640849982, "uuid": "ba354787-afd9-4ab6-9fda-289f36bb9697", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640849982, "uuid": "e6ea584b-86cb-4a48-81ba-69654325e129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849982, "uuid": "c4eca842-49dd-4b04-b2c7-2a28e7438161", "value": "da42b3f16999890ffa59a2aa10a334e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577dafa3-6947-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1640851567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640851567, "uuid": "a96e65e1-b0b5-43d1-ae78-38c543fff98d", "comment": "Malware payload (DCRat)", "value": "ade53f1db17cc1e6bce6accead71b256", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640851567, "uuid": "357fb3dd-74ad-43d1-bba3-c8b6f26832c1", "comment": "Malware payload (DCRat)", "value": "1d075c1ea60ea19ed8e5456e89715fafaf9daf614113e71f2e81dafd4a903a5d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640851567, "uuid": "56d41b2f-b109-4d14-a678-8d13ecbcbd3c", "comment": "Malware payload (DCRat)", "value": "d94beda54da0ef7123cf7a6f24fb41fde676029e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640851567, "uuid": "a11c2bd1-2451-460d-9098-8eb4cf09204e", "comment": "Malware payload (DCRat)", "value": "e294cf4aa681b2c9e12f92522b9ee6b74afcf87959565b3a9714d42a4bd7c56e31eb30ec1692de9f93e32e91ae7628e1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640851567, "uuid": "1e1b69e0-7b3e-4d2d-b1d9-8d217977bb04", "value": "T1EBB43B242AED5A25F1BFAF7DC4F125958779B5637B27D70E08D1028A0A23701ED81B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640851567, "uuid": "39a47e52-14a1-43ef-b640-b190c23d573c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640851567, "uuid": "b26a68cf-9126-4ef9-8405-bf1e5cdc40bf", "value": "6144:VqqDLOykyF9y586WDj/Vx5ftLOWIKpW+HE/a1/oVdQrWOdbBidSk8OMC3YQ9:YqnOyNF9r6WDj/Vfflhk/koUrjqdSVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640851567, "uuid": "b5886fcc-d84e-4c9b-8013-ce7fefc11755", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640851567, "uuid": "e0e8724b-3993-4b8a-81ee-d365d2f04c62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640851567, "uuid": "da7537a3-4b36-49cc-a5b8-323b1c8d5ebd", "value": "ade53f1db17cc1e6bce6accead71b256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659e8490-6964-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640864046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640864046, "uuid": "a3ca575a-c4fc-4f33-a214-6f1b7f909709", "comment": "Malware payload (AgentTesla)", "value": "d218f9582c4ce24653a33a8f958ba418", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640864046, "uuid": "0ab6b6bc-5044-403e-a598-62cd27066423", "comment": "Malware payload (AgentTesla)", "value": "1d75484aa645df348b7832522a8f1f9926549734f92b7398acec5b2c9117d571", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640864046, "uuid": "d9d95841-6369-431c-995d-c37637982665", "comment": "Malware payload (AgentTesla)", "value": "e54633732cddc1da0e1eb83bc46d892649992fc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640864046, "uuid": "3b25862f-7ec9-47d5-b790-0b7abc896420", "comment": "Malware payload (AgentTesla)", "value": "137a93b71a68f0ee23becbaf443e37dca53562face9ff49c0a034728dd0c33d1ed429ba39386a2ae96c2e3d4243ffd30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640864046, "uuid": "d0a80f8b-29f8-49e5-be29-02c2f6150cee", "value": "T1FA942219375C8316E7BE2BB6246521740BF4FA1ABC25F36C1CD232D51673BA04921FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640864046, "uuid": "e8e0d9e8-68e8-4c87-84af-8f52069e5b92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640864046, "uuid": "cc4666c0-53cd-4410-a601-180e67e77686", "value": "12288:EouuqtSqbZaDcyK2xPDTfKxTdjVOLXoHudI3lGNc:Ehu2S8Za/HcHwtmlAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640864046, "uuid": "186285ba-decf-4260-8d27-e3a54fea8a79", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640864046, "uuid": "00c53f31-42ae-4ad3-b3bb-d2bea70c5384", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640864046, "uuid": "6173a9f0-370c-4401-ad7d-f78235864623", "value": "scanned copy(01).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8428503a-6941-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640849065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849065, "uuid": "e3b67939-91d6-47a9-8bff-e89c233df2e5", "comment": "Malware payload", "value": "767e19c9a9af79740cb21ecdc892bc31", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849065, "uuid": "8b2c7f17-fc42-4f37-9775-a9549a600884", "comment": "Malware payload", "value": "1fcee107586b02fd6965d26395c26301383e4bf05a796a732b7845c609dce084", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849065, "uuid": "54262b5a-25b6-4988-b783-10279af895bd", "comment": "Malware payload", "value": "f3967b23dbc6587d30e11723ababcb29f28ee08c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849065, "uuid": "2033fe14-0bef-4621-ac44-bb37ab13dbe1", "comment": "Malware payload", "value": "4be6ad29f07e69061bd70868aaf3947187f79026d5a638073ac66562ba8037e4f646e5fdcee931f63b337d2ed4cfea0a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849065, "uuid": "8b9a017e-359b-4edb-942c-21d135c7c744", "value": "T17D647DE37583D071C1961070B515CB637DF8AC3531E9809BF39909A9AE61ED2EA283DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849065, "uuid": "badca4a1-bd7c-4623-81fa-b9e4bcbe4a4e", "value": "2123bdc780bce58e13f1b21ac2cd5247", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849065, "uuid": "4197d187-fcf0-41ab-949d-bb5adc04d11e", "value": "6144:ynE0PKEVFcZ0tIZU0GnrxhcGXdZ5H63jG9KTpJtE:MENQIgI4VnY3jGAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640849065, "uuid": "944b3d34-f1ea-4f6d-b936-7ed2a27fc538", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640849065, "uuid": "a549d42c-3dd2-4930-8ffa-2362891bde7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849065, "uuid": "d64e70b0-8658-4166-8d7f-ca401dbc3893", "value": "767E19C9A9AF79740CB21ECDC892BC31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0568f567-69a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640891802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640891802, "uuid": "1f9caeac-ad92-4325-98fd-338b264ed7a4", "comment": "Malware payload", "value": "45c0ce53e5ad8c930e9781be28f191b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640891802, "uuid": "8ff55a9d-252d-4b98-9444-abf2d545ce7c", "comment": "Malware payload", "value": "23c021ec87c8743ef23796c3bfe371298388b4ef72fc6249b29858dc50ece722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640891802, "uuid": "d6449f4e-cfbf-48b1-a1c9-ee41d9eb80ed", "comment": "Malware payload", "value": "35f58c806a271c4d3d475e6a457d205039af3f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640891802, "uuid": "814cca78-dfd0-4a72-92ff-8f67d5055ef9", "comment": "Malware payload", "value": "7081f0962987f0f0435451e2602da298b150ead244c703a6dd53fd687f6278990d330fa1e524c2a2e4ce8e0fbe665594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640891802, "uuid": "a397ccf2-91a3-4c02-bce1-f870d25f6f4d", "value": "T165E422513A98F798F0FDD7B882A2955503B73563AC17D70C8CC4E1DA7937392AA91A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640891802, "uuid": "c2151806-b555-4bea-a01c-cb2e19163c18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640891802, "uuid": "3f92a30c-6dd5-4eab-bf3e-6c40b239ef8e", "value": "12288:cczd6JdBe4Tdc58VDvct8Fnbi4MDHfJ4UOVF/jaebHc1+qP8RfC02hxu:cczAJdU2dc54Dvc2F2DWtjV81+TRfCdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640891802, "uuid": "898e1db9-359c-4c40-91e9-f7d2971c7866", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640891802, "uuid": "b3adbb0c-15e5-41a8-a6a9-2251715d2757", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640891802, "uuid": "759e4744-cc44-48d9-8982-dafc1bf00014", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbb01ad-69bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640901610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901610, "uuid": "908651e8-7826-4b82-af4f-ec55f9ece717", "comment": "Malware payload (Mirai)", "value": "651303e153f4f9d5619b3a2efdd506b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901610, "uuid": "ee22ea5b-0b2a-4ddf-9e33-86a4f5c037fe", "comment": "Malware payload (Mirai)", "value": "242736e55fbac3c042ac30883a9ba0a31ffd1d79e5dab856bcef811e390fc0cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901610, "uuid": "ee45e7ad-3772-4583-bb77-0671db75eabe", "comment": "Malware payload (Mirai)", "value": "1cbae401f91bda24da1e954bf1acb12ad73ac545", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901610, "uuid": "5521321a-f33d-40eb-a312-292a23ba133e", "comment": "Malware payload (Mirai)", "value": "e83bb761ecf3fde1325697b101136174c016e7eabc89012aa2608eb2c1c234df37a12d27b44c96c25899ab9d63e4d6b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640901610, "uuid": "3c7454e4-7e71-435c-9586-6e85fd5a2d71", "value": "T154C3F752B8829A23C6E6237AF5BE588E332037E5D3CE72178C215F2077D591F0CA7A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640901610, "uuid": "9f777c58-dff8-424e-af8f-6a25b270cbcf", "value": "1536:K5sbwo8+c1rMjWmZp2UvLrUOd95FqSyo8MnCK96f2//AbLsLlD/w0/Ls6ftpf+Js:K5Ewr91rMazz2/4MLcSV+J4fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640901610, "uuid": "a72e72a9-f9ab-4175-9c5a-6ed12d2b63d5", "value": 120100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640901610, "uuid": "cd848768-400a-422a-ae22-08305de77f5e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640901610, "uuid": "bf23da7e-3245-4f75-87bb-2ed4123a8c98", "value": "meth.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d1f2a9-6942-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1640849685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849685, "uuid": "9bfb2292-8fb4-4faa-8ff6-6f7a94289610", "comment": "Malware payload (AsyncRAT)", "value": "52f13f6be6220affb4acc182f974dabe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849685, "uuid": "6ea66429-9fa1-409a-b50b-c98c04592083", "comment": "Malware payload (AsyncRAT)", "value": "2568251040acb82859e2944aac69d01701c95d89d3d28e30a02b5445a0946ca1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849685, "uuid": "986a89fd-5ca7-4702-8749-0a3940be0e34", "comment": "Malware payload (AsyncRAT)", "value": "275d2e03ece179e04787fd2fd4174589a4794d2d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849685, "uuid": "8885098c-64ad-4756-867c-334a159d6f3d", "comment": "Malware payload (AsyncRAT)", "value": "a653d7b9360ce8d60d9d507e9b45aad157f9de76c9c635c653bf32dffafdf89b0495c70e4ffd6b94b05e242faaa14a51", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849685, "uuid": "61e5586e-7437-4ed4-adc8-9888a7f7e4ee", "value": "T18A0527BD7250B6DEC9A7CE71CEA81C24AF64787B471BC307A01311AD998E497CF205B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849685, "uuid": "9047144e-a07b-45c1-98d7-33ac6ed68df4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849685, "uuid": "79d9a6cd-b300-4a0a-904d-e50bdcffb099", "value": "12288:dVVHCc8wDaKekbCxjEncgLbXrqTQuSMf4iqJFTPHjwYr+sBfdwQTVsY12jSNl2d7:dTqwuFkbCxjCL6TQkf9qfwY3TVp14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640849685, "uuid": "bac3b833-48b4-42f5-8982-f0b50cf556e2", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640849685, "uuid": "51505dff-537c-4c60-b0bb-67df0d5e232c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849685, "uuid": "79e68e3f-ac9d-4528-ab2a-5db377120bca", "value": "52f13f6be6220affb4acc182f974dabe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8353e3d6-693d-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1640847345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847345, "uuid": "69163183-f030-455c-8d3e-32961004d613", "comment": "Malware payload (SnakeKeylogger)", "value": "8e1c7e5360dca0b88a1ebc26ffd4165e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847345, "uuid": "28c87acf-0011-48f2-b728-412a81d4f654", "comment": "Malware payload (SnakeKeylogger)", "value": "29704c1c8f22aefdd760c85d19b71aa22fd35e0506804d629c92611f3df072bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847345, "uuid": "737ebd2f-4c73-479a-a4cd-0b979b48f9d3", "comment": "Malware payload (SnakeKeylogger)", "value": "6799cbe38bf126280c19ad00c0f7e3162f75345c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847345, "uuid": "bd7da926-ade7-46b6-b6e4-4b4f674bc0db", "comment": "Malware payload (SnakeKeylogger)", "value": "56b70945e6cec7677427bcdb3d63d0e5b28aa0732013626d5f2c49a9ae18a563a3ee3e6e3b6ea6f588d358cb1df14935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847345, "uuid": "327b2712-a14e-4565-af17-9159ed5d5df8", "value": "T1FE132AF3B64A2D50D8B10AF7D993E67403B41E1A39D7D98BF49A330B1433F92679094A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847345, "uuid": "d6ac8c69-2835-4349-bcc0-ac583451965e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847345, "uuid": "361867bf-d304-4bc5-a5ee-a56f4d1c3a5c", "value": "384:7bx2DI0LCeN3wAznuLZcvDv+hLh5T6NuXYAQBLhebkONQ8DRb9UWVawfWc:ZtAznq3mOYAoKkr85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640847345, "uuid": "a7b4f5a8-8814-4fb7-b2da-2b2ceb68ec85", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640847345, "uuid": "82c6e902-f427-4791-af81-755ee8471007", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847345, "uuid": "32ebb30f-c802-46db-a1f7-561f63c86c4a", "value": "ELQ-1100911803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db60e3e-691a-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1640832357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640832357, "uuid": "336ab501-33c3-4de0-84a1-bca8af812301", "comment": "Malware payload (AsyncRAT)", "value": "a4135f2786b618342c40ec68df21f10a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640832357, "uuid": "29db1729-c0c9-4aef-9aa0-7804c0752839", "comment": "Malware payload (AsyncRAT)", "value": "2b706f2254c046cc98027519e95de07d7e0d63ac61733db9c42fc2995b69fe48", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640832357, "uuid": "a2dfb1f6-4b36-4b70-833c-974726222aa5", "comment": "Malware payload (AsyncRAT)", "value": "9bf3badb4a0d7ca93a8e73e26b455b844acdc9ad", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640832357, "uuid": "d9c4e8e2-84c2-4d4b-96aa-2469b1a74752", "comment": "Malware payload (AsyncRAT)", "value": "0fd72ea68595c905ce7bc4ada52f64ce0800ceca876787c85c9eda0765a3e40eef99108e9bfc3c77a3ab600639a7fa1e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640832357, "uuid": "8d3d5d32-4109-4cfe-8c0d-f83f3d6340a5", "value": "T120233C007BE9862BF37E5F74A8F32145867AF2633603D65D2CC401975623FC69A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640832357, "uuid": "7f39f367-10ab-4a19-be42-f6b8b0a7eb99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640832357, "uuid": "77a08f53-ae0f-4ee1-8b99-1f36efff94e5", "value": "768:auu91TwQsOnFWUF01/mo2qDRWe3495ciMPIoNzpOTtV0bbBdRdufw1PQZVimwBDY:auu91TwSo2KicixoNzpOTtibbBj0fw1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640832357, "uuid": "7d1d48f8-51ad-4af1-a509-80eff30bd4ab", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640832357, "uuid": "75c8e46a-413d-4686-b032-ccc5cd1b3c0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640832357, "uuid": "447c6446-ece4-4125-9963-6dc6251ca93b", "value": "a4135f2786b618342c40ec68df21f10a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a1aa18-6945-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1640850834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850834, "uuid": "bc17fabd-a8ec-43a7-9790-9e89f4ddb802", "comment": "Malware payload (AveMariaRAT)", "value": "d2adb0245bec75c191eeb875b8f43ed2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850834, "uuid": "f45194c8-36d3-4a76-96fd-962bc64d1e15", "comment": "Malware payload (AveMariaRAT)", "value": "2c7756ea23a40db1be39e11f74818899f046306bb8fedfb4a7bc004df565a18a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850834, "uuid": "1362fcd6-9ce7-403d-a6ae-04b4775d6341", "comment": "Malware payload (AveMariaRAT)", "value": "c3fd2a51faaa1af01d1782d5f50cc16fc5ae4329", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850834, "uuid": "af46beab-d42e-4875-a208-117a5ca0420e", "comment": "Malware payload (AveMariaRAT)", "value": "ba68439e5182c13db478aaa8341882a2fede43a828b655ae954addff2d7f4f232deae07a6c2bc69c0fa7c7f5e0d17e0d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850834, "uuid": "866b04c6-68cc-4963-b505-4fd3b5aab537", "value": "T133F38D0237A8DF27EABA9BF55422208053B2755B2637E3488DC774DB21F6B200B56F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850834, "uuid": "53a7fefa-0e9e-4fe4-a5ac-06403350896e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850834, "uuid": "eabdbc0f-f5ca-4d34-a60c-8f739ed234ed", "value": "3072:S6wsatjMVqbvJy7Dnw0Zz9EbuJL2/5ipGlXnHyJBA8lPqBohiVVHy3K:HvatSqbxy2aL+0Jrqfya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640850834, "uuid": "68597f41-dcde-461e-a1eb-4114a17177ab", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640850834, "uuid": "d074a958-369f-48f8-897d-e2bbcbc9e98a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850834, "uuid": "4cd69ab2-4082-41a5-b547-d32cf44114c9", "value": "d2adb0245bec75c191eeb875b8f43ed2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e448d16-6945-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1640850773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850773, "uuid": "1585f668-1991-4c6a-8512-6ddb64d8d396", "comment": "Malware payload (CryptBot)", "value": "bd532d1e7f14ff577daa3a21557eeb31", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850773, "uuid": "400cffc0-897c-47f1-b17a-4cf973f525a6", "comment": "Malware payload (CryptBot)", "value": "2eab6eeca8ee894e70353f47e930c15fdbd599ae99357b17c2a412d60ecf4d98", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850773, "uuid": "43b5671e-6a82-4053-a308-35aeed7dab03", "comment": "Malware payload (CryptBot)", "value": "569003082bf7c286e8e6441eb93fb36c431b2364", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850773, "uuid": "a1208f91-67fc-4c8e-8a3d-6800de3cea33", "comment": "Malware payload (CryptBot)", "value": "2d652640b88e5ae7a6af9d16a09dbc9116d9f25a3fa720a75084b2862a6291ef33ea9589ee594e7268fbe4f260aa6581", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850773, "uuid": "9d8a8322-fee8-4c53-b53b-7073b4f6d60a", "value": "T11ED5332A7CB9D283C95151BCBD664F48B10ECFC892DC2718B7498178E895F0E8BD7AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850773, "uuid": "a6bfe368-4182-43d5-8b91-5b93b698891f", "value": "076fd3bc44050b5480459bd4d8e1a2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850773, "uuid": "592bfc4a-fa02-42c2-8e17-e4f90668364c", "value": "49152:tYHxEXQWFG1cI8Lkeq7uBUXubOuh81laSIxr31tklI5V4V7IdKlGHDmGbyeBZhtN:mgGyFFlK+bHsFIxbPkHad1fbFvht+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640850773, "uuid": "91e3b485-c779-471d-bc00-79a8a03ca610", "value": 2756608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640850773, "uuid": "27eeeefa-1f34-421b-b5d4-68d7c72c5b04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850773, "uuid": "a9a660bd-43fc-4ff7-9204-08e8377e79ab", "value": "bd532d1e7f14ff577daa3a21557eeb31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109af352-6944-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640850159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850159, "uuid": "808e683d-39e2-489c-ab3a-0964cd173a71", "comment": "Malware payload (AgentTesla)", "value": "36d3e4700d246075bfc4716cc329c894", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850159, "uuid": "1ac9e888-8461-4c2f-bc84-0cced3d93b2e", "comment": "Malware payload (AgentTesla)", "value": "2fa603dd41e95f257403b45ec3cba307ed33aa3d5aa605e8d8796b5ab28cac54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850159, "uuid": "8ad8f710-7bdb-4436-bb0b-6cb6f44f4ecf", "comment": "Malware payload (AgentTesla)", "value": "10697098cbfcb4d6c4be889305aaf9a1dd6a042b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850159, "uuid": "b328f032-4d59-4aa3-9703-8545312526ef", "comment": "Malware payload (AgentTesla)", "value": "28c483c24a9dc025da636e48469b09104b665433c295d73b113037a276c5dcef5cfd5e29e88fd3ea47b624103b11afc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850159, "uuid": "2a7f4fd2-98ee-41df-a2ff-0e2d1b9963e6", "value": "T1099412595A68667FFADD3ABF041E225083704231014BF3CE4DE1D2DA1AC6BE68610BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850159, "uuid": "80f5ef8d-0aa7-4caf-952c-328b6aa2e3ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850159, "uuid": "7f271892-2715-491f-8204-54618aed0d3e", "value": "12288:A/kKzoF7vUhgLllUp+uPQESz3orJFXx7tHMbctBHKSLxCpxkL9zc:AjoF78aBepXPIALhDBHxCpxkdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640850159, "uuid": "8048311d-797e-45c5-abdc-474d367bbfd6", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640850159, "uuid": "b591963e-0b12-47de-9c2a-c17433a5cab1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850159, "uuid": "b4ff192b-75c4-475e-82cb-7bb19d3778bd", "value": "DHL Shipment WaybillDoc_TransportLabel_PRG211001715505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e943f5-69cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640908202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908202, "uuid": "19a078c6-8eda-496b-9bf6-51fded7773f3", "comment": "Malware payload (Mirai)", "value": "db147fc41a11ce18be6d1df52bcc9ba6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908202, "uuid": "c728366c-46b6-4507-b140-2acf70ecd625", "comment": "Malware payload (Mirai)", "value": "32688a90adef20e15e99af62e369964193bd33b2fd18107df496715cf700ad3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908202, "uuid": "7184d2d6-cbe1-4281-9825-2d812bdce9fd", "comment": "Malware payload (Mirai)", "value": "f93293ec8dc37abb4e5702e5d8a1167f6ee04d52", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908202, "uuid": "c0b38ff9-2cc4-481e-a0a3-3f29dfacb6c7", "comment": "Malware payload (Mirai)", "value": "6c76e17ff1015b05ba94dcfec44716a25544e782a0afbeb79b7d7089f80f62db6ac9838f23422f0abb73ee285ac04a4e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640908202, "uuid": "30f1d0c6-44bf-4625-a813-462f3c4bff09", "value": "T18A534BC8A5C3E5F5EC001D793076ABA1AA73E53F2075ED9BE39E2573A903603E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640908202, "uuid": "00f2275c-5165-413f-846a-c1b992922cdb", "value": "1536:V5Vn4pXoqVExGxRP3MFnKiejGKO18HKaPWJR1UnDlgAG9Y:7R4pxuxGxB3MFnKZGHCHKd3+VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640908202, "uuid": "0ef45667-f887-4095-bd53-08a36100f1bb", "value": 63696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640908202, "uuid": "f58b59ba-805d-46e6-8a77-9b0e5d156d66", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640908202, "uuid": "4a7c305b-7b59-4383-8f69-a356cef64533", "value": "7ega.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76be5341-69b8-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1640900152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640900152, "uuid": "2335b211-383e-46fc-9b74-fa7b577e968e", "comment": "Malware payload (DCRat)", "value": "fd7e62de8a8b4eef4d2f7e8d4e2feefe", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640900152, "uuid": "90ad4943-e485-4fce-9aaa-31af228c21b3", "comment": "Malware payload (DCRat)", "value": "37728370446782dda4fd81f1bbcbe8759e00cc6d03aa4eb4822e73b02a8ce67a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640900152, "uuid": "3200b5f8-4822-4745-9c5e-87cd7652bcec", "comment": "Malware payload (DCRat)", "value": "9c5cbd8db524c1ba4d56077e3439a79f3312a1d5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640900152, "uuid": "9c9f9f57-04aa-4242-a01c-f535d53dcbb8", "comment": "Malware payload (DCRat)", "value": "cac10b84864018b924f05ed06dad35147d7f2a0592eec7c3c9c5832d0e523e49a0b69274101d8992484b04d63fc9e3f6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640900152, "uuid": "40b23729-c29d-4c2c-91ae-62305a26603b", "value": "T1D35533379B245C9ACCA170396727B5984F8BD4F2AAF7988606C423A4117C73363C6E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640900152, "uuid": "75499adf-5457-4e7e-a723-4703ec901f85", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640900152, "uuid": "211fcb74-e15f-4a75-8268-f22a3f7932c3", "value": "24576:TJ8QrLQjsUI0y5gKvlP5jKGUm+Pn83EOWwKOkOYe0IyucykidZkVJv:TJ8sjUOdvrcHn05PYebyudv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640900152, "uuid": "a967124c-5f67-4248-b528-9cbe0ac892ef", "value": 1376768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640900152, "uuid": "b2e908b2-3477-498d-9acc-9cdd91aa3254", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640900152, "uuid": "b81f83f2-ab3a-4355-99c8-18b26060ef54", "value": "37728370446782DDA4FD81F1BBCBE8759E00CC6D03AA4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcd63fb-6986-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640878850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878850, "uuid": "74baf9f6-c53a-4100-a625-a520726004a5", "comment": "Malware payload", "value": "b6f9becd464c2c07fbafd4649eadbfa6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878850, "uuid": "3b072436-10c6-4514-b529-9bafa6f74d58", "comment": "Malware payload", "value": "39ae14f17ff544ab0fdfb0c1420b72ecbd85c1707a89e82cf41af54f5bfd3769", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878850, "uuid": "0ec1716e-051f-4eb2-8f90-7c976d1df874", "comment": "Malware payload", "value": "14a833a1915d00f1635c36b3b17dca85ef6ea8e2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878850, "uuid": "6ade79e5-a97b-43f7-950f-743d6c52c2a6", "comment": "Malware payload", "value": "f0f1937d11fb48a83d261ab994d9213dc594548b8d0d7a2f93c1eb8f1d4f141c22682c64a2c494367d06f294a4b11f66", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878850, "uuid": "6263e17d-ad80-4955-b90f-4c142c6724a1", "value": "T17DF0C891E786E6BA01403289A449DA8CF1759D440689FBF157CCCACC6489C8D5F795B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878850, "uuid": "714f9361-9c36-4b0c-83c5-0c36ba5128af", "value": "12:SMRuPFs44ojU7w4S1sLW5BK2FsR84yaeWzw4m1sLW5WJ:SMRuP244oYjpW5BKxRLyrW7NW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640878850, "uuid": "7aa8d957-230e-4fba-b96f-84826c9f5b1c", "value": 596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640878850, "uuid": "f2a1cc66-0581-4e55-bc5a-bc95d2d17dc2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878850, "uuid": "24c13bc2-3761-4db7-8349-9dab88d93bc8", "value": "Invoke-PowerShellUdpOneLine.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dadee5c-69b6-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1640899251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640899251, "uuid": "3f9629b4-f9b1-496b-a381-e5f2a0de8382", "comment": "Malware payload (AZORult)", "value": "fe3cd494cd9a23a6520a880cd0231911", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640899251, "uuid": "611798af-c45c-43fc-b1be-5e7cab257c24", "comment": "Malware payload (AZORult)", "value": "417f49927f45584016e610907ea6a317eaafeb53b727c5f74928c61a1e03b9cc", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640899251, "uuid": "a8876072-02fb-4f12-829e-c324f062f552", "comment": "Malware payload (AZORult)", "value": "870ef3166255b4979bbab248f8d0f1518de35e10", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640899251, "uuid": "c0528210-5b91-4097-a73c-4c0f73228865", "comment": "Malware payload (AZORult)", "value": "413dfa21a1d7a8c208eed4bc96bea8c83e746161c8679c0bf4423f4c49bd4c62830c6cd3f17597f0f0c44829de4800c5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640899251, "uuid": "d619dbd8-d4cf-48a3-8d53-b8120e43781a", "value": "T12644CF1131D4C472D2536A7A4824CBB50EBFB8711662AD8F2FD919B95F28BD2973430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640899251, "uuid": "74880495-6069-42c5-99f5-46baaac851d1", "value": "ddee000756f8da4dc8a992d891b33f1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640899251, "uuid": "e924e7b3-faa9-4dde-ad0b-c6f3cf32a094", "value": "6144:Cgc9XmfYQL+fY7VEIILFWSh8SEFoSnLCo:UXoYQLH5Ti/ooSLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640899251, "uuid": "5761d58e-106a-4c99-8d3f-7d63cf6a212d", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640899251, "uuid": "82d3f684-ca44-4778-b8cb-6faca3954cd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640899251, "uuid": "4f64e02e-d5e6-4d80-9170-60d63e1ab224", "value": "417F49927F45584016E610907EA6A317EAAFEB53B727C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5a576b-693c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640846802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846802, "uuid": "f74fbf14-6322-47ef-b0d6-fd455edc5f24", "comment": "Malware payload (Mirai)", "value": "1431d4674006f57807c9212478e7aa86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846802, "uuid": "462804b2-60e9-4112-8f1b-c64ffcac9a45", "comment": "Malware payload (Mirai)", "value": "419a6655774dc4fdfdeaebb3de4fa82614372f8cbc90192d5e0d0a72d9293bba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846802, "uuid": "63a5de2b-97e0-4373-96a7-be865a6e200a", "comment": "Malware payload (Mirai)", "value": "cf1400657cbc8a00a5781ce4ddd75acc60f10ac4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846802, "uuid": "99b3be2b-e8bd-403d-a6f4-bc6f48bfab48", "comment": "Malware payload (Mirai)", "value": "c6609995402eaa601c5ce47a7b41b068fb9bac90a27829399a8f8b6576cde389184dc28936a6912c0423d215d0042091", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640846802, "uuid": "419d8c53-728d-4208-aa63-1ba98a04f2f7", "value": "T19D03E0CCEB859C6FCDFE2D3F40FA17F2D9486098A8E702819B0A4528710AD3FB56D464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640846802, "uuid": "542a47a9-cb9c-46a3-b2a8-6e31b1b6d16b", "value": "768:SLXbO7oeJdSqgV+O4K1UDALzvu2+dwlx9XAhYkG7zF5XFnlmhgkqW/2:SrbsJkLVprKDAfvu2+qlxNAhYjzF5DmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640846802, "uuid": "7ba2fb77-eade-4ca7-9a38-bd1233cee11e", "value": 40064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640846802, "uuid": "52d5e47a-1e40-441a-a7d2-10748e278423", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640846802, "uuid": "7861ec38-bbe9-42c9-9a03-1f57771ad96d", "value": "1431d4674006f57807c9212478e7aa86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c00d22-6918-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1640831569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640831569, "uuid": "df0b2675-4dc4-4e87-a91f-5a8f4e25693a", "comment": "Malware payload (Heodo)", "value": "af52f913f396cf5bf78d271cb1ff09ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640831569, "uuid": "ed23b401-e4e8-42d4-9754-eb737a2fa265", "comment": "Malware payload (Heodo)", "value": "42be8b7b5806fc3da370fd664af0e626776ac93a85eacfd6e37d07c79d5f3257", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640831569, "uuid": "d2e44b9a-efcb-406d-96f9-caae274685cd", "comment": "Malware payload (Heodo)", "value": "a7ac85d08d440d0e62ed26a5ac7dea8780acabbe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640831569, "uuid": "a67d3505-93ed-4b02-8303-5a2c4363b910", "comment": "Malware payload (Heodo)", "value": "6ac68c98f5fa6a1d7bc9898817a79fc235fb8328c04f4b55bb46c1cd1a4afa47275d75370c882ef9c172fb073ecccaac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640831569, "uuid": "d08c49aa-fe6a-4a74-8b5b-da268fb02004", "value": "T189E46B00E601E036E9FB10F7CAFB49AD45787B205396A9DF16D82DE69B281D03D3295F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640831569, "uuid": "66391c85-4baf-4cce-9347-d5ec5dab6d12", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/O:JapiKiBEmj4GbOX399Md9J/0TY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640831569, "uuid": "ce349105-a046-426e-a6c5-6647d80b2a33", "value": 695883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640831569, "uuid": "184bae07-4145-47ba-bbc2-4979865e1769", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640831569, "uuid": "0574a745-f03d-4f3b-9a6c-1ae5b3f66fef", "value": "emotet_exe_e5_42be8b7b5806fc3da370fd664af0e626776ac93a85eacfd6e37d07c79d5f3257_2021-12-30__023243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6769fb-69a3-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1640891147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640891147, "uuid": "aa8fb89d-eb01-4f44-bb94-b0235fa1d1a6", "comment": "Malware payload (DCRat)", "value": "f53787a96da6c79b66dbcdf8c8b83d48", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640891147, "uuid": "f4635476-0277-40a6-9bc9-7139211347be", "comment": "Malware payload (DCRat)", "value": "488aeadb7b5bfdcf2b7bf7f25518f6ccaf136e90bf81409838d7f8051938d076", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640891147, "uuid": "60751f45-58ed-4f50-91b9-ab7de8cfca52", "comment": "Malware payload (DCRat)", "value": "ef06280ae9b4f468c12686a31f54b1e5e3dee56c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640891147, "uuid": "023df405-a603-400f-949d-e781f8a6b244", "comment": "Malware payload (DCRat)", "value": "21d6277213b0cb9072de8f19fa3a055c31054bd699d505555f465a1cf4619622a3c49571e4afc00fbf632ec2a15adfd1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640891147, "uuid": "6b418cf0-e42b-4ef9-a82b-62cbf3322245", "value": "T14E953336A276405FE1A5ABF9837C15D0ACE399442DB440C91BCD3ABAF83B9CCDC58947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640891147, "uuid": "b80d65d5-806c-47ee-831a-2888c0168658", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640891147, "uuid": "bcf5257b-10d8-4295-85d3-b1c077ebb2ce", "value": "49152:iB7+6FQUFLgNcEZ0CF169qxFkHm3SzvYOdTEwb+NBjoBL75:aNQUJgihCF168iHmCTxye+NqBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640891147, "uuid": "73b0fbbb-715f-4a0d-8353-2173d9bd1fb2", "value": 1968640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640891147, "uuid": "a78d22d0-e212-4ff2-828e-f54623c64c72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640891147, "uuid": "9a5149a1-900b-42b6-9f52-47b815833d9c", "value": "488AEADB7B5BFDCF2B7BF7F25518F6CCAF136E90BF814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1e7322-6943-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1640849967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849967, "uuid": "4141777c-9eb6-49e2-93e4-12569066224f", "comment": "Malware payload (DCRat)", "value": "aa2e569d9af1b56279f911faec205cc9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849967, "uuid": "585b70da-bbd5-439c-8d4d-a34d761b56e8", "comment": "Malware payload (DCRat)", "value": "49ee9d2ee42e87a37a24a767703968a61dd2aa00cc6d434d5aff3c8797dac6c8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849967, "uuid": "817b3e7d-c50e-4445-8b26-0c89f54b006b", "comment": "Malware payload (DCRat)", "value": "ef9a3f69994ecd56a389bf5a182f8b21b5cbfe40", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849967, "uuid": "c9c1951c-c867-4c01-8d0a-05ae2dc2b870", "comment": "Malware payload (DCRat)", "value": "e06ee6477ec431c9cdb3ffd7d68f7bf2161d81a360bd58603fca973507305d5366624231e3ec2bfbb1a4595d2fdf9874", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849967, "uuid": "556739fa-66b2-40b1-893e-282ee92d8152", "value": "T13315120063E9151AF2D144F9A813BFE4F57B42AB9518F4F79CEFB89FE4113902A4588B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849967, "uuid": "e483bb33-4699-4471-b33b-28bda8fb0143", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849967, "uuid": "09d81bee-c179-4919-abf6-30cdbf4470bf", "value": "12288:5rBBI2IxQMvBRuo1wZCmbFdNnPROXlCRGdTfEx5TrC0lijZCy7hLaecbLybd7/o:9BnIxfd1wZnAlAGCTrC0R6hLaek+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640849967, "uuid": "2d61b8b6-32f4-4099-a95e-5cac902c912f", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640849967, "uuid": "21736acf-01ec-49ad-9cc1-f5588f4a2292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849967, "uuid": "d993a62a-0915-4ae1-a41c-e843a5c7672c", "value": "aa2e569d9af1b56279f911faec205cc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14085ba7-6948-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1640851883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640851883, "uuid": "54328483-185d-49ee-8877-53cb52dd7612", "comment": "Malware payload (BitRAT)", "value": "0b032e83c3a78f61fa3bf9cebd5a0242", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640851883, "uuid": "656f26c1-b192-4e04-88d3-0651a059ba22", "comment": "Malware payload (BitRAT)", "value": "4dbfb66b1aca617e4af7d11dcc9d97b11e61e94b188283a8f17f9078df30dbec", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640851883, "uuid": "50ae5a83-9325-447d-accd-885114ca9c16", "comment": "Malware payload (BitRAT)", "value": "f39705cde333b8c104f0a0381aa85de5a9d40e23", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640851883, "uuid": "07e0d821-301c-4829-9342-ecd91b1114f7", "comment": "Malware payload (BitRAT)", "value": "3eef0157d631b328050063492e89b374e5c4678fa95552aa45139bafad23858834236c5fefe91ae2d7acf96760f1074f", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640851883, "uuid": "961ae382-1257-4378-936c-8f12f1f90d76", "value": "T12A2622E871E1E2B9C85692712E257C3457F11DA1D8B0E94AECDDF8E2D570EF12B22603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640851883, "uuid": "0604a4e5-aed1-487e-b1e3-bd172174ff0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640851883, "uuid": "255ab255-bc33-455e-b8dd-d5bef4430168", "value": "98304:KmYHOtCiE4axqG+K2gur0diRZy9wwm2NHSj9EjH5NgYFc:4ME4aUC2g/Rm+Ue5iYFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640851883, "uuid": "574d59d9-78f9-4cff-b5ca-35c16ae8505b", "value": 4762032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640851883, "uuid": "5eb6aaa1-38c9-4dd3-8687-f0d6da9ed021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640851883, "uuid": "c9834510-ec7d-4a57-9d89-b95b7d510be2", "value": "0b032e83c3a78f61fa3bf9cebd5a0242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d95b4b-6959-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640859376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640859376, "uuid": "e59fc70a-0c49-4a75-81b3-3773bbe0e9f8", "comment": "Malware payload (RedLineStealer)", "value": "be277c5f2029e1e98383ddc3e6029a46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640859376, "uuid": "87941fe9-3a43-4651-8696-dd1e21f57fad", "comment": "Malware payload (RedLineStealer)", "value": "4fce37e360ca280e7aca9ce2eacef82c77a4b7d62bf23a447fe582ad79847d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640859376, "uuid": "f20d19a5-3398-4abd-a3ef-4fa52246e6e2", "comment": "Malware payload (RedLineStealer)", "value": "22e0a61b66d565190e0647057037b7c144cc0878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640859376, "uuid": "21e6488d-f1ac-469f-bc5d-041a36d949d8", "comment": "Malware payload (RedLineStealer)", "value": "ec553dc7187c0084cfc41bb77d7034ca2097cf851b1d045197bcb82c2fa5eccded86ebf794a234cfc2e72da9bf851b7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640859376, "uuid": "a5663ee3-cb7c-4a16-9bed-3e0810a23f48", "value": "T16835E9DD51D19949DDAD27F01DFBA88CADB094CA938773EAE32C95F0AB423C2254D4E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640859376, "uuid": "f7f9e504-ceb1-44f8-b283-3b8732f24070", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640859376, "uuid": "372aac3b-0ca7-4a32-8096-c2044ae6c250", "value": "12288:AE0n3CDbXyaUzmTOYg7Fc9h1oaHVzDnb/4ZJ0HUvi4kGJSnP0tvCbgmVADs5:xp9kSboa1zX/ukxqvC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640859376, "uuid": "7e971dab-3b6b-4430-af75-214f00ce21d8", "value": 1123720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640859376, "uuid": "d9dfc568-767a-4776-98f1-88660da70395", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640859376, "uuid": "862a3b5c-4f21-4398-a88b-30cde05fa579", "value": "Skinschanger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aeb1004-69b2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640897609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640897609, "uuid": "e7992348-5cdb-4441-baab-1a59ef9a94b1", "comment": "Malware payload", "value": "c4706861aa9c71d48d29feb9313504c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640897609, "uuid": "c1ae44dd-5e58-4915-ac31-a930f4e3cd70", "comment": "Malware payload", "value": "532f44b536030d09e0eba0736580a4fc010e77ad258342643275b846337684d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640897609, "uuid": "8d853efd-3874-41f2-a699-06e0f830478d", "comment": "Malware payload", "value": "4c13aba185343f89af000e45ea8d317994efc642", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640897609, "uuid": "7c0a19fd-08d8-4381-bafc-7da5ade185f9", "comment": "Malware payload", "value": "57f81e4bb30e60d512c21d564b3355c2ac787e327db511afb1e913240cdc64b8217e22c246c2c542878fc71590271814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640897609, "uuid": "f0816f2b-877f-4689-8b37-c557d2f185d0", "value": "T10B55335A94960D53A3E35101ADF53FF13D5279130AB262900EEBF1BA81790E78F17ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640897609, "uuid": "0bd28d75-afd6-4c02-9576-c88885c2f33e", "value": "24576:3pHfCA9zTKrUXa5JTrMPnZz129Mbej/0RzZhstHm37BEYq7PrYx:3tCA9Da/TaZzk2a/09PslmrzqbrYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640897609, "uuid": "bcbaa81a-3e25-49b8-9ede-a8efa8058fde", "value": 1363808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640897609, "uuid": "0bfc4425-3546-44c4-b845-b055f6a2fcf0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640897609, "uuid": "8620267a-3447-4c0d-bdbb-02ff2c50cfb1", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5212ea33-6943-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1640849840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849840, "uuid": "0999ff8a-eb7f-47a7-b65a-8de3db7c1765", "comment": "Malware payload (Smoke Loader)", "value": "c4a7b64813c8e57198670a76afb73996", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849840, "uuid": "c24e92b6-4b29-4ea6-9bfd-162762cfa3a5", "comment": "Malware payload (Smoke Loader)", "value": "538d3533398c3f0adbd59483ced973cf35803de5e9356e8dafb5f6bea4049a30", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849840, "uuid": "7eadfeb5-f674-47fd-af58-025513baed91", "comment": "Malware payload (Smoke Loader)", "value": "f531e572031911cbb5b8d5c5c69def2c6e085223", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849840, "uuid": "95e55edb-8334-4114-8b43-a80cb7d8e70e", "comment": "Malware payload (Smoke Loader)", "value": "611398535904a48203eb3c079f5962072e21fea8278cf1d6f4d91ba368ea22ba5ea336f19c67d535b43bd741bbc85698", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849840, "uuid": "76b2389c-afe0-443d-b559-e7a937fa3a4b", "value": "T1E1746B10B7A1D03AF5B312F489B99275B52E7EE16B2491CB13D627ED96356E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849840, "uuid": "f390f79d-0743-4021-b925-2b4b1bf75c6a", "value": "df4770b655576d07220de10802675da4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849840, "uuid": "b10b780a-9bf9-4702-8053-d92fa6ad14b8", "value": "6144:e1oq8M2qTHjcbbbrcOUrhroSjKyZalJX3JiM:eyV0bjcbbbrcOUrhroSvEJX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640849840, "uuid": "c7b87a76-7103-44db-8506-a467d758de26", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640849840, "uuid": "99a881be-6caf-48e4-81f1-c2310dc3d205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849840, "uuid": "3cf9cd99-a7dc-43fc-a3ac-e209c8e5c2ab", "value": "c4a7b64813c8e57198670a76afb73996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f509f4a-69c6-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1640906153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640906153, "uuid": "309dfd2b-e657-472f-b2fb-a6621d7cd55b", "comment": "Malware payload (NetWire)", "value": "60324306cb83ad2ab8192344f1b15e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640906153, "uuid": "8975e3d1-6d2a-4bd5-b849-f159f1be00e0", "comment": "Malware payload (NetWire)", "value": "53e50cd638abfb79fd2e29d0b2c39305c937852b1c314b06358b37d73bd31e98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640906153, "uuid": "31683d68-7535-4c90-af2e-f96bb3e98038", "comment": "Malware payload (NetWire)", "value": "ffd772ea71bc69582c57f03cebc32b1fc4d39083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640906153, "uuid": "dd660dde-9e0c-4f55-a7ad-e5481df0ef25", "comment": "Malware payload (NetWire)", "value": "d7de5ec09cabb6a54cdf2a0500dfb8eb4edbf15fe218ec9a33400ece1cc99e3e2fae4600928e5c7b5eeb5520bb8b99ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640906153, "uuid": "0991eef9-9511-4fcb-b628-9af34d3ac956", "value": "T173F46D16B29048F7C47316789C1B9A949DAABD3039389C422FE41E487FBF2913D3DA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640906153, "uuid": "2d9cb8dc-c84c-47c9-aad6-f1161d17ca63", "value": "99937d85363a3c33a12be9c7a06b26e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640906153, "uuid": "28baf04a-784c-48c4-8c2e-c038eca1f79a", "value": "12288:7oXNijZcTb++heFqzrCJib8HOLOkqFGix5FDhUcyr:7oX8mvbeFqyJBHcRiNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640906153, "uuid": "986c9781-4e8d-4c6f-8f35-97d803eb8650", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640906153, "uuid": "ba3f5e7b-5a30-438d-bd19-4febb336b1e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640906153, "uuid": "2223f037-2bf1-47c9-9774-82154e10f119", "value": "60324306cb83ad2ab8192344f1b15e44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fd63ca-6975-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640871377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871377, "uuid": "b0e4527e-a5c2-4010-bc84-7eafc37e090c", "comment": "Malware payload", "value": "287d612e29b71c90aa54947313810a25", "object_relation": "md5", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871377, "uuid": "809e6be2-f83e-4f55-9e03-472ac5e0cf22", "comment": "Malware payload", "value": "54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b", "object_relation": "sha256", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871377, "uuid": "b4136a4b-f4c5-4783-92b8-6936976a8998", "comment": "Malware payload", "value": "8f35a9e70dbec8f1904991773f394cd4f9a07f5e", "object_relation": "sha1", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871377, "uuid": "c5ba0fe3-4f11-4b98-ba3c-71d751272f08", "comment": "Malware payload", "value": "901d2002dff5c6da794ddcbc593fc1a1c2913309e7ea74c4e5daf8d7b3f44ff2af095bf665cc6ab1c25f3b792d5198f9", "object_relation": "sha3-384", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871377, "uuid": "e62bf9c7-5925-4d62-91c5-33bf44767832", "value": "T13594AD933541C371CA177D7695789AAD4B3F8D3816BAB987B3B83B8F5C303918636902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871377, "uuid": "e0004092-617b-41f0-81d1-f0354b7973fd", "value": "a59ed1599cc2f8311b215c83c51a2cc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871377, "uuid": "fd1dd7ca-6e0c-4972-b3a4-c98f232c6877", "value": "6144:CdaRD0n4URr6zIKgDCVh84DLn5X3lWiDSVS1dGSLaYWis:XRonpRroIKgDCY4DLVlW3UiSL4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640871377, "uuid": "63f231af-24db-49ee-97b8-4b3eb73f2a80", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640871377, "uuid": "4e2ec53f-cf2a-4093-ac39-8c526dbefe67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871377, "uuid": "3d7af880-cb5c-44a6-b7cb-1f0c6979339f", "value": "54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690b92a7-6922-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1640835705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835705, "uuid": "43555f6c-20f3-4a91-945a-a4a98e30428a", "comment": "Malware payload (Heodo)", "value": "3c83c46ea9bd5f81268ef1c2660f9fc2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835705, "uuid": "be71f20f-fb8a-4db8-8c14-fd2c56b93439", "comment": "Malware payload (Heodo)", "value": "59660ef18e24bfbd9096636c446c87a7c42c0000867ccf0686e57ecf98f219d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835705, "uuid": "657dff7c-b099-4a5b-9cca-61887ab4ec93", "comment": "Malware payload (Heodo)", "value": "7cbf0739f595d62a2949e071cd58f1c40426ee30", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835705, "uuid": "c7e7b8db-ce9d-486e-9982-b71e1bbdf0e7", "comment": "Malware payload (Heodo)", "value": "0301933469ebb39ebb5aec72e2d7ecedef4dda1adb18f2887f78372179bde187735b347d94ecedafa451f29f8ad0e85e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640835705, "uuid": "72220703-2ac2-4d5e-b91d-9a375a99b3ad", "value": "T18C44BF10B181A031E8FF187A89FAD56A8A7C7A100B80DDDB63D8197D4F775D1BA309DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640835705, "uuid": "ef8bea2e-3a5d-4c4a-be2d-057d4584f522", "value": "92be4bf7cb83ac405a16f7ce39bb2989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640835705, "uuid": "f65d4261-fb9b-4533-9e65-daa1f701a3e8", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBTj:6jIG/pjjuLbJLmGshoCUnWTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640835705, "uuid": "83c6ec58-be2e-49bb-9d96-0373a61e1606", "value": 260727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640835705, "uuid": "e67b5277-77b3-4365-8610-eca841fd92d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640835705, "uuid": "430a5dd3-67aa-4cd9-a6db-1aff2ed3fcd1", "value": "emotet_exe_e5_59660ef18e24bfbd9096636c446c87a7c42c0000867ccf0686e57ecf98f219d5_2021-12-30__034140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7bb521-698c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640881237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881237, "uuid": "c2d2da03-76ef-4855-ba35-04817d8feae2", "comment": "Malware payload (Mirai)", "value": "c352c6c1c07785cd77707193d762694b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881237, "uuid": "0f4bf629-685f-4865-b094-b0c993e82193", "comment": "Malware payload (Mirai)", "value": "5ae7867d7884d65aebeeb7911b170e1df07a387f608278dffa3dc855e248a752", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881237, "uuid": "eb82ef67-5675-4486-8fbb-8aa68a7839fc", "comment": "Malware payload (Mirai)", "value": "a7e8c9a98b74a26e2a6f634473ad801012dbe9be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881237, "uuid": "6586a93f-94ce-4dc5-ad3a-8f9abf9fd2c5", "comment": "Malware payload (Mirai)", "value": "6b1a28a877b67005684dc410c4d329c79122d0ef4458b681784e2b568532b419673ed7e74a33ee25e963e7a457b0de39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881237, "uuid": "04749e34-5773-4fa7-ba76-884fa210291e", "value": "T11F538D75E42A9D14D0C40130B4A8CF705F63F2C982663EF75AE546B6540BEA8FA0DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881237, "uuid": "e99397eb-1fb0-48d2-a1f8-93ca550130f7", "value": "1536:WjhwW9QG/+D+WgBVKqlk3viCwCl+Ja10:WuW9QGmibO3viCwV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640881237, "uuid": "0bd56ccf-5949-42bd-b6a5-7caf843f010f", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640881237, "uuid": "5835b818-19f0-48df-b15f-3215c6e374c3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881237, "uuid": "6e71ba83-a1a9-4240-916b-2926f0622c84", "value": "c352c6c1c07785cd77707193d762694b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d197ae-6987-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640878941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878941, "uuid": "02a37a44-1685-4863-a556-2da959932d86", "comment": "Malware payload", "value": "e31c8a2f6211cef6fe1df3607435de11", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878941, "uuid": "0f109238-41e7-4c34-a685-80d2cf4cf198", "comment": "Malware payload", "value": "5bd3c4e2e1d4907d7df181671fe8f7a3483fa441dc7ccbb7fc20fb56d02b3ed1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878941, "uuid": "acb87f53-917c-4734-9d5b-cf461f441f5a", "comment": "Malware payload", "value": "8920940e9f24a17830a3edac755b8a2387b52b63", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878941, "uuid": "76080a4e-2e08-4739-8ef2-b06760abcf75", "comment": "Malware payload", "value": "d2ef5e02f13faac08b58106c6f04865735850c971794c8c78520372e6af81ce3c66d95b55eb2d254c20dfe9b4d5b0d66", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878941, "uuid": "5263a638-4045-470c-b7d1-33b433414e1b", "value": "T121D02B59F389FB6E4D404683D101D595F26450055709B9C213CDC8DC497FDD9A0054FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878941, "uuid": "40326461-6115-41ba-8de5-e28a1f50aba6", "value": "6:EnRwmoMUtPt3RlnxRmzp3YabIpHKAnyg+mgQ49XZoAPoA3C:EOmoMcPjlnXim7pHbny7q49XZ3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640878941, "uuid": "44d6cdd1-9435-403d-a18d-86e59509cc2a", "value": 283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640878941, "uuid": "93d1ea89-a7e7-426b-aa73-b8cc856da917", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878941, "uuid": "6449dd29-db74-46ed-a1ba-524533204a87", "value": "Invoke-PowerShellTcpOneLine.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2de0686-6986-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640878859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878859, "uuid": "eade0c4b-5861-4b16-bded-52b0a52c672b", "comment": "Malware payload", "value": "8bab641d3e118afaca84886659f7690b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878859, "uuid": "d864cc69-93a9-4204-a408-c626bfe3ec3c", "comment": "Malware payload", "value": "5eb2815a4f0d05d0bb3b3ffd4088eb9fbfde317838ee8d5872716742fdba7c6b", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878859, "uuid": "f449c16d-b9a7-4ec1-8f9e-2ed7e2d50020", "comment": "Malware payload", "value": "70961b0732af44e72ac20c78f644e2293a7a140b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878859, "uuid": "251ac9f8-2883-4c92-b699-5843bcfc9d55", "comment": "Malware payload", "value": "cb7408ce377f3d52d79f1a1e2dc22f81c21170acc3467294cfe34c37c0dd3d7c40f8f761c34c90cf92a4808c28825328", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878859, "uuid": "058035ed-1796-47f8-b9e5-aa819a02845e", "value": "T1A301DC9187ADCA662BB0206AC848EB0A7868160B5126FE55E3DDCC84E55FA1CA1601BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878859, "uuid": "a39be5ef-7910-4ffe-995b-1497491a6db1", "value": "12:tVGxSMcPuBqHV6LHPMZvLkpfQKcVZgR4Y5E7E2aBXi90MoVCufYEm8jLKsPjoHX:tVGIXPpV6LHPqvLk5+9AE7EgCCufYyjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640878859, "uuid": "3cc47bdf-8c47-4ec3-a9a7-f84539433638", "value": 736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640878859, "uuid": "e4db8afd-2aa2-4294-820b-b30e36a131d0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878859, "uuid": "69e84347-c1a0-44d9-8a39-94d95a481f98", "value": "generic3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d676b193-6917-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1640831164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640831164, "uuid": "a7a7e893-1a52-4c5e-b0c5-2f875aa4032f", "comment": "Malware payload (DCRat)", "value": "a710687bd248c76a7155412960601904", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640831164, "uuid": "3040e587-8677-43bf-aee2-c22668524f8e", "comment": "Malware payload (DCRat)", "value": "5ed80f3e0c9d4c92b05864fafffd410becd10235c0cb34cd1ac46090dc83f293", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640831164, "uuid": "774ea0e7-f920-4d9d-be06-dd44eaf2cae0", "comment": "Malware payload (DCRat)", "value": "0c39b589e82b345c701d78c38802536de9a6bd7c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640831164, "uuid": "90ba2216-04ae-42ff-91ad-0e1e34895eb5", "comment": "Malware payload (DCRat)", "value": "cee26cba4e9058e6703a7265f1bbcfa220818a8c8ce6b44e5f0803d528a66a6863f76a28fbc23411c630206dfe09e77c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640831164, "uuid": "c457f5fe-3eca-47b4-9ab0-c3dd53ce1d28", "value": "T193553347D6205178E043C776F8D1D01E7148C4199AEEEED53BC23829D29EAA2467FFE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640831164, "uuid": "5e44b3c6-eedd-48ad-b142-6109e33fddba", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640831164, "uuid": "36729012-8fbb-41b2-a3ba-e870fbf0d85d", "value": "24576:lm9q3pxKENU49+v5RffCyq/F+dE+ydZpljRnxwTZLpin3TQDGJnnm16:M9q3pxKENU4+zffCgE+6ZplNxwxpinjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640831164, "uuid": "3d422dcc-8e29-4c34-ad29-aa3e60a569f5", "value": 1401856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640831164, "uuid": "2cebc9de-2b07-4891-b8f6-36cdddb3eed1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640831164, "uuid": "327c404a-9088-405e-9f21-81f7e04c2355", "value": "a710687bd248c76a7155412960601904.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c616ca2-6921-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640835174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835174, "uuid": "6cbfb0f5-70b4-4ec4-b191-7cbd27faeabc", "comment": "Malware payload (Mirai)", "value": "cd1d4738a83a61c9673177d2c4a50d6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835174, "uuid": "b33d053c-8d1b-46f3-9771-3228c27edbf1", "comment": "Malware payload (Mirai)", "value": "6635ba369cc750dafd4d743bb375d60ca10afb6406d86736dbf6d2b4698ad919", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835174, "uuid": "c60584e0-85d3-4fd4-9687-9f45727a6fbe", "comment": "Malware payload (Mirai)", "value": "2e3cef943ae03258c0ddf15a56cb059ce986cd34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835174, "uuid": "cde0aa9e-20e3-47d6-ad32-9f8f3d6fb6a0", "comment": "Malware payload (Mirai)", "value": "4b061bb979a81c1d052ceea9c3288aec370a4f62e78270050915bd0ec58ee78e244aed51af9ed070c2220527dc83d907", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640835174, "uuid": "2cdf68f6-dfe5-4613-be3c-ac6b4690f0fc", "value": "T1FBD34C56FA408B13C4D51779BAAF42453322A794E3DB330699285FF43F86B9F0E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640835174, "uuid": "55ddafaa-7fbe-43d0-94e9-f048231b5245", "value": "3072:SYSxILof0GA7PBRDN+na3z6jl5ARttl3yFr88rM/9Qm7wGgWT3:StxIM8hBRb3z6jl5stbor8YM/9Qm7wGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640835174, "uuid": "b4be1b34-ca24-4108-a777-fb2d9e667961", "value": 141238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640835174, "uuid": "8833ef30-1025-4875-9312-8386efddb96c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640835174, "uuid": "3cb1a742-51b9-4fea-875a-36812252b5c4", "value": "cd1d4738a83a61c9673177d2c4a50d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e12fce7-694e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640854557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640854557, "uuid": "68967781-0f6b-46d3-876b-b50431bd8436", "comment": "Malware payload (Mirai)", "value": "42282295fac8a9550d5064b1ddcdd8d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640854557, "uuid": "87340fc4-2096-4ca3-91de-d31886201566", "comment": "Malware payload (Mirai)", "value": "697c4bd2894f72f4a8e8111afcbfe40be3e16dc4f0178672049ed06322177d6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640854557, "uuid": "bced0b8f-298f-465b-a56e-becd6f749818", "comment": "Malware payload (Mirai)", "value": "1d2d22375501f78b5be51813667d88feac81e5b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640854557, "uuid": "01052397-0d22-4929-b518-75f4a112cc91", "comment": "Malware payload (Mirai)", "value": "a9c00132b47830e5241ad777636ec2e34e68d1a1326ab7651a6091acfdc82b13ec159acda04ce8752cc6211589968f0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640854557, "uuid": "50756f66-cc36-47b6-954c-c6a8542bb234", "value": "T17A23F17955110BBADB3DA8B24BF01A200E4C17F3A963DD157685E613AF059F532C3AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640854557, "uuid": "c2d909ea-35cd-4d31-9692-b8051e813fa5", "value": "768:YVNSFS4Qa17UDPjW234wswEgY7xS0GYFVRY0fhd67PQg6agJgGlzDpbuR1JhHCk2:YSSa9UHW2IYM7xS0GeVRpy4gBgVJu/Hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640854557, "uuid": "107cdfb9-ca73-4e4a-b527-536353a2b55c", "value": 45696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640854557, "uuid": "51c9ac4f-4884-49c4-bca8-81d6efe57950", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640854557, "uuid": "dfadd1ad-75b4-42e6-b80d-2cf7e4be25e2", "value": "apL.mips-20211230-0855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3305eb33-693c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640846781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846781, "uuid": "cd80f22e-d2a5-4213-94e0-2370ce07a551", "comment": "Malware payload (Mirai)", "value": "936ac72516f9b5a68e500943fe41c562", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846781, "uuid": "a1050db1-dcc7-42fc-a8c9-6bfe5f820f2a", "comment": "Malware payload (Mirai)", "value": "6a365ff2df901bb556c8e114f4f3dac80b15ee63a1575dcc3564e732ef660bd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846781, "uuid": "81d21514-afbd-4943-9766-074d07c811a4", "comment": "Malware payload (Mirai)", "value": "0b281a259356da2455bd1eaf2740f1d440564ab5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846781, "uuid": "b12d713a-ef42-4e58-bbbc-a31721224cda", "comment": "Malware payload (Mirai)", "value": "6879ff4873b5265f6e8eb9d192627bd00939c3290d93275aa9bacd67c0d62fe058d7c7ba483e6cb5d6d08b19d53feac3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640846781, "uuid": "91ed66a4-f001-4915-b364-ef4465352288", "value": "T1291302605B30ABE2DA7415F6786CCE9FFDE557FDD1B8B161A4A025C83CA030419ED781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640846781, "uuid": "c9774ef1-031d-4567-9669-3e03d02095b6", "value": "768:Yk92toKrcZHwPEbpAOg9aoq1C3mEuUhirLIc/U784PjfMlP9q3UEL7F:T90oKrqwPsmOgck3mDUMnpUIl+LJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640846781, "uuid": "c86ff2bc-1336-43dc-be34-6691a67343ae", "value": 42284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640846781, "uuid": "f10e935f-ce35-49e3-ac0e-836bf86a3868", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640846781, "uuid": "b9b05791-f14f-4fc1-8e1d-2528b3c079d6", "value": "936ac72516f9b5a68e500943fe41c562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9df575-6912-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640829005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829005, "uuid": "c4e21b7d-c275-4075-98f8-732df4182f54", "comment": "Malware payload (Mirai)", "value": "916ba0100fc9e5900588058ff32d056c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829005, "uuid": "7842aa3a-b222-4289-a37a-99a6e19bc4a9", "comment": "Malware payload (Mirai)", "value": "6f6697e7cc6550d800a625fc1d27912cc8c92920dca99e393e7b0a055676c05a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829005, "uuid": "2051a159-b25a-44ea-b842-c0534af6622f", "comment": "Malware payload (Mirai)", "value": "e61d87797fd41bf3295d6706bd6603700aa40776", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829005, "uuid": "985c6490-f364-471d-8ac2-04ae540846f0", "comment": "Malware payload (Mirai)", "value": "bb52df86ddb964c06236755f19dd1f9eeb20671793c70d52e9f82b11e68841e95d9623f7e7794677475a89c4f1bbddc3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640829005, "uuid": "b947c42a-4cc5-4244-a3a5-bb294a2a5b5d", "value": "T16FE34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640829005, "uuid": "d8f95267-0ed3-4c79-a7d5-fb02e00d691d", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1Qe:walgM69pe0QmlTvI8t9mrsplDKZUQQBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640829005, "uuid": "50fa798d-97d6-43aa-bb36-710e05d7e9f7", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640829005, "uuid": "7b111a23-1f6f-4929-b471-4592c8c60e9b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640829005, "uuid": "99acb72f-a753-4701-b72a-60618765e835", "value": "loligang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff34f2c1-6986-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640878906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878906, "uuid": "31299544-d3f0-4089-a979-49a38031347a", "comment": "Malware payload", "value": "43a5d16efc741de09daaa0b975cd4c6b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878906, "uuid": "4a8d5355-2838-405b-956c-7ddbb0d6df83", "comment": "Malware payload", "value": "701b6b9ddb2f2c6ab6907e65b964a19604906f319bcb58172264a8ecac75c9d0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878906, "uuid": "0dcf6484-deba-42f1-b1e8-b83b0341b14f", "comment": "Malware payload", "value": "a27e3942ffd664b35a93237599728aba264ac36a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878906, "uuid": "5e228d10-b4fe-4ebd-8348-4cf86c4e4c28", "comment": "Malware payload", "value": "c3980a3f255cb19ce35adbd6e3e9fa3e68a95ae96a430f8518ef92eae4cbd65a421043e82bfd0e2ea6f12b54804582a9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878906, "uuid": "ece19a3f-14ac-491e-aaa3-cdece8d652cd", "value": "T18921F24BEF85894A12E270BF9CC8FDCD7099511B904A7C2F7D5DCC68B409C0CB0245B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878906, "uuid": "83068e11-0ad5-464f-80f5-c5e78e57c315", "value": "24:JlIdEMrUol8G9I+GIuPLtrnenFJumLMSuE7E7evRz2UqSuvqmUXtOR8GBvT:Md7rvVSIu9YJL7QesUqn0tIVBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640878906, "uuid": "6be24e26-0e98-4715-b7b8-82ab4c337f04", "value": 1435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640878906, "uuid": "c5abb9ce-f3c3-4a1b-afe9-8d925143b7ae", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878906, "uuid": "a2c00384-ab7d-4707-93dd-8b8859dd69dd", "value": "generic2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1402f4f-6906-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640823854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640823854, "uuid": "c8ed01eb-5de9-4032-8f8e-5c28e8da131d", "comment": "Malware payload (Mirai)", "value": "5a4ea6ab05ed629091b0d62fb3dd1bd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640823854, "uuid": "8a53796b-613b-4014-ac84-8b7fed1a8b41", "comment": "Malware payload (Mirai)", "value": "71e55895e6474ad615aca06609f0f0024466799c86c295b666979cb9032c4c68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640823854, "uuid": "525876bc-01c0-47f1-8fc3-c07dd96794d1", "comment": "Malware payload (Mirai)", "value": "07a432d8842a54392c7d1f2c5ddb3eb32061613b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640823854, "uuid": "f56837e0-964c-4c68-9c27-2f6c8ae14924", "comment": "Malware payload (Mirai)", "value": "b5b1d5ae091289d38ab0b7df371f521e099641ef30ca9100fdc454aa6597c0adeb136de4eee754cffc442fd36ad7fcba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640823854, "uuid": "b0723225-9225-4695-a3bf-adb10f6d5d75", "value": "T16983AE76E06A6DC4C1820338E4985C7C9F13E6C4A3731EF65AD24B5A144BEE8F845BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640823854, "uuid": "8df19867-73ab-4750-bc42-3e08a87704fd", "value": "1536:+/ONAz1/0+P/IAzqDvENhVnPUKdloEiS/Cqbk5caUszL29KCRLNuEH:+WNQJ3AQVXPUKfoG/Bb8xUszLSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640823854, "uuid": "290d8c80-cd71-49f6-a504-8724337890e0", "value": 83820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640823854, "uuid": "d44be636-fe52-4a11-93d0-a3635aa306ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640823854, "uuid": "176af388-f194-4e62-b2d7-922b2e18ad18", "value": "5a4ea6ab05ed629091b0d62fb3dd1bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bc54eb-698d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640881634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881634, "uuid": "be0910b6-70d0-406e-870e-cfd92d51437b", "comment": "Malware payload (Mirai)", "value": "aae26aada2b20558620652f8674092b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881634, "uuid": "04ede1d3-5ec7-4a14-8635-f039c80c36cf", "comment": "Malware payload (Mirai)", "value": "74fb338b00d2350ac44e80e75bad6d3bee3259b1d51e235d8cf09c4553ec67c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881634, "uuid": "aefbcd33-17eb-4a8f-a5d6-f4a9ffbdeb1b", "comment": "Malware payload (Mirai)", "value": "7ad5893d5d69c342701193772df9d9deedc6f2f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881634, "uuid": "04f24420-5ce9-428b-9fc9-b90f1a38fc10", "comment": "Malware payload (Mirai)", "value": "45540352d637cde663cfd18ecfce45d951cd63e242b9bfa833e8baeb9818a734dca64ab17b978010e2dcafdf857ad802", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881634, "uuid": "87037943-05a7-43bf-b37f-a10053811176", "value": "T149634A62B8815A27C5D423BBF66E468D3B2563E8E2DF32079D312F5137C682F0D27A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881634, "uuid": "99a7a853-f642-4a2d-94ac-28ba36614a5e", "value": "1536:HJh0i6BIG8vgiNTFu91uf+oIHELX7qBI8rDJa10:HJh0UUqfJuE7GBprD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640881634, "uuid": "613ca66e-0dac-4e44-a935-5d8b98058492", "value": 69028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640881634, "uuid": "fc2c26a3-ea5c-4a02-896b-1b2c1f03c94a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881634, "uuid": "2b06c19b-dc0d-4049-85d0-b43af28b8efa", "value": "aae26aada2b20558620652f8674092b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634800b9-698c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640881222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881222, "uuid": "ae4b9077-d104-4115-831c-5e8321318dc6", "comment": "Malware payload (Mirai)", "value": "aeb248aa8ef92beeea0f693bd635723a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881222, "uuid": "bee28892-930a-4861-8d8a-6808435d8a61", "comment": "Malware payload (Mirai)", "value": "750fbc058c18f0f55a52be468fd2c9aa0f33338e2041305caf0e4c16f36eeaa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881222, "uuid": "521d31df-6c0b-4c45-bd01-9b7e05669725", "comment": "Malware payload (Mirai)", "value": "81e9c9a03809124b5a723af890069f07f2f1850a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881222, "uuid": "34f1e610-c6e7-453a-9cb9-db52cd035df9", "comment": "Malware payload (Mirai)", "value": "84f3d9d256df314b602883c448b816eac414b849064d5fa89f0b0a5ca1df7591da3408a08b5582632ccfa771294eea27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881222, "uuid": "f18a5535-0b15-4204-81c6-badb540ef4e0", "value": "T1B183D80D7E21DF7DFBAD823487B78E219A5833D626D1C581D1ACEA005E7064E241FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881222, "uuid": "db99d8b6-49ab-40d4-87b6-9f098c42d0b1", "value": "1536:YJcFgZRC592Xogr5OtUsrVQWQVRDOBQjw8Q4EqJa10/d:uc0CfEomeQWQVRDuQjw8QTq4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640881222, "uuid": "5bcc0b1c-f030-4ab1-8da8-37460879257b", "value": 85636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640881222, "uuid": "f66ede49-645c-4c48-948d-9a93f91f9946", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881222, "uuid": "7f8ffcfd-3219-4787-8468-62afeee26497", "value": "aeb248aa8ef92beeea0f693bd635723a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70b2da4-6975-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640871457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871457, "uuid": "2c1ce44f-6e91-4c2a-a2af-204ff16235f8", "comment": "Malware payload", "value": "fd695898fe6a205ccc86d920d8ec6a9b", "object_relation": "md5", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871457, "uuid": "d4736e97-be03-472b-b916-cb34a408c446", "comment": "Malware payload", "value": "77680fb906476f0d84e15d5032f09108fdef8933bcad0b941c9f375fedd0b2c9", "object_relation": "sha256", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871457, "uuid": "904b8fca-2653-4057-8b7a-a7cf3f2ab698", "comment": "Malware payload", "value": "f75a8b0e6af6a3447f1ea2f85089cfebaac7d936", "object_relation": "sha1", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871457, "uuid": "f9b77954-6c51-48a6-b65d-d12449949485", "comment": "Malware payload", "value": "4da29f2bf85a98b8096a8bb2c9d484de1c4b3071a10d35937ec98da14f00ed79f6a97ef05b23c43393293e32521cb5bb", "object_relation": "sha3-384", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871457, "uuid": "15a031f0-ccb3-465c-aa51-301432fe0cb5", "value": "T11FB47B11BBD1C076C26631744E5AD3B4AABAB8319F35468777D02F7E1E306D29A3930B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871457, "uuid": "0927c5c0-9353-4077-921c-6d1304e3570e", "value": "9bac2e35c1c81ff04ab8fd0a24b8316d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871457, "uuid": "414a220c-796a-42e2-8eb5-7a4c0d42bb4a", "value": "12288:w3kUNnIL4Qyva9myMBBWRb4omnOlydGuGfViW9n:oeL45a9c9oCOlydEN9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640871457, "uuid": "553b93bf-42da-470f-898e-c1831585f38b", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640871457, "uuid": "8306fbbc-941d-471c-99a6-7ba682b381fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871457, "uuid": "e22e1b36-739a-4c42-be19-6d8cd3d1f59a", "value": "77680fb906476f0d84e15d5032f09108fdef8933bcad0b941c9f375fedd0b2c9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea55e44-6915-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1640830372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640830372, "uuid": "8773eb0e-341c-4804-ac57-af66ee42ec13", "comment": "Malware payload (Heodo)", "value": "86af07d3e753a591a80c69b9a27369f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640830372, "uuid": "be87f922-7218-443e-9229-d3e4c64fba6a", "comment": "Malware payload (Heodo)", "value": "79050b25475d154df3d6fa25274c95265776bc2bbdd1a892d7f7f1016c027ca5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640830372, "uuid": "2d667104-f6f5-49c8-b1da-ff0002216a42", "comment": "Malware payload (Heodo)", "value": "68accda553306db5500c01e1cadf52dbaac71c72", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640830372, "uuid": "7566b526-d47b-4d78-9dde-d3124417a4d9", "comment": "Malware payload (Heodo)", "value": "6c510e673f951e4937d5bd6b9bf85e939baaa65883d873cb835a986e940d67e85216bc9d807a50b56267e8687b995b5e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640830372, "uuid": "1f74ebe7-b05b-43e0-a2ca-37a399254e5c", "value": "T1BA645B40E201B02AEAFB10FACAFB097C99A8A71453C7A9DF56C86DE5D7654C03D3152F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640830372, "uuid": "503be4be-d5c1-4afd-a81e-9a5d98c0cf6e", "value": "6144:J2BMQOuPfzZLawDZj1MKVeRByYUTSRRuEhwdSyGVWHmw2MnvXkWP:JKUuppiKVoByYUTsRuEhj4GbOXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640830372, "uuid": "9047df91-fb01-42c0-bd31-d55b0e15e9e2", "value": 322123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640830372, "uuid": "dc805e41-bdf8-4909-990f-77e2db3c2300", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640830372, "uuid": "a71c0333-3c25-442d-beb2-28b59a2f690c", "value": "emotet_exe_e5_79050b25475d154df3d6fa25274c95265776bc2bbdd1a892d7f7f1016c027ca5_2021-12-30__021248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381bd9bc-693c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640846790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846790, "uuid": "9ca583fc-6942-4aff-9560-ad6ad520fbc6", "comment": "Malware payload (Mirai)", "value": "234204092d67919690ee231bf52332ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846790, "uuid": "5d19cc59-6c9a-4675-8837-547ffc5eb5c7", "comment": "Malware payload (Mirai)", "value": "809243289a4ec256ee0e7aad94eb0c45daecd11ff8753219ec1ff1438ce390ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846790, "uuid": "ce531cde-7217-4419-9e1d-8302b737ef44", "comment": "Malware payload (Mirai)", "value": "16a320a61df2a7c215094d3632b7007831210c49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640846790, "uuid": "a6e7fda5-f007-40bd-80fd-b88e4c8fa483", "comment": "Malware payload (Mirai)", "value": "87eacbb91b1d59360e04934e2dd31a657a92ecbcbe1df876ce2bd1d379166709b0bb8c80a0b7dfec9d1c25a0f47f8754", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640846790, "uuid": "c13c7a7d-bf0d-4d80-b7b9-756d7705282c", "value": "T1185302A1BEB8DC57ED3048F7DC960F48BE360AB9E2EB34275A04445CA50CF216B65F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640846790, "uuid": "e65c1900-c273-40a2-bba2-c8172b819ae5", "value": "1536:OSrLOqtgLqY2qaMl0g+HNR3xfy8LO9oNc36haKW:OS3OqavFa66RNLO9oNc36MKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640846790, "uuid": "1dd14a47-abd5-4840-9fa7-41d38210a162", "value": 64352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640846790, "uuid": "c9dc03d1-e5db-4d14-b435-ccefde1df5f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640846790, "uuid": "bd03112a-845f-4a23-9da1-3422ed1ccc7f", "value": "234204092d67919690ee231bf52332ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61a894f-697f-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640875804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875804, "uuid": "aba1c242-bf7c-4676-8e58-554c45cc974a", "comment": "Malware payload (Gafgyt)", "value": "8aedd9a5dc18dd087a9fffd8d76bc688", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875804, "uuid": "f4c916a1-7d36-4c97-a9e2-665cb1bb827e", "comment": "Malware payload (Gafgyt)", "value": "81b66a8e13fb96d8fa736c058d48b06553914db95dd97c78af90b59db5549286", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875804, "uuid": "575d2b55-e9ce-4918-968f-6323b582a64d", "comment": "Malware payload (Gafgyt)", "value": "62b81fa8aefe887ba40fd231456ee90fbc72c5ab", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640875804, "uuid": "1b90e200-6858-4d32-a26f-e933addd9979", "comment": "Malware payload (Gafgyt)", "value": "6a33d71213d98598389b94faddb8cca8680a8e9333883c6cca922400f990ad42e2d6411417dd3de487266317aba6fdae", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640875804, "uuid": "a9824f85-a5a1-482a-a39c-4db33ee3da24", "value": "T128E33A46FA808B13C4D61779B6AF4249332397A4E3DB73068D285FB43FC666E0E63945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640875804, "uuid": "0f7368d1-9570-4cb7-b134-015a4eba1294", "value": "3072:0BjXxsbHSFeDER1Z4XgY5yrMpCPNnhYnOs5q3gVuT0hivo9hbml3crm6aLdl8uGm:0BjXxszSFeDER1Z4XgY5yrMpCPNnhYn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640875804, "uuid": "d48e7c62-7bed-4ddb-b7e2-b0c8e8402739", "value": 155308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640875804, "uuid": "1b23cceb-7f8b-4fd5-bee8-26ea70fc3b5d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640875804, "uuid": "ed8f8660-b9e4-403c-ae84-4c7455ae022b", "value": "Fourloko.arm7-20211230-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c82c6c-693d-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1640847158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847158, "uuid": "212e2394-0417-4132-972c-252b8a9d632c", "comment": "Malware payload (IcedID)", "value": "52d12bd4537025133a02ebf10f49918d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847158, "uuid": "d19e9863-253e-4cc9-8a05-d48ccf2a7cd8", "comment": "Malware payload (IcedID)", "value": "8366e238982bac70c27f1884d72407ba93de0d5a2f7fb7103e275dfd31d084aa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847158, "uuid": "90c75a1b-812d-42b7-b832-6c34bf5e4758", "comment": "Malware payload (IcedID)", "value": "707b37559152634a87819a378bd8ed7d9214d13f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847158, "uuid": "d528af6e-c6e6-4f9b-98a2-08e66475b0cd", "comment": "Malware payload (IcedID)", "value": "e975ae6d8be2bffd582b69db74c17dceff6322d61dd2afe4f8e1924e48c0f2eb9ed6b8476174758e288f6059f4cfbb1f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847158, "uuid": "f82a86ab-f8e3-4474-adf9-d4d5e5af16cc", "value": "T1C8733B6671A3DDAAF4C109346D8AE2A0EDB87C654D04D9C372F3770E98B12F455ABE03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847158, "uuid": "f97952e9-c9f5-406b-a020-61ec0fe0e3ce", "value": "768:Z/MMM1tMFus4JTOqYKgDZXngJuq2tTuyvuql8c1GFZIdJ6jtQlQNBOTHxPIz/tZS:KwKgDZrtaIdPhW/jTEQMieblLRkd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640847158, "uuid": "dfe63400-4150-4b30-be5d-b7b093ade190", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640847158, "uuid": "e8e90044-f12a-48de-be81-93c926fafb3b", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847158, "uuid": "ded63e96-c131-4d57-8314-a8fd41f33ef3", "value": "legal agreement,12.27.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c50cf5-6975-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640871433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871433, "uuid": "1fcf326a-d081-4e80-a37c-4060dde963c1", "comment": "Malware payload", "value": "8904341c8d4f2c339775524f38bba304", "object_relation": "md5", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871433, "uuid": "86f78335-889e-4b32-ba21-2fc8cdbd035c", "comment": "Malware payload", "value": "840ce62f92fc519cd1a33b62f4b9f92a962b7fb28c12d2f607dec0b520e6a4b2", "object_relation": "sha256", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871433, "uuid": "1ccc1dcd-5d3e-4196-8953-392cfba47408", "comment": "Malware payload", "value": "f9990d6aebd55d6e7b4012a5fa07578218309efc", "object_relation": "sha1", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871433, "uuid": "46665367-d872-457a-8d74-dd22bfe42f05", "comment": "Malware payload", "value": "2048c8dfc016f4c1168ac129c19b21bec6a1be4ed9dc3b8c0ecb7edfe3b68d15ea6e61cb53e5f13094b7925347c5595c", "object_relation": "sha3-384", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871433, "uuid": "2128eee9-d634-4258-8fcf-81137f181a3d", "value": "T1C27523113A870E06F1BFAB350AE3D287853ABC959E108F4B3345770E15B6951E5E2B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871433, "uuid": "efb82a2a-cabf-45d6-afaa-3ebb3c91ad4e", "value": "24576:GCvh6IxlPWI2ho26uu/QR0GxlApxu/02tHMaemYKboleG2eIn+o2IRuIpIBlZr:pZxQDiBd4Kk/02Te8SeGAn+HIR5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640871433, "uuid": "eb8ad2b8-8b7b-4736-92a0-70b0cfe8eda7", "value": 1690112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640871433, "uuid": "b5be565a-95e9-4339-93e1-5c238b8f3c56", "value": "application/vnd.ms-outlook", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871433, "uuid": "ffd9f476-cb13-4c70-84d9-d4b5f4449843", "value": "840ce62f92fc519cd1a33b62f4b9f92a962b7fb28c12d2f607dec0b520e6a4b2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef54a70e-691e-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1640834212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640834212, "uuid": "ea22312b-f444-4363-90e9-2ce3e34f058d", "comment": "Malware payload (AsyncRAT)", "value": "23ca2d2462dd957e3fe565b3da804b8e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640834212, "uuid": "2cdf9e03-e0f4-4564-b5d4-34a17ab08387", "comment": "Malware payload (AsyncRAT)", "value": "875ddce13022bafdf9e27f3eab2af78147c589037bf9c86192091e3843cedb16", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640834212, "uuid": "724d3efe-4034-4f9e-a237-cc7e04d96cc4", "comment": "Malware payload (AsyncRAT)", "value": "5cef3c9f8e5ac090cc67908c7cdbae58eb4b3b7a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640834212, "uuid": "16d69f51-63fa-46e8-b2da-3ead5c279c03", "comment": "Malware payload (AsyncRAT)", "value": "f14dc08909cada566e336fff06d3ae4a1585950142579dbdbeba6a3582155fbf4ef319c113f07bcc4f43142fa5a36f06", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640834212, "uuid": "6649e334-7d89-4473-9abb-e254ef70f4b2", "value": "T1A093D026E38546B2E9F807F2F447993267F81F963027E06B209D7FCB79423590A4FA45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640834212, "uuid": "b5708f5a-b18e-4e1c-8c67-764d526778df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640834212, "uuid": "a83214d4-2984-435f-a8bb-a600cf10aa85", "value": "1536:EGkkmxS+H6+N9cPppv3s54ldQxM/TsLi+vQrpazPcXofYsxzR17TtJeqZp:gkmxbHVI68d4kX6YsxzRB5JeqZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640834212, "uuid": "216fc6a6-bcf5-4180-847d-09f5c7230276", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640834212, "uuid": "3963295d-c189-4f14-bd07-0673407c96f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640834212, "uuid": "42d23556-c2df-4d15-89b1-bd8ce3e8f612", "value": "RFQ Product Inquiry Catalogue.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff8c953-6908-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1640824550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640824550, "uuid": "b204484b-c328-4dc3-90ec-fa3c8db8ec4a", "comment": "Malware payload (njrat)", "value": "a359db2841e75ed24c3d39b7af55ea31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640824550, "uuid": "3527a938-73d0-4e19-bba6-fa091aa5b1b4", "comment": "Malware payload (njrat)", "value": "87ac8c78f79072416a0d38c7509602d28e367e990f31cbfaa667b59292391c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640824550, "uuid": "734173ce-2d54-4add-94b1-df030445ba46", "comment": "Malware payload (njrat)", "value": "db9b0ceb9ce3aca3403892f1b43e764891e3a047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640824550, "uuid": "a31cf392-554b-43a8-9598-fe96cc8d6e8e", "comment": "Malware payload (njrat)", "value": "b497468835d19fa11df92a3ff078c00dfba0eb48346e929e1d8dc6d96c007c901fe12caf1e9bb9390ca9ad5e7e47af5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640824550, "uuid": "43aaed4b-c7f2-4321-bcfd-8c3e51fb5f23", "value": "T1F693E74977E56524E0BF56F79871F2004F74B44B1612E39E48F219AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640824550, "uuid": "acf5736f-c142-4537-a493-82ab02ba8b81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640824550, "uuid": "b0f62874-af51-48af-90d3-651a30d1aac7", "value": "768:CY33UfnWXxyFcxovUKUJuROprXtWNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3NsGdp7gM:9U/WhIUKcuOJ2PhBjEwzGi1dDdD7gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640824550, "uuid": "f402d19d-bda8-46e4-9fa0-d12642408398", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640824550, "uuid": "e7b2309a-e633-4a16-aaac-dc4662a38d3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640824550, "uuid": "b39973c9-5937-4c63-bef4-6077f79a0737", "value": "a359db2841e75ed24c3d39b7af55ea31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da81a86-69cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640908217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908217, "uuid": "f2aeb1c2-084d-46c2-a852-b8776f337746", "comment": "Malware payload (Mirai)", "value": "3ebab770738c03890ad4252875c74671", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908217, "uuid": "96a3e296-47c8-4a94-9625-178499b240d8", "comment": "Malware payload (Mirai)", "value": "8a3c366f2d405e45a7539fa341e4139023622b81f179c45a3cee815494c6c232", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908217, "uuid": "0501309c-5307-47a0-878c-e8f1cbffc752", "comment": "Malware payload (Mirai)", "value": "684d89e79c3f2b921653b724af7c3363f845499b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908217, "uuid": "af93d1be-6dba-4320-a9e0-61c159167e6f", "comment": "Malware payload (Mirai)", "value": "c6923aa0f5cb641a7775bb41523779f07e6890b6923dfe4f2920b0e8ad40d39d0f23db1dd6b40118815e2c00470cf256", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640908217, "uuid": "145ea119-d5ea-4ca3-981e-29df0f34a5fc", "value": "T1D363F782BC80EA26C7C00677FE5F508E331567D9E1DA32429D255FA07A8FC1B0D6B796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640908217, "uuid": "e270033f-224a-44c4-b2e5-3d849ff50221", "value": "1536:xBnoU1QAu0Ud66g2aIlx0lB8t46uxtayJToN:xBoU1Q90384BxtRJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640908217, "uuid": "7e6274d2-d7a4-455a-b7b6-6f92addf4c47", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640908217, "uuid": "d2905217-bd48-42b0-9de5-61f70cf94516", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640908217, "uuid": "5df34533-4f83-4b83-83da-509edbe22006", "value": "7ega.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abcb920-6979-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1640873128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640873128, "uuid": "71510d85-8b23-4708-89e2-e04f91ba1fd1", "comment": "Malware payload (NanoCore)", "value": "ce7068e4369c0d675b50fc86f416cb97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640873128, "uuid": "98d72422-1d82-426e-a4a0-2f88aaa8a099", "comment": "Malware payload (NanoCore)", "value": "8bf0518cd0c607aa51073dfe422f6af43ab8b43523bd0c182cc6172c9ecb9072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640873128, "uuid": "7acae0e9-1727-478d-9032-3765f0b4a38c", "comment": "Malware payload (NanoCore)", "value": "570b0c8ed35ba7a62e1721aee5b4ed1824235133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640873128, "uuid": "737ae9d3-8513-4afc-a149-e95e68dca97c", "comment": "Malware payload (NanoCore)", "value": "ef1be0506471716f1171567717a4fdaa1d6e4845cacac216ec481d638e929e71319dcaa7107530061060fd4d60480727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640873128, "uuid": "e455e393-c97b-456c-95f2-6ea96f930ffc", "value": "T182E49B6C7783CA62EF8E8372C9130754EA1A0E023380ED7153D695ED974ADF9DC89897", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640873128, "uuid": "e9b1e092-0d23-4747-b279-4549bd00b529", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640873128, "uuid": "b39a7678-a2c2-4c1f-9fcb-358ffc56260e", "value": "12288:N346nKbjdEoL+bXGxzflReFCPDar7eWhHtwqp:PGpfTKCbarPhHtwqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640873128, "uuid": "1492d373-5b06-49ef-9a0b-14052d376aa9", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640873128, "uuid": "7f6e442e-49be-413c-99f6-0a8e0a44bba6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640873128, "uuid": "6013741e-6ec3-4e79-a7f5-0693004bc9f3", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c80adbe-69b2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640897558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640897558, "uuid": "d2dfb390-0809-4215-9927-16821a4fdbda", "comment": "Malware payload", "value": "4767ba2f13005ca6a74c994b0ebe33dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640897558, "uuid": "bb6ea9ea-b87b-4a8f-b161-49e6d014349a", "comment": "Malware payload", "value": "901ec2f017d11c1569c211c3a3279c5f613d117e349c5a1efe881a5003ec6b17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640897558, "uuid": "47e56c98-5172-4f96-9d80-ad48783da1e5", "comment": "Malware payload", "value": "30f49d1a6a85525290fbccfc5dd4436e5cafc26d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640897558, "uuid": "037a0ce2-0cb7-4168-8e57-439db26f619e", "comment": "Malware payload", "value": "7c24849f6fb51c237cfcf0e23b2a183524a6f9330be431a3596406da4a0b90e208c605ee7710c8afd04674dd0b262b6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640897558, "uuid": "ae994023-5bcc-4ba1-b334-f9488d3b1e63", "value": "T1C6853C65FC8C6D89ED526133CD7078A6632BFDA231686CC0E5FC3933AB2AD954473864", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640897558, "uuid": "7576310f-9aac-438e-84ba-95b14726df9e", "value": "23a6f7b455b4639b7e61f1e5210339a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640897558, "uuid": "bcf36417-fcd7-4f4f-a262-eb93681f6358", "value": "49152:27QzrciQ+dagX06dt7r/PDAqGiVXOPrfaiY7jUNUTJn1vPLFjp:2m7X06dt7r/P8ZykrfaiY7INSnPNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640897558, "uuid": "f1890ca5-4c52-4d57-9928-06412dd3f78a", "value": 1840848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640897558, "uuid": "396a9e3c-21e6-48f4-a2c6-40600d9ed5be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640897558, "uuid": "e93e44b5-47c2-459b-acb7-b4be2651603e", "value": "4767ba2f13005ca6a74c994b0ebe33dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b815141d-6916-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1640830684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640830684, "uuid": "91870f0b-2a9e-46d4-9ff4-ca45e3f783d4", "comment": "Malware payload (Heodo)", "value": "6ee82ab651a53b1abb5638ae40ee85c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640830684, "uuid": "6d5ef9b2-0d1f-4793-87c9-a72f788ea55a", "comment": "Malware payload (Heodo)", "value": "9189207e5da21b8219e8f89de8ae9ab2de9bb07d2fff464b817d8358d918d6be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640830684, "uuid": "207eb90f-d5d0-48d2-a58b-3bddc992f46b", "comment": "Malware payload (Heodo)", "value": "87df78df50c839fa69ac3304c37065c65e5d88b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640830684, "uuid": "83a12a4d-565a-4300-a603-b9ebc13cab93", "comment": "Malware payload (Heodo)", "value": "00fb139cac899e02317937c3da6c4683ad85b118f5b49acba4a07d918534985f43e17e7b4e4931623ccc797081f10ad3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640830684, "uuid": "878a949f-e9e1-45bd-b419-8f3c8c9fe45e", "value": "T11DB45B40E301B13AEAE700FBCAFB49BD9568AB14238669CF55D86EE5D7284D03D3251F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640830684, "uuid": "d2eee781-ba25-4e67-92fb-c364c011c529", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWua:JapiKiBEmj4GbOX395", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640830684, "uuid": "e255750f-63ad-427b-b8d4-eadc3ec473d1", "value": 523603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640830684, "uuid": "e7507b02-3456-45ec-b999-d0a570f4a454", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640830684, "uuid": "12a38a98-c29a-4d3f-b783-09da2f282a8c", "value": "emotet_exe_e5_9189207e5da21b8219e8f89de8ae9ab2de9bb07d2fff464b817d8358d918d6be_2021-12-30__021759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87491de-6934-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640843623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640843623, "uuid": "d3524131-70e2-44d8-849e-c9cc9fb919f1", "comment": "Malware payload (RedLineStealer)", "value": "f3279df0dfc992ed2faa0e7581fb01cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640843623, "uuid": "26f6b35e-9de9-4a03-8943-20410a05f0f8", "comment": "Malware payload (RedLineStealer)", "value": "9e1565a4e0af404cf7eb096a60ddb70b5d5adf849312ea6f76c6374841759166", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640843623, "uuid": "9b027207-cad0-4e68-89b1-90a9dafe513f", "comment": "Malware payload (RedLineStealer)", "value": "5e1405d7d35724eef6e9d62e239abea69862b474", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640843623, "uuid": "c81be80d-6ab5-4b01-a131-59a0ad4fc3a1", "comment": "Malware payload (RedLineStealer)", "value": "c10475637950eeca5c5add64eab88ca7965e795f25864106bbbdb5fb52a6a100d7244f1526a1a731c4a92b9c961a53b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640843623, "uuid": "df65348f-fdde-43cd-8af9-9fd8334b77b8", "value": "T184840292E2E245F3E9B2493211F5A43FAA79A2399714DDEBD30D384257857C066383FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640843623, "uuid": "079adfe3-ee09-43a7-864e-fb398735fcaa", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640843623, "uuid": "a083b5b0-3b89-4ad9-ab37-6112fd2e5fb4", "value": "6144:ozBkLL2NTBACA0jpYK3+I2qk0P4+SRmnRnUrJJzD7lZSZZOubOkX8uRI8GNhgiO:oKyNTylFjrqkQ4+kuRYJzyZsaDX8mlK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640843623, "uuid": "bceb3503-2c43-4931-bba3-c346115c7d13", "value": 378200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640843623, "uuid": "7aac10d9-2e70-4503-a1f7-2d7cd448931c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640843623, "uuid": "969fc8e5-6300-4146-8089-d6a7991a76cb", "value": "f3279df0dfc992ed2faa0e7581fb01cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b1ded8-698c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640881229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881229, "uuid": "6caf48b7-ba66-45da-a557-78d29b84c2dd", "comment": "Malware payload (Mirai)", "value": "1817dfbaaaa181e4cff79c3ac63c99cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881229, "uuid": "f3249fcb-90a6-4854-afd2-aaf6df993a87", "comment": "Malware payload (Mirai)", "value": "a46c2fc8d6a4719a23f5841f5bae12087c09d02f4b35a6e4ddd4e221d0776b9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881229, "uuid": "13d93562-4f50-4e1f-8af5-8399b2a579b0", "comment": "Malware payload (Mirai)", "value": "009d5e4cfa7b51645ced60fa2d35b73c08bfe942", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881229, "uuid": "0a561c54-0b2e-44bb-bab8-d33819644910", "comment": "Malware payload (Mirai)", "value": "390e1d782e53b4a10b7cc1622b98843478a1329d717c4e307474eb65d16939ffb951d1ad8a8bcbd050bdb1b79866da56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881229, "uuid": "5b02bcd2-84a3-4ea0-9397-da0ad4fc4515", "value": "T11F434CC5E243E9F5DC13017020B6EB33AE36E1F91119DA97D3E8EB236D92512E44AA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881229, "uuid": "de80551b-896f-4594-937b-b9556ff637fc", "value": "1536:DgLG/crzf+oXU8fBhVCHj54U5UtwUSNL6KB:Ui/crzf+oXaX5yNS1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640881229, "uuid": "5f753f11-90ed-401f-abe0-d80db441a6fd", "value": 59444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640881229, "uuid": "a9b7ebbd-cc04-4b12-9642-0c4b0644926d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881229, "uuid": "50ba2dff-2be7-418b-b8cf-2014be3ec434", "value": "1817dfbaaaa181e4cff79c3ac63c99cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a164c32-698b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640880831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880831, "uuid": "e92ed903-9edc-474a-947f-e6e04ab36807", "comment": "Malware payload (Mirai)", "value": "3123402dcd32fc1df0f8d033189b9bce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880831, "uuid": "2af0892a-786f-406a-a793-5cb7a07fca23", "comment": "Malware payload (Mirai)", "value": "b021e618442368b9062191c3c8705e9c6f44f3b0099ed29c3dc02730c5e0ac59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880831, "uuid": "3f4bf550-3db7-4bf0-aa3d-9d2b90ba6591", "comment": "Malware payload (Mirai)", "value": "277a977d472325e29af2083b536fc2afbfba6675", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880831, "uuid": "11f66ff5-c072-4eb2-999d-c72feae85c67", "comment": "Malware payload (Mirai)", "value": "1b4bd27049c3013d2637e612ffd062302d5a340472bbc1f35f74d7b1dd2f98fcb5d620a9367dc2b70989bffa726efff5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640880831, "uuid": "3b1f86cb-318d-4bde-9f46-68eb48ecc886", "value": "T1AA6339D6F8019E3DFC0EE67A84550E09BE7163D112831F266BB7FDA36D720A66D02E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640880831, "uuid": "7cc45e3e-c8c7-4b0d-a8f8-07d40e889eb9", "value": "1536:HL3mMsvOLG5XJrr1Dctrg+JHdtIi5zFY9BgOo8QNLgvQ5:rCat0IOQgBJy13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640880831, "uuid": "d36db0f0-a927-4eed-99c3-f75688e999ca", "value": 69148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640880831, "uuid": "854ffefb-4d7a-4436-8d7b-d9200bfa0664", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640880831, "uuid": "37d319e7-a0b0-4509-9f6c-9da1d32a9992", "value": "3123402dcd32fc1df0f8d033189b9bce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a725ae14-693f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640848264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640848264, "uuid": "f8f638b0-eac6-44e8-be99-5572404863fc", "comment": "Malware payload (RedLineStealer)", "value": "aaef2f245bd1694986de737c33a07935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640848264, "uuid": "334f4dc3-ad7c-4803-93f3-aa948248cce8", "comment": "Malware payload (RedLineStealer)", "value": "b17768009cf2fed4bb244460953841a35578dea7019c9c6b30b1208a0a87a065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640848264, "uuid": "6fc9b71d-517d-4ba0-851c-3ed1d2ba753d", "comment": "Malware payload (RedLineStealer)", "value": "d6b770e57cb177db79fe53428cf1f3205507b650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640848264, "uuid": "ab693997-4c86-4aa8-a016-acaa533fba12", "comment": "Malware payload (RedLineStealer)", "value": "2616da77bd1b0363108262b70cea723d071f316fb7928d4c52f4638b1fca73f6805bd33227ce849efbaafde0be04fa7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640848264, "uuid": "31a57272-91d0-43f7-926a-4186140acf93", "value": "T1B205025D79881E63FC1FB8708A525D8A4B510E9267524AD22B64E0FDE3CF015EE13FB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640848264, "uuid": "dec6d625-60fa-470d-aa38-2b649ffaefbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640848264, "uuid": "ba8eb5a1-a0bf-4086-9f03-a4bd75cb95b2", "value": "6144:0Lw8Oi1BbOnRwGTnXdY/8MBjP/+PQMYBcajdxIu2TslbvqvJjE/ffVpOy:2pBbOnSGbXdLO/UrK78cRHVpOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640848264, "uuid": "d1fa68d8-8701-48e3-90bf-c7af51535483", "value": 845192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640848264, "uuid": "a5a0efaf-026e-4d79-8041-161a63b222fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640848264, "uuid": "e6e976fd-ed17-4b13-8d2e-4969b82e2419", "value": "aaef2f245bd1694986de737c33a07935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99d9c32-69bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640901607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901607, "uuid": "13861b36-675d-413b-a84f-1e320a0c44a4", "comment": "Malware payload (Mirai)", "value": "b436cc98aad3b2e36424a57e6a9c65db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901607, "uuid": "39a5c848-bb03-4c8d-b7ec-2dbe2088901b", "comment": "Malware payload (Mirai)", "value": "b2aeae77f2d5cabf537c60974314e90ec8e8101aa0310139814b5679afdf91bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901607, "uuid": "2c6d7aff-f213-4629-a605-e742c6dd2a74", "comment": "Malware payload (Mirai)", "value": "3996710ed255a8c2021ee35d8adfd40dd8f3297e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640901607, "uuid": "fbb7103e-6953-4491-a55e-8f096c64b8b7", "comment": "Malware payload (Mirai)", "value": "d19a74179103f8d8ca8d721b9ca2ef0e6e11afc74c5e0fe97ca40098b166dbd5fc40716f71fd8e832f663a239e83deb6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640901607, "uuid": "fe125511-c879-4cd9-8498-b8e8be47b39f", "value": "T1C3142A46EA814E13C4D6137AB5AF018E3332A7E5A3DFB2068D145F743BC6A5F0D63A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640901607, "uuid": "d9c5ecdd-c2ff-469f-b8af-c0ed4d77af06", "value": "3072:FZ5M2U9M57iufOva850UULJK4TBIj4p/JTgUurr8JVtymf8iGM/97nNQ:3RU9M57iufOva850UU9vTa4pRTgUurrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640901607, "uuid": "d17bd85c-4df1-43ac-b4c9-8051cb2a32a2", "value": 190698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640901607, "uuid": "5c3601fe-02e3-4d59-a3f0-801edcec6268", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640901607, "uuid": "df3063d5-aea8-4ee5-a29c-72afdc43fece", "value": "meth.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f70b37e-6987-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640878934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878934, "uuid": "b13ac651-fa14-4e0a-bdb9-552b1882fbc6", "comment": "Malware payload", "value": "c6974ff6e6eee9fd15157cffdcab38f5", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878934, "uuid": "3b682374-561c-4e93-bd00-583a004e3216", "comment": "Malware payload", "value": "b33ee9d0667628067479d4a4f7a998ad14786ff1bf9d66db5942ae727b12426c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878934, "uuid": "d5d2d7d2-dadf-44c2-bc3a-7424435e3e9d", "comment": "Malware payload", "value": "6693f1a62d4d5420c22914b6992b1cb8cc436048", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878934, "uuid": "e260a608-9fea-4c86-b2ae-58b7bce0de08", "comment": "Malware payload", "value": "929a577cf80ac7648d5befbc22d5367c0ffa5b990d8d3a6a9114444511fc8ad915029ac891e2a132a12589a896973243", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878934, "uuid": "8b7b27de-15d0-4cc4-86bf-94d94c33ebe7", "value": "T1B291A661725413252A83828B140BD698B23AA0A7318D0EC076CDD5E49F53FFCDE707E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878934, "uuid": "111966cc-7402-4a4e-9c08-4ab154dbe267", "value": "96:J+rbXHvonUsYqwLZvUqVn/0b37DMo6XBr4qIVCqiMa+:Jyb3QCK+lo6XBEfVCqiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640878934, "uuid": "e1605c42-4759-4c58-8c4d-5112add54689", "value": 4406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640878934, "uuid": "6c3f5a0e-9830-42f8-b4e9-4677a566ac26", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878934, "uuid": "2168bab2-97fb-44bd-9180-2fb5d8113d7b", "value": "Invoke-PowerShellTcp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c1c6de-6987-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640878964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878964, "uuid": "802925c1-8857-45cc-b687-845790efa5f1", "comment": "Malware payload", "value": "7179cd774f0b949f4c36e52fc9cd0275", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878964, "uuid": "011ef104-5c68-4171-b8c4-2eda63651eae", "comment": "Malware payload", "value": "b94445765f5343654fe154802e4ed0ef453a2ef8ee3ad567c31bd00fb896ca4d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878964, "uuid": "9e617ee1-de11-4a11-866d-764fc6429198", "comment": "Malware payload", "value": "26303b496baf956672031084a5efe06832e84fa6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878964, "uuid": "80f91d79-536c-4c30-9a41-c7d781e126f4", "comment": "Malware payload", "value": "9fc58e5eaa2d7c97adef4261b4193e569a7d4d37c1cc2e71c799b4cba25e1a1c584727f36446777eabb49bd1516a1afe", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878964, "uuid": "1a62b4e2-262a-43bc-9e62-0f2e699e9873", "value": "T10EF0AC64BBC7D76C4B02628A8805FB8CF1745802261AD9C2B7CEC8DC440AD892B351A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878964, "uuid": "68d7c9c2-c813-44d5-887b-1a005a4602c8", "value": "12:6KZG4VmouP7JBJqRfE7yARzg6dhHLknpHbnu1HeWGX6BXe5n4txi78cJ:M4VmouPNqfE7JRzvLknxbn2+WCqXeits", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640878964, "uuid": "3c004c69-ead3-41ca-a15e-c4a2c7764f69", "value": 618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640878964, "uuid": "e9661633-2ecb-4295-9072-ba37e95df808", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878964, "uuid": "ad600e4b-4e9a-4f9c-b7e6-026ea510c48b", "value": "powershell_reverse_shell.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3f1e10-6975-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640871496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871496, "uuid": "0abd1695-69a1-4e76-ae02-6a7562d5ef39", "comment": "Malware payload", "value": "8d3e29bd96352a306022393e94a7270b", "object_relation": "md5", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871496, "uuid": "a2702234-6c9b-48fc-8a5c-f732b928f7bd", "comment": "Malware payload", "value": "ba27ae12e6f3c2c87fd2478072dfa2747d368a507c69cd90b653c9e707254a1d", "object_relation": "sha256", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871496, "uuid": "0483a06a-0b5c-42f8-b39b-9c7c4dae8249", "comment": "Malware payload", "value": "802e7e9bde53d254614268e4b78f03edb1db068d", "object_relation": "sha1", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871496, "uuid": "79050d6d-c2ae-4f2f-9908-e03e57299cc3", "comment": "Malware payload", "value": "02b7582f45eb015b24e421db2794e746333a5dbbbc9f3a7f6013dd86dd7fb52e3168b55bb98c3068811be321b6fd8b62", "object_relation": "sha3-384", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871496, "uuid": "0f802df0-1d1a-4f41-a38a-cbe753aab69c", "value": "T10675330E8FB3F868F9981EF5E67A980F94454012DA9D8914ED1129E807C31FBB32576F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871496, "uuid": "4e2a871e-618f-48c1-9737-141644e3aadb", "value": "49152:hVA4wQg3VPREdpwzHAp53T5fKIHkqu4pVpJAnY4g7FXu:eJ1CwzgZKwkqu4pVTAsh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640871496, "uuid": "3bdc50ee-ce37-4276-8cf7-189ae108efeb", "value": 1635074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640871496, "uuid": "a20b191b-2684-42e0-9fda-af0c2e452e0d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871496, "uuid": "f3160ae4-d9a0-4394-8351-842a3d5ddfa8", "value": "ba27ae12e6f3c2c87fd2478072dfa2747d368a507c69cd90b653c9e707254a1d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aeb2a31-6987-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640878926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878926, "uuid": "7f79b512-0ad3-46bf-837c-d8b5c9a2c744", "comment": "Malware payload", "value": "4d70556bf6d770e4868c93aba04e11b5", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878926, "uuid": "d9387542-579e-4996-9309-6986032e0a52", "comment": "Malware payload", "value": "babc83fff56f1c4699d1826417d49a42f9e9a1df02b5ae3d9b0ef166fc46f3d0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878926, "uuid": "65ba61e4-66db-4ebc-a17d-4842d0bc1da4", "comment": "Malware payload", "value": "71351d9557416bd0969e1e5b32d3842bfe895446", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878926, "uuid": "7666dba7-3195-4153-a5bc-dc569d901d8e", "comment": "Malware payload", "value": "7742aac7adbc05ef1ba2709cefdcc438feb8fe3a07d583553f93bacf3b4d52d784cc26b8a104c627b7cecac47223b850", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878926, "uuid": "32765982-8f41-4bf7-a356-fb56b1d5b827", "value": "T1138164753658637B120362974487DDDCB239E09B608E1E70779CC9808F85A6DAB46A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878926, "uuid": "7da38c76-cb7b-44a0-b65b-f36ccf55fde1", "value": "96:Y+LcItThQNA/sb37DjVHbTQsSqQOuC6AgVKWfO:Y9TO/mVHLSquC6AgVKWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640878926, "uuid": "952d7880-0168-45d0-a0c2-832d39cbd9c9", "value": 4170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640878926, "uuid": "3d7b2979-011c-445b-a08b-05446d24209c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878926, "uuid": "0caf3327-fb60-4184-a52f-f680466c19c2", "value": "Invoke-PowerShellIcmp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46106966-6978-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1640872583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640872583, "uuid": "d465f20c-9510-4bf7-a98e-58038a228557", "comment": "Malware payload (AveMariaRAT)", "value": "8bb5443a351325862346e95674a7745d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640872583, "uuid": "26f22518-c106-4536-a80a-52c277e2429a", "comment": "Malware payload (AveMariaRAT)", "value": "bac03f9b60b043b72ae8548b8915dd6058c71b6beae23652389b0cb9310af91d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640872583, "uuid": "50b6f2b4-b232-4fb3-9c4a-a747682ac650", "comment": "Malware payload (AveMariaRAT)", "value": "e5208dfbe31500dc7463cef2b555e16bcbc1347d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640872583, "uuid": "1da869db-a284-428a-b5f6-2b73c59457b3", "comment": "Malware payload (AveMariaRAT)", "value": "b939e18a61e96d0942d24cf2a05ed6969115ce9f0f5d3275f1906b2793fbdb62f43488fe07f9d0c4b05c1a17c3b178d3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640872583, "uuid": "4b343c58-d8f8-4fb7-bf41-09313a48d8ab", "value": "T13305C057E7D7FAB0E6FF827A86B2852C627B34530160A74E674071C96E22352493DB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640872583, "uuid": "395f6506-3b5f-40d0-a71d-a1501d5cdc29", "value": "fd738bdf3861116c40ccb9439519c3e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640872583, "uuid": "ebce5a11-f6e3-4156-ad48-d7ed31995148", "value": "12288:3zizgSdBxQlHO6S8bzbBSreaGz0hK1eu+yOLL5x7VLCJ1qUJoffLJG:3z8gSdBgHxZX1A8AuO5CJwUJoffo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640872583, "uuid": "ee7f52f4-d05b-46d9-90d9-972663afc07d", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640872583, "uuid": "f12b40d8-19bd-4847-8dd2-4dbb032fcb34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640872583, "uuid": "c2082f7d-99c4-4f96-910d-0951db6ef503", "value": "bac03f9b60b043b72ae8548b8915dd6058c71b6beae23652389b0cb9310af91d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3d7b4b-698b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640880836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880836, "uuid": "829e5926-56b0-402b-acc0-098eea5fc2af", "comment": "Malware payload (Mirai)", "value": "b1cd5594ab8f50e7ffa18e1d89ffb210", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880836, "uuid": "70a64556-ca9e-40e0-a62f-2d2c5e87121a", "comment": "Malware payload (Mirai)", "value": "bc295c62547eed3efe71521589f31f9e9bb288a3c99ca91b14de55996a80884b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880836, "uuid": "2cbac90a-b3c4-4db6-a9eb-d2137932ca9f", "comment": "Malware payload (Mirai)", "value": "0ff0e78b039fb1eb6020ca1ea54fef4c71f30826", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880836, "uuid": "048cb299-0fc6-4c5c-81f6-bb466f7bafa0", "comment": "Malware payload (Mirai)", "value": "8a307139813231db3de035ac8e65282068bd1838857615a806618816c450a9026827c53d8e737224784e4ff39ad04bb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640880836, "uuid": "4e5e61d2-2ded-4648-9d97-9b0bec836286", "value": "T1B7E35E56FA404B13C4D51779B6AF42453322A7A4E3DB730699285FB43F87B9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640880836, "uuid": "217dccac-e6d8-42d6-b451-65a698e491df", "value": "3072:atP5jHwaVnoH/ZwLU03ZfFrgc7Yd/ak4nXD/oM/9g+HBmNwaCST3:UhjHwaVofaLUsZfFrgccdPsXDAM/9/HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640880836, "uuid": "20ca46bc-bbdb-4b90-9e9c-eeabf1bb0851", "value": 144845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640880836, "uuid": "65d844ca-b7db-4679-a4e4-8e36495971c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640880836, "uuid": "990c5ebb-a968-45e6-8e16-7175b5eb3171", "value": "b1cd5594ab8f50e7ffa18e1d89ffb210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f0d4c4-69ca-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640907994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640907994, "uuid": "c20983d6-59af-427d-89b8-080a57be4bdd", "comment": "Malware payload", "value": "fc2ad84f2b6ca844147b805e798ce228", "object_relation": "md5", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640907994, "uuid": "a5330d2d-afdf-449a-ba8b-a81b9b66605d", "comment": "Malware payload", "value": "bd431a53c65170dee9ff174ea2865b49edf395023bd5d69f61150d83babba52d", "object_relation": "sha256", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640907994, "uuid": "858e2678-8c8d-411e-aba6-5e70996f5f7a", "comment": "Malware payload", "value": "142ed6277c10f9e81299fa07cafb0f6b75eb0ee1", "object_relation": "sha1", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640907994, "uuid": "05450889-2337-4b3e-862a-5bfe0fedc698", "comment": "Malware payload", "value": "1660de5e427c2530dab3b875b5cccebe2881cad2bde871ed7d5a80dc7359223e211266a5dc69ea1f73284b2bd4dfd8a5", "object_relation": "sha3-384", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640907994, "uuid": "567b1e99-26d7-418a-a948-a651a5a9e9a3", "value": "T16BC48C11BBD1C076C26631744E56E3B4AABAB8319F35468777D02F7E1E306D29A3930B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640907994, "uuid": "71118697-8628-4b45-b7d7-ffcd8e53d470", "value": "12288:f3kUNnILkQyJanmyMBZWRbEo6nOfyd2YGq3iW9BLMy+:veLk3ancDouOfydUy9Nj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640907994, "uuid": "650383e9-cfef-4d77-ab5b-88778e467afc", "value": 545363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640907994, "uuid": "38639be3-d65a-49ba-a2c0-12437d558f92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640907994, "uuid": "5d2473ee-81a1-40ad-94df-382afc4e5e02", "value": "bd431a53c65170dee9ff174ea2865b49edf395023bd5d69f61150d83babba52d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85e9554-693c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640847005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847005, "uuid": "6ca3c370-5c6d-4719-8d0e-0b453023e089", "comment": "Malware payload (Mirai)", "value": "71a15b8196d055dedbc853005ce5fe67", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847005, "uuid": "549fa711-8c34-42ef-9386-fc1066216441", "comment": "Malware payload (Mirai)", "value": "beb028ed4f5e704f7c13698ea06340c3125c4a53ed7ea089624f99eb26e6fd00", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847005, "uuid": "7ec74dd6-52d3-476c-a9a1-38c4e42d4860", "comment": "Malware payload (Mirai)", "value": "aaef7f47f67eb4c0379c09bda8c8d50458a7cc70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847005, "uuid": "00391d1e-40f0-4d1d-b28f-61564b52dbc5", "comment": "Malware payload (Mirai)", "value": "671d7ec37af0598d0a36013ecf8535e4aeb48300619ec93325ebcddd368f6c1982376b029f57b5fae3881f67459e0564", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847005, "uuid": "6f946615-a4d5-482b-809d-8d9011a9ea26", "value": "T19703F152108BCD51DFA49D71AD16CD93139E0CF0B2FF3276463810E1623A62E4DACACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847005, "uuid": "2b3c08c5-3907-4bac-8b89-52cc8a8a506d", "value": "768:tfHbcg+KODv7/r7odrA2P8Lfp4ylVbFFZezyW5D5s3UozB:Gg+Vbr7odrcLHJezyW5DEzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640847005, "uuid": "4e40603d-e1d8-477f-aa84-b367644c6eea", "value": 37840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640847005, "uuid": "0775fc0b-0d36-4b72-a432-31efb7558556", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847005, "uuid": "867b89e8-be93-4ec2-89a0-e73e27371f81", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183c591d-6987-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640878948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878948, "uuid": "76d78b22-84d0-4bb7-8d99-dc7316db107e", "comment": "Malware payload", "value": "5dac56a2b416fdd9c5f6ef9b018b429d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878948, "uuid": "8a592b15-543a-4688-a361-b754219da13d", "comment": "Malware payload", "value": "c356454ab6484d3157d26d83c1b7ad53cbdb149569404e33f41d8f23e1bd44d3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878948, "uuid": "854a2003-4244-4390-a134-9b840031d5f6", "comment": "Malware payload", "value": "6cd267d761bbd073c31e855d77e00de1d1709632", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878948, "uuid": "85d594ff-9aed-4d12-9ab1-859efbad2b3f", "comment": "Malware payload", "value": "6564f814f2dadb26e8aae60475a9251843bac3edfc8d52b86f932955de2e02eb031cca16052579065314cb0a96981fe2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878948, "uuid": "115b01f2-1fa2-4dd3-b01e-f30876fb203f", "value": "T1F9C1A56073366310164B258DA39AE504A23664D322CC4F40BBDDC5945FC7EA8DFB57E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878948, "uuid": "03e0c8aa-f4f9-46fe-9b5f-a46cdf795583", "value": "96:1+gkvonkmh9vUqEDIJoaoan6zPuQn6zPZTb37DU5r5I5rAfqU5vSM++:1zkQSjaxoan6zPuQn6zPZc5r5I5sfb5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640878948, "uuid": "c1629ed3-f92a-4fd0-b9f2-96cac472ad8f", "value": 5756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640878948, "uuid": "b1492090-645b-4d18-8d26-40769da06ac2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878948, "uuid": "cd3bad8f-3c86-4da5-b9e6-c5fb24fbdc2b", "value": "Invoke-PowerShellUdp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81203539-698b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640880842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880842, "uuid": "ebf10ae2-6364-4551-9f08-9e39f05621c9", "comment": "Malware payload (Mirai)", "value": "4d26dc3d67d35d250de56c6c8eb95e7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880842, "uuid": "80377ddc-8113-42a3-8461-00777f69e6da", "comment": "Malware payload (Mirai)", "value": "c4edadeec458b525daa1e0860d24ba3d7f9ad0eee2e27a87e5b09899b0dcaf27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880842, "uuid": "a96ec187-9c6d-447a-aed1-31b260191225", "comment": "Malware payload (Mirai)", "value": "0a4b1cd9b6f5ff23771b1ba13c383dea3f9dcf8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640880842, "uuid": "d406ffea-2a05-4b58-8e2c-883a7e93cfc7", "comment": "Malware payload (Mirai)", "value": "dbd0cbd6d342bd93c95a89db36aa4ac20492b75e550974b4348a0e34aa35c3c41e6b3a8126e3ee31bf2f580098430e60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640880842, "uuid": "6c329bfc-ef4e-4e3e-8bcb-6688243e589f", "value": "T1CF635D53B2280D17D0A30A70293F4BE18BBEDFD121F0B686695FAB568536D331586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640880842, "uuid": "119cc5c3-c1db-47ee-a5bb-1c262fe63347", "value": "1536:HtDk+zX0QboUK99VB1ywRaXb/E1WbIRVcxJa10q:qkE6pKPVB1yoaX41WbIRVo4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640880842, "uuid": "da36d32f-7dc4-432d-9d00-9d9b714fffeb", "value": 67956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640880842, "uuid": "1fa819ec-fbbf-40c6-9228-f61eeed359cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640880842, "uuid": "480f2deb-10dd-40f2-9b88-15d39f534bfc", "value": "4d26dc3d67d35d250de56c6c8eb95e7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9019c30b-69be-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640902772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640902772, "uuid": "af445e2b-8bab-479b-8176-c811c1cfb10a", "comment": "Malware payload (AgentTesla)", "value": "d08ab2fa66b051f94a2f45d41548575d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640902772, "uuid": "c0383209-1e7b-4354-9356-d246cb318472", "comment": "Malware payload (AgentTesla)", "value": "ca3227d6093ce79389b00025e3f88970433935e00f14e1c85ee1841c6c43a510", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640902772, "uuid": "d82f3abd-bf92-4a35-a741-97041b594b3e", "comment": "Malware payload (AgentTesla)", "value": "50c84dd3d12d8834780497e4deb462d050ea5ed4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640902772, "uuid": "d8998661-8805-4fe1-a8ab-96778407a2b2", "comment": "Malware payload (AgentTesla)", "value": "74a88d67192f9f551d4c31a556964f6977cb22f3ab56ada3084149a0fcfe133ac58a978318a7879f0e1db950da100f3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640902772, "uuid": "3c9454dd-9946-40e0-9e57-f45b3e03df4a", "value": "T1C0B4DF0131C6D2D8F87FDBB10CF9BAC14A79F6E4E840E1DEFC68645E8863A954B14672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640902772, "uuid": "719dde6f-a244-433f-a937-4b22322e2441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640902772, "uuid": "531acee0-45c8-4155-b6a0-f2bf32afeaab", "value": "6144:64tgdcVpC6ji6iGeoHwQ8AdM0rXX0bcW40nVcPvVkU4Y+u4Q3u+NOlqpZzcqD/Zn:39G6LZQQ81QUIW47PKYsQ+lW9cgELd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640902772, "uuid": "33b5c225-e1c0-4510-b3c1-ff75763fb908", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640902772, "uuid": "83085bf3-71d4-49d3-b341-c797eec74420", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640902772, "uuid": "b80353dd-683c-41ff-a90c-14661967c401", "value": "SHIPPING ADVICE 4084301002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11402703-6945-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1640850590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850590, "uuid": "5e0c40c4-bceb-4681-9006-9a3823067fed", "comment": "Malware payload (Tofsee)", "value": "bbd82fb0846ab910319dd505405a07f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850590, "uuid": "80555040-bad8-45a2-ba4d-aebf0dfaa4fa", "comment": "Malware payload (Tofsee)", "value": "d35dd18698186ad6694cfb0361dd9e0c30c03ca1935c40cac4e92e672bec1080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850590, "uuid": "c1719626-d08b-47fc-a0dd-e5c7ebe46ea1", "comment": "Malware payload (Tofsee)", "value": "b62f84c89cecf2f64f538e3bbffe58ef65451bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640850590, "uuid": "3c792b91-3e2f-4e32-98a0-1af36f5a0733", "comment": "Malware payload (Tofsee)", "value": "de952b0af48885479fa564b02326344d3e491fcfa95cd6b89520ba8f785065722e35e80ce6800b0b93d567d00126e27d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850590, "uuid": "b175cc82-ab35-46af-890f-9eb9e46fb1a5", "value": "T17E648CE17DA0C831C495FA318C2D8EA4DE7EBC11D960954B32743F9EAB722C1562D21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850590, "uuid": "4907738c-3e22-41bf-960b-577189a68eef", "value": "319bf6fe2c13d54d7e13af9887ef84ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850590, "uuid": "9e86edd9-2661-4204-b8ac-6cb01a7846cd", "value": "3072:Lwy0OHqu2zpng+N4ilZXRVWnXvNgaaWFSQgqcj97hsJVggjcGkNIVqIbM/h3:M7LlpngNiDXz+fNzaWlgjhmr7ITsq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640850590, "uuid": "63a6801f-34b8-46f1-b165-0173975bf997", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640850590, "uuid": "0d4c7a36-4c58-4f7a-8853-b3fc55087991", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640850590, "uuid": "7ff4ac6e-d786-425d-83d3-c69d7f510903", "value": "bbd82fb0846ab910319dd505405a07f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebc543d-6979-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640873054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640873054, "uuid": "08d2c664-d4d9-43bb-ab9c-63c7a6465d66", "comment": "Malware payload", "value": "11a44ac4c0c2f80276502eb216448fa8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640873054, "uuid": "80dd36f5-792c-4ba0-ae53-1bf90477bf97", "comment": "Malware payload", "value": "d3a0b7c5a1eafbf7d381b6ee064083496476163da5dfed53096fac36c2b30738", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640873054, "uuid": "3bbf4e16-9fca-4ec9-a63f-8cf8959e3e89", "comment": "Malware payload", "value": "94cc4db1a464d8e2072eab185b9c68bbae2c53eb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640873054, "uuid": "82974001-969a-46db-83c3-037e1cc31b9a", "comment": "Malware payload", "value": "e3d1192ee924d8e09de3f747ba987eccc3033e757b8666a2398c5618a4e554be3b67bda7d98089a94481f9f9a1592b9d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640873054, "uuid": "b762616d-e00d-4f9a-9037-fe3f431bc020", "value": "T158C423E5493C4ABDE0A37938D58C3DE05312BA0ED5B84B06E1FCA2CDD71255B58DE893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640873054, "uuid": "a4323705-fe74-4793-b4ef-aed82f156576", "value": "12288:VekV1Rvw7ZlfBDXNmcwVtH5Uv2+kt8212adRnW:5RviZrdQtHav238bz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640873054, "uuid": "a0d5f870-e956-46cb-8b60-f7d6aa62858c", "value": 556282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640873054, "uuid": "479bcabf-97a7-4315-95c8-1b6d7d3192a0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640873054, "uuid": "4249032f-4cf5-4ddd-9cf1-3f6d2a9795aa", "value": "Omicron Advisory - Two Imported COVID-19 Cases Tested Preliminarily Positive for Omicron Variant.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9240630b-6923-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640836204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640836204, "uuid": "ff7e42f2-0b02-4b32-be13-05e838296c69", "comment": "Malware payload (Mirai)", "value": "64fced4bc5e4165b801e6676440b958e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640836204, "uuid": "edd44c2d-6443-46be-a5b4-04cc3858df00", "comment": "Malware payload (Mirai)", "value": "d3bcae83e52a408529ecbd703a5bda95693973cc60b0966d354cafc69008e241", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640836204, "uuid": "02543f8d-8ffa-41be-b3fb-e733a7de20bc", "comment": "Malware payload (Mirai)", "value": "7f56837ea0c63318424987b05bdad1c98c6af237", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640836204, "uuid": "6eb33a93-21e4-475b-a7bc-65bba0f637cb", "comment": "Malware payload (Mirai)", "value": "b3249f602f077de5327112ff68f626f5f83f127db36648f674aaf575269f073b5556226c5372e4c28229e49497686a11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640836204, "uuid": "b6f12488-02ec-4342-8311-426d76b1e8f7", "value": "T134437DC1F603D9F5DC02797430B7EF329E72E5FA1159DB87D3A49932AC42602A50BA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640836204, "uuid": "deb654fe-75b1-40d5-8c0e-118370c9acdf", "value": "1536:raGl927ouDf9nLACvL3nm/MzmH6cLGBJJJJJJJJJJJJJJ+BJJJJJJoJJdJHLa:Nk7ouD1LACjXmkiHD2JJJJJJJJJJJJJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640836204, "uuid": "7faed917-3a4b-4de6-9fd7-b77219b6a12b", "value": 59572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640836204, "uuid": "902c4831-1f8c-4395-9bec-73815c20382d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640836204, "uuid": "5c2bcf5b-e896-4893-8ac1-3dac693f7f0f", "value": "jKira.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce687da-698d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640881614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881614, "uuid": "5d4ad15b-4ccc-4be0-8aad-971e712c4308", "comment": "Malware payload (Mirai)", "value": "0bf7c5b5fb80dd45dd9f4ba8033d05a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881614, "uuid": "770f7bbd-1cf7-4d8f-bf06-07e48f2016aa", "comment": "Malware payload (Mirai)", "value": "d5eb0d72bfde0f5849d2fc05674191756e4f68d5efe05f31b0ab6aed87acda82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881614, "uuid": "c87d411e-9347-4568-9ca8-689963c9d682", "comment": "Malware payload (Mirai)", "value": "a661a4fe2c591e4fbcb82702adce7fade8cafc51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881614, "uuid": "b13102ba-41bf-4b40-95d6-2ab78d9c6345", "comment": "Malware payload (Mirai)", "value": "e02f7b883fad9e4099b7212a18a44b262ac70e53af335abcb2975a4bd59f23280218c0d855ede68ed7bbf3097c5039fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881614, "uuid": "b1f5f671-556d-4dab-a0ba-5ad87faf585a", "value": "T1A4635C31BA362E13C0E1A47E61F78B11B5E617DE36A4C61A3D720E4AFF211506507EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881614, "uuid": "06bb86e8-ecad-4039-b559-e8460b4bdb1e", "value": "1536:ngr3IAqziDiRQAaKqvOVk6XFIPApZk6VIfiV0Qq:grDita9WBIPAvZVNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640881614, "uuid": "228724d8-7a1e-4b95-bc69-abdba84b060f", "value": 71912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640881614, "uuid": "0cceaccb-7087-4015-9ccf-97488622d297", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881614, "uuid": "67feec5a-2ad6-4d11-b2da-79ba64ef36e6", "value": "0bf7c5b5fb80dd45dd9f4ba8033d05a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a8e899-6941-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640849153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849153, "uuid": "340cb1c2-81d9-49f8-a6b6-168349229422", "comment": "Malware payload (RedLineStealer)", "value": "34a9043dee612822fc62dcb070e8b401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849153, "uuid": "78c7eee0-d259-413e-a1b6-5e57df512acc", "comment": "Malware payload (RedLineStealer)", "value": "d68d7178b780c1d80256fe6e2b42659f22c3c24f11280a4eb488a06f59e044b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849153, "uuid": "b38a0e43-e5aa-47b6-b703-b5a388ac8ee2", "comment": "Malware payload (RedLineStealer)", "value": "84c3329df08c7aa3b0b45f3f3157791b1a05298a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849153, "uuid": "9e1a5e34-d08f-406c-9ba2-dd6ed128d485", "comment": "Malware payload (RedLineStealer)", "value": "7ecd985c31048a6c445dd6d7368ae43d13e9c0163b953bb4f8f650405764501a159d92cc794a7c73f99d174486f4d389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849153, "uuid": "4ed12917-487d-4d41-9e5b-c72477012a19", "value": "T1EE0633BD39C1E470D1C3C9714E7F6BBD03A8F9E064BBBDA7E2EB38089402554026B695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849153, "uuid": "6fd58382-1c7f-48f2-b405-0961c2e973c1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849153, "uuid": "f5423523-726e-4f4d-9ddb-ecb5ad67d605", "value": "98304:cDfmxmV5I17B0h35VCiQMa7M84apVmdnFFcwGfXF9kURlR:czm0k17m35gP7M8BpYnpUPkilR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640849153, "uuid": "c6bd75ed-8aba-44b1-89c7-0dc8bd2d32e2", "value": 3932254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640849153, "uuid": "090eb6c0-ced4-4dc0-9e3e-afcf3a96657b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849153, "uuid": "c1858174-49a6-4909-8cd0-301267458628", "value": "d68d7178b780c1d80256fe6e2b42659f22c3c24f11280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e188d593-6942-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1640849651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849651, "uuid": "5564679f-d051-421e-961d-f9aaa282cc31", "comment": "Malware payload (SnakeKeylogger)", "value": "dc3aeb196964e78851f9ed9d051d1f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849651, "uuid": "8853dbdc-1dc8-4742-b2f6-183a27fde2a8", "comment": "Malware payload (SnakeKeylogger)", "value": "d73d8f99a6704f43c0caaf0b6deb99b3f342f645765bf5ca94f41d5daea31612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849651, "uuid": "722b2ce6-01ac-4ccf-b519-b0cf03d60469", "comment": "Malware payload (SnakeKeylogger)", "value": "32900115e46531ce143e8ee60e84fd362fe68e77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849651, "uuid": "cd8e6861-8c30-43ba-937d-7687243e1765", "comment": "Malware payload (SnakeKeylogger)", "value": "a92f36bbfbbc03cb630b449d4b398e70473c4f0d2569770dc476a4d8149192100a3dbba730441cde6e908f6594b0770b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849651, "uuid": "20f1e633-dda1-4c70-b821-d19569af5e15", "value": "T15925231B57C55A7BD3B9133875EB1E0383B9AB1529AF5E8EF481B3C9990BF428030708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849651, "uuid": "a3ffda3d-61b3-4203-965b-91886ff6eb1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849651, "uuid": "d6d8e0c8-8382-4bd6-adc8-5c89132f882e", "value": "6144:ffUv3EeQwTfOhl7tAGgj9GfeqNGvxMaaPzOQnwsmNEpmli8RyUc3uVUC8GW+7Xg2:FJ7AGdNEfgaci7AWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640849651, "uuid": "1960fc99-6c06-4427-9130-aebfcc9da404", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640849651, "uuid": "bc25580e-52a3-4c31-8250-4c8b44c41b8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849651, "uuid": "853f9f91-39ec-46e9-b391-092cd3cc6a19", "value": "jpa13xxl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736460cb-693e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640847748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847748, "uuid": "e238b573-60a0-4ce5-a35d-b43562191556", "comment": "Malware payload (Mirai)", "value": "332ae1e1ec6cea53ad1b7ce788cc7728", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847748, "uuid": "cd6ccf91-29b9-4a47-bffa-864dd52edc00", "comment": "Malware payload (Mirai)", "value": "d7b01eba04e6e73fdcf103115887d2a3e7a554fb31a36b598d1e34fac6f63cba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847748, "uuid": "0e6f3710-57b0-4af1-93ed-82e8a609d7fb", "comment": "Malware payload (Mirai)", "value": "53f50095d1586018e50ba9d583d658b75ec53880", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847748, "uuid": "1c44eedd-2be7-4b94-aea7-c3d9f0141b04", "comment": "Malware payload (Mirai)", "value": "1b120e876b6efb57d38ec87b25136dcfdf3d0a4644bc9c58a4326b2af98c7fc5a2995b9dd75124c2a2f8c8c75bd42d3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847748, "uuid": "ac6e839b-abe7-447a-9e99-88b7c39aaeae", "value": "T13B03E16EFA1072AFC0A69BF556D007B12F300FA6D943D84675C6B28BD8DF2B464872C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847748, "uuid": "57eaaad7-2028-41b3-af8b-181ba22365df", "value": "768:FAOn6Um9atG7FLRWp0E1QbKaKdtC2DlKMkYPFEi+hPUwiRbKXxVeJgGlzDpbuR1H:8Um959RWV1QmHdtxDlnpPeiY9iQXeVJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640847748, "uuid": "d1d50fc2-a125-4fce-8785-ceb8c81fb6b8", "value": 39428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640847748, "uuid": "8ed844a3-6c3c-44a5-8b8f-f65be3cfc3b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847748, "uuid": "75e75bc6-d055-4f34-8bc6-a969103e5371", "value": "332ae1e1ec6cea53ad1b7ce788cc7728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7017cc03-698c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640881243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881243, "uuid": "225ab09d-f6c6-4ab4-80ad-6ecc8e37e389", "comment": "Malware payload (Mirai)", "value": "22da0659a1fca269e58cbd2e3264ce04", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881243, "uuid": "42d7656d-c5a2-485b-95b0-e00d58434555", "comment": "Malware payload (Mirai)", "value": "d97ef4090064ef0abc596d176a5fc8cba2a19bb99689b5681fb6dbbfedf674ce", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881243, "uuid": "3f6ce795-c685-40b8-a0b9-78971c56c0ef", "comment": "Malware payload (Mirai)", "value": "693ffe01c7a3bdafba70eb0af024863479edf07c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881243, "uuid": "541591de-0b79-4df9-ade3-9a38b51eb6f7", "comment": "Malware payload (Mirai)", "value": "24d3aca81865cbcda4e2f312b26f4d8d11d8350a1188978e6f1de379e755662e3dad7ac50d2f1a8e0c3c15a3eddb60ca", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881243, "uuid": "6f7eec6b-5ee3-4174-81ae-c2ebc246ec94", "value": "T17E531817F58182FDC099C13417BAB93AE92734FE0238B6A67BD4FB262D46D211D0AD49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881243, "uuid": "00120cfd-81cf-46f0-9970-13791545146d", "value": "1536:bklYu9RPiANIzTtAmIoR6mvJKmyG3hB8BQX0cxygcYNLv:mYu9UEIzmXoRHoYcBgygcY1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640881243, "uuid": "2518b519-eb7e-4742-93ad-8c3f9f52a782", "value": 66224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640881243, "uuid": "1d6eacb9-87ec-41da-ad2c-9a6298a2fd20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881243, "uuid": "ff3982a5-7ec4-4cfb-9de7-624cb3dd34b3", "value": "22da0659a1fca269e58cbd2e3264ce04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad30c88-6986-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640878899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878899, "uuid": "8852455c-4798-4910-901c-276764733d21", "comment": "Malware payload", "value": "602e5de08b13a1844b5a21aba4944595", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878899, "uuid": "449eda80-75e1-47bd-95a5-5dcd77d1b1e9", "comment": "Malware payload", "value": "dd15254c72f603384ccf6be8257c2f51fc8f06b6da1356b38e12535e8a031c31", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878899, "uuid": "617b4f5f-3262-4365-ac1d-2748260a67ab", "comment": "Malware payload", "value": "4878e843bc681f87ea2daf115b6038b8177d6da0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640878899, "uuid": "94e44df3-4e5f-4c93-8e64-cd5d2ca160d4", "comment": "Malware payload", "value": "99e8ef0a6bc64956268e8486a1c714e5c2ea3bc0f6bda35481540ba8c1b6e75f27b72d3b7fca4e72abcff124774bc833", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878899, "uuid": "bc668db6-5345-4477-a401-8b285d42f5ca", "value": "T1AC311054F36EC66A0A7120598C4B6F46B898210B540DEC14FBDF89C0FF8DD28D1A16F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878899, "uuid": "f8b560f5-b7fe-467e-a100-339a34bd10ee", "value": "24:GSVGIXPpV6LHPqvLkNZ997AE7EZCCufY/6bB6XVkeI8WFcDS8WMQBYkA7d5Si:GPIXAtzBh7wCCubbkX+wW6DWlYkA7d51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640878899, "uuid": "75e6fc7a-7b28-43e6-8277-199711e642c8", "value": 1729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640878899, "uuid": "61f7a40b-dc91-490e-8e6c-33ca8fb72f43", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640878899, "uuid": "7223ecd9-d6b5-44c9-952a-61dcc1ea5a0b", "value": "generic1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085be443-6943-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1640849716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849716, "uuid": "5f5eb7e4-0031-4915-980c-d3e8ccdff8f4", "comment": "Malware payload (ArkeiStealer)", "value": "8c478a01ab08b256bd7e226df2e9ca1a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849716, "uuid": "4bf81b7c-c503-41f1-a2de-d5f17ac7b354", "comment": "Malware payload (ArkeiStealer)", "value": "df71148d5c047d3d46ce71ca4f68487b0a487a0b52ea4f5bb3f8eda035fd771a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849716, "uuid": "4d755962-027a-41c0-a941-0c5041e4c9f1", "comment": "Malware payload (ArkeiStealer)", "value": "69b60bd912ed7ff6bcd80d3b1e7cf79fa35272c6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640849716, "uuid": "4fc5168a-0ebe-4a5b-8137-f1c4b7815a8b", "comment": "Malware payload (ArkeiStealer)", "value": "09a9dda5697304e63348dcca55ec377455fc7ef01192572bd978ab8b1193d04b41525425cdc281fee23f619d7b254c12", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849716, "uuid": "e182a302-d29a-42b9-8cce-944e9dd704fd", "value": "T1FDF401E1B4A1D17EC4417A30442ADF900D7EAD25CA54398B36743BBEAF712C05A26EDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849716, "uuid": "25debd78-f8be-4e82-8866-361028c52f81", "value": "1615937a2e607eb15adb042a4174e80b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849716, "uuid": "b784ae91-4517-43f7-a165-9c7b06ad5a57", "value": "12288:35qCmHR3BYJPiajqfAEEzLL3A6FSFHEkZPYBXRq+F77:3nmHo7u4EEzL86sbYBB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640849716, "uuid": "66011fd6-5504-42c8-ab5b-e2b4686d2473", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640849716, "uuid": "43592998-bd39-43f0-b897-111c6c7333ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640849716, "uuid": "509fc5f4-ca9a-4dba-82d9-a90010946458", "value": "8c478a01ab08b256bd7e226df2e9ca1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bdf838-6921-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640835168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835168, "uuid": "984f5957-3c14-4b66-9309-ab0ef4927471", "comment": "Malware payload (Mirai)", "value": "c894f8a4981b950b74dec749a951c352", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835168, "uuid": "d198d69f-0b12-4b84-bea4-804f01397066", "comment": "Malware payload (Mirai)", "value": "e04f25f4b76c99d30a43ddedcc40d323c11d10eafb0da4fc9f3409682d111778", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835168, "uuid": "e416df25-1cf8-44a6-9f50-a08a135a6d06", "comment": "Malware payload (Mirai)", "value": "6f206884f97a9474126b13d467ef0a54765b0a1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640835168, "uuid": "e37e2296-7292-4ab2-9d91-42551c6bda69", "comment": "Malware payload (Mirai)", "value": "ec52c8c30443fe727bcc28672f8e737b50124d73ec3d608516adfcfeb59bbb8febb0143ac27a5b9d0950e08e158466c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640835168, "uuid": "96591b71-051a-4636-bc60-ea2cb5b8a12c", "value": "T1A6635C55FC819613C5D012B7BA6E16CC3B2553E4D2DE3203EE356F612BDAC1B0D2B986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640835168, "uuid": "f3fe3197-4ebe-461b-be3e-6bb1929bc722", "value": "1536:PV+GXEFtQwQv9YWYwSxaH5HWkya5zCl95gu6Wa10e:PV7X6u6wIaH52/a5zqguy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640835168, "uuid": "4fabb1d9-445d-4ef8-93b6-19bd1b41456c", "value": 67960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640835168, "uuid": "30729e63-35c3-474b-83db-40487e9b0064", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640835168, "uuid": "cc6481a9-2f13-4f1d-98d1-0a03fea759fd", "value": "c894f8a4981b950b74dec749a951c352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9944921-6975-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640871515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871515, "uuid": "a0f5e8d3-e6bf-4e53-bf3e-00f387bdd216", "comment": "Malware payload", "value": "11746ae92be83ba28b05272fe03780d6", "object_relation": "md5", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871515, "uuid": "ecca13d3-dc96-40eb-af64-c82c5b4c8733", "comment": "Malware payload", "value": "e197c583f57e6c560b576278233e3ab050e38aa9424a5d95b172de66f9cfe970", "object_relation": "sha256", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871515, "uuid": "11564ec3-0810-4f43-a8cc-0b0efe30467a", "comment": "Malware payload", "value": "7190a70241a58610a5f200daa253bc47b686a3d5", "object_relation": "sha1", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871515, "uuid": "87f7e5a2-b761-4cc7-a8a8-b9b5651474cc", "comment": "Malware payload", "value": "db0dcf642abb34de4ae50084365046423f6e1e5107cba42ae5aaa1598c157dcbc513cd817c9adb3104c77955d06c2a17", "object_relation": "sha3-384", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871515, "uuid": "c1a4f742-a322-4afb-9843-71e09c9af194", "value": "T1C2A45A11B7D1C036C26231744E6AD7B866BDB9719F35468B77D06F3E1E302D29A3930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871515, "uuid": "ba8df7de-ff47-41fb-8401-3693956764c3", "value": "9bac2e35c1c81ff04ab8fd0a24b8316d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871515, "uuid": "efe66109-68bc-47a6-aedd-007dd502cab3", "value": "12288:8R2IxnImmp6stGDNy2iRKtounB/eK2+FcBZ+:YrmvyNBoaB/eKXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640871515, "uuid": "1f2d1d7a-953a-49a7-a851-d1bbb94545bf", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640871515, "uuid": "b34d1ca9-d1a5-4481-9645-357a0b30d86e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871515, "uuid": "d6ab332a-4142-4f90-a5d9-a0b653864785", "value": "e197c583f57e6c560b576278233e3ab050e38aa9424a5d95b172de66f9cfe970.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520e736c-698d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640881622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881622, "uuid": "5bf40081-a4f3-4794-83fc-72d842a3640c", "comment": "Malware payload (Mirai)", "value": "1aade86aa581bb5b32ca4ae3dd9b5e89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881622, "uuid": "fb7d87b2-8aa5-4aa5-a410-7170c60c7035", "comment": "Malware payload (Mirai)", "value": "e2272effe913b582bde6ba9d657a1f9207b87f0e0b2a3aa4dcf03cdf1373e3af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881622, "uuid": "91f37e91-7168-4f74-884c-b36375d60d7b", "comment": "Malware payload (Mirai)", "value": "ace5e7dae21d16fa968cda87ee78b25718179942", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881622, "uuid": "44c33935-49b9-4af6-adcb-8300541666c8", "comment": "Malware payload (Mirai)", "value": "ae38b9be50c3b2394f06391b4f47b6fafc3606c2a98bf916b5cfcb318f11a40f7cf4a023e78f906a269d7d199f009275", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881622, "uuid": "86c6eeea-1de4-47b7-bff4-ff705140774b", "value": "T138B3ADABF24B1451C85306F407CB0FCE6F6721D2AF5BC9E36D6A253B18350DB190AB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881622, "uuid": "1b34bc2c-2bf3-4ec0-8d8a-ec49ce0c4e0e", "value": "3072:kLcBxe66f7CJqyX6HTYwsSY+CrvgMWFq:k/nHT3tbiuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640881622, "uuid": "6b0c885f-f955-4bb0-b020-1d0874c44091", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640881622, "uuid": "26c5fc93-382a-488d-af77-bd1ed0a9e5a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881622, "uuid": "0c1252ac-a6bf-4233-9d16-fa7313ecf15a", "value": "1aade86aa581bb5b32ca4ae3dd9b5e89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05d1dfb-6912-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640829006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829006, "uuid": "e533e6d9-eb7d-4bbb-8a74-b69c1c1082b2", "comment": "Malware payload (Mirai)", "value": "b9790d353642319cafe023d0256a6f93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829006, "uuid": "703f5f22-7c41-4fd0-ad43-144089e238a2", "comment": "Malware payload (Mirai)", "value": "e2a19058b78a414061a261560f82b2a7de635551118be2ae478da346e92d255c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829006, "uuid": "cc7531d5-287b-43c8-aab6-ca5ed5826855", "comment": "Malware payload (Mirai)", "value": "f7e21f3208b3b63e3e5df0995042439364491f7d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640829006, "uuid": "7cda6aa0-8cf2-4338-9712-6e2e254f98ba", "comment": "Malware payload (Mirai)", "value": "a0422cccad05fef1e89126a391855dd6c38fdc566aa2358e30f999ec8db6ac21b8672841cbf4351757a3b0f811955868", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640829006, "uuid": "485453d8-5295-4a2c-9442-af29aa6ead4f", "value": "T1116318817C80AA26C7D0177BFA9F108E3314ABD8E1DA73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640829006, "uuid": "72e9bc60-cc89-4be7-9bb6-bd389eb05866", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI89M:GbtexU0r8QCKw2Fb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640829006, "uuid": "9e57a27d-b384-47b2-82b4-26de66f10e17", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640829006, "uuid": "fa23e610-62fe-4d9c-9c4a-c3545fba8eab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640829006, "uuid": "fc5d5ee7-e68e-44d3-b8d6-e42834c304a9", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd34d13b-69b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640898660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640898660, "uuid": "7b72ff28-a366-4b9b-b2b8-7ce99f772377", "comment": "Malware payload", "value": "b73e633bcc72b77dbe5c0948a54c01b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640898660, "uuid": "3c0f1b45-09a4-4781-b444-6814413d216c", "comment": "Malware payload", "value": "e46ea10a5b05bf3eec5a25019a2d41b2a21d236c6bb2be113879d2c765ba7946", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640898660, "uuid": "fe246839-d52b-4798-bdb2-e24a722b66a0", "comment": "Malware payload", "value": "e417ee6635379ce52d6b5a82aed0861ce72a4508", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640898660, "uuid": "6313d51e-98d6-4013-a68b-0f07970b197a", "comment": "Malware payload", "value": "dc47d2d6ef7160a1b460dd5b78921c36ab6e13f3d6c1e5999a5bebc278309140214ec203096e670f9dfee8f6286f8659", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640898660, "uuid": "3ed1c87b-26f2-4be7-9502-6b3098a8dd95", "value": "T1829423C1DB093A78C7F90A38633FB2CA01168A6582438E1CFD2C5956FFA158541BB9F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640898660, "uuid": "46f1e0e7-2d8f-452f-8cef-2b51c3ba5d0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640898660, "uuid": "f488af45-c2e2-47ff-8556-92cd1c689faf", "value": "12288:5b1u/evmlOwt6gG4yiI1HwYSrBXEBrfybUDBhp:5bN+OwUgrBOHwrBXEBrfKUDnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640898660, "uuid": "e6e0b3b5-03ce-4541-a842-3fc833e687a1", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640898660, "uuid": "e3fe904c-7aa1-45cd-b8e3-2ac353d17484", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640898660, "uuid": "20a7946f-1147-4c79-bed2-f486433639ec", "value": "b73e633bcc72b77dbe5c0948a54c01b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b592b5d-6982-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1640876779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640876779, "uuid": "3d533af1-973a-4683-a863-03cf0f0ee8d1", "comment": "Malware payload (njrat)", "value": "cc579df05cc94213fa649e5e6a7bb249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640876779, "uuid": "80498e5e-a3b9-43f1-b44b-e95ba5429128", "comment": "Malware payload (njrat)", "value": "e80b7525c04cf98d2bb872559472d9d98f803cb43d02dd45c219c8b2f69ad02f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640876779, "uuid": "9f767375-08e5-4d53-a7a6-795e753e5bac", "comment": "Malware payload (njrat)", "value": "231683a72b0a4406b177ea62a45b2b06c37acfb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640876779, "uuid": "5f830933-d674-4465-a0d1-5639590933a4", "comment": "Malware payload (njrat)", "value": "efddd0b8cd4a895fcd8c7d22d72813039644c6f3b6cd80a77941b8be00396b6724fcde6f56948da7b5a99e1ef9e1e180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640876779, "uuid": "12846e5a-8e98-4d3b-bb4d-a842eecd97bc", "value": "T14E032B4D7FE18168C5FD067B05B2D41207BAE04B6E23D90E8EE564EA37636C58B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640876779, "uuid": "92f18aec-7c88-48c4-8127-8a4d07f8b888", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640876779, "uuid": "2163a6f3-47c4-4e2e-b807-151bb5109f1b", "value": "384:g7jrUiS6L1G5k2gyk/8If5e/QUZSgKrAF+rMRTyN/0L+EcoinblneHQM3epzXgNf:Ujz32bk/8IQYUZS7rM+rMRa8NuGjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640876779, "uuid": "e6d9b64e-9de2-40c1-8828-0ed6d51982dd", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640876779, "uuid": "45cfbd71-c68c-44f6-8077-9dcd5287a99d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640876779, "uuid": "63b0c51f-fbe6-42c7-8359-eb6c3019cadc", "value": "cc579df05cc94213fa649e5e6a7bb249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d908d2-6975-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640871537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871537, "uuid": "75ca215e-9164-40ee-96d4-e2b68428d5c9", "comment": "Malware payload", "value": "1b39dcc5de43d2840d6992a561e34eec", "object_relation": "md5", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871537, "uuid": "f33c1142-16ac-4801-94b4-86c4e2def47a", "comment": "Malware payload", "value": "e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876", "object_relation": "sha256", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871537, "uuid": "d7cf47d6-db97-4d87-83eb-2f6560d2ab76", "comment": "Malware payload", "value": "abb567aadfbd5686b3fbed027dc297646e6bbf04", "object_relation": "sha1", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640871537, "uuid": "eee85187-cd0c-4f85-b0d3-ff87611ed1af", "comment": "Malware payload", "value": "fe4e5cd8e2394410d9f6b6cd4ce9a8e336b5b2d53fce6792373f3b5e51d56d202bf2177e003569dd14a5354097387b03", "object_relation": "sha3-384", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flagpro", "colour": "#A2129D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871537, "uuid": "0e592e88-9ebf-463a-b3e9-7711bf431919", "value": "T152C48C11BBD1C076C26631744E56E3B4AABAB8319F35468777D02F7E1E306D29A3930B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871537, "uuid": "44f3af84-8712-4edd-a5f0-f2161c2aecfa", "value": "9bac2e35c1c81ff04ab8fd0a24b8316d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871537, "uuid": "ac56f3c2-9951-41e5-861c-2c999a4f483f", "value": "12288:f3kUNnIL4Qyva9myMBBWRb4omnOlydGuGEViW9bLMe:veL45a9c9oCOlydEU9nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640871537, "uuid": "ca7b4710-d09a-496d-8e07-7cd2a3b1ba8d", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640871537, "uuid": "95cd0e96-4d6a-48c8-bff4-285f1549a330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640871537, "uuid": "88019118-eb41-4c85-9f36-c66c3e3cdd75", "value": "e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73578cdb-698c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640881249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881249, "uuid": "4f39fdcb-d6fe-4813-b8ba-52cd0398725d", "comment": "Malware payload (Mirai)", "value": "9a5f95d3570c7583872a040df186c05f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881249, "uuid": "76d4f298-45ff-4f32-a9da-d0de5169121a", "comment": "Malware payload (Mirai)", "value": "eb4e8341a05747792802474ed98676ccd82adc46151f44d885227f24bfebde32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881249, "uuid": "696857fd-9b6b-4344-83de-d14c167873f4", "comment": "Malware payload (Mirai)", "value": "abf6b2d341a40f52d6ff728f16cc2ce3045b56aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640881249, "uuid": "035ef233-926a-40b0-a043-9cb2e3eb9589", "comment": "Malware payload (Mirai)", "value": "3cbb71f08ca7001fe8811822106de3b3aa70480a8aaf49c3d146b94ba86679edb22e5d8c3a5fb6e590a0c90194aa00ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881249, "uuid": "b4d07ab1-0289-4c5a-88c7-ee09b8081717", "value": "T176430956F8829B3AC1D0627AFAAE568D333073E8D2CF3117DD601B517A8A41B0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881249, "uuid": "a6fcc8e0-52dd-4a4e-ba79-c92d754b0e4c", "value": "1536:v3jN08yCL2q2dFNJf6/kNzokRHELtOKOJa10Hlr:v3jN0xzFzbhEpLO4Ilr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640881249, "uuid": "e47a8cee-23be-499a-bc28-688fe4f203b8", "value": 59924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640881249, "uuid": "cf024b54-45cf-4c24-9ac4-0c01c9a9ba23", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640881249, "uuid": "0920ee09-1253-402e-bfa6-924d231ee8a8", "value": "9a5f95d3570c7583872a040df186c05f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8c4a8c-6999-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640886819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640886819, "uuid": "002e29cc-906a-4ead-8451-b5288ae1b52c", "comment": "Malware payload", "value": "8cf05bb9c58fd8b72f3b27d5a54d95d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640886819, "uuid": "a5a61805-c0d4-4802-bba4-b626eb7127f0", "comment": "Malware payload", "value": "f95825c13bfccaa3bffe49f65d584cd015ce109b265df7bc75ace85c72ce7435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640886819, "uuid": "50d43317-5d96-4358-93b9-5515b5b18a4f", "comment": "Malware payload", "value": "254ab2f455150b27e6c530f38c99e1608c3799e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640886819, "uuid": "b8523ea0-425d-42c7-bd25-24734ac10ef1", "comment": "Malware payload", "value": "938bb9115575c466a2a46ce4070d62d1aaf2790ec34878394c282e1c0f2a207d371d66e533525f1b41af9f8fe02525b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640886819, "uuid": "339680ee-81f3-466f-a021-46046dc90490", "value": "T12EE52302BEAFBFF4C616D037C66494754E4370111EF54826570AE73D2AC36358F8AAAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640886819, "uuid": "2b34dc15-c0bb-4334-b036-ea96b054bcda", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640886819, "uuid": "5cc63126-64ff-4096-a704-5711c6b6e179", "value": "49152:8YOKf1ATiyM/kLVEwexF7BfG9ksGtHvBnG7Ocu+AxJS/sK8aLKaBCjKOHGhWSg:9fJXxFN+9ksSBGW+smnLBBwGhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640886819, "uuid": "68f6cbee-8813-4b81-baf4-4ddc2c05e089", "value": 3316736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640886819, "uuid": "ef84101b-ffe0-4d32-8897-0af35ce7f04f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640886819, "uuid": "27441b96-def3-4f51-9dd6-767fd0fb82d9", "value": "8cf05bb9c58fd8b72f3b27d5a54d95d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70bd9b0-693c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640847003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847003, "uuid": "36a3ffdc-1379-4c7c-8563-e5dc35309852", "comment": "Malware payload (Mirai)", "value": "e2ec822b1f4835f937da2e09b1764ed1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847003, "uuid": "0e69c3f2-d6fe-4448-bab3-a19aa19c572e", "comment": "Malware payload (Mirai)", "value": "fab90387d1d83e6957f1f2494a769ac4d7cf6ae4e6e425bead0af9aa393d9220", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847003, "uuid": "7f2e1726-3d03-4c56-9090-d54738d7fa4c", "comment": "Malware payload (Mirai)", "value": "927a7e79c1203673c1ec6afb98ae1e47785c65d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640847003, "uuid": "9f4f1b5a-471e-4d4c-994b-d3c52188167d", "comment": "Malware payload (Mirai)", "value": "14394031baf89db932820da6c9fb854240644ffe8d17653f79f868beb34f088011c39a31a1aa596dad8f0c5b0d8f2ccc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847003, "uuid": "eda11fbb-45aa-41fa-b789-758b0c1a8b76", "value": "T144F2E1DBC45BC74CD57E223A1C6F656B9920C249522CAEF3DEA4A0FF6940F98143CB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847003, "uuid": "ad80244e-ce1d-4206-af76-82d45c9392c5", "value": "768:2WZy3jZrI0Gsf09vq//PZtyc6V7y+H1beBOnbcuyD7UHQRjbx:2WZkp3f003qV7NbeBOnouy8HyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640847003, "uuid": "d9d6265f-9fc9-46a8-a305-043ec32eb71d", "value": 34512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640847003, "uuid": "0e8380ff-6ddd-4d49-aef3-94fdf591c881", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640847003, "uuid": "1388d807-529a-4644-8744-0fe3782932b6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3601a31a-69cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640908204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908204, "uuid": "a3b3d4ba-3858-4555-97b8-fc217183889a", "comment": "Malware payload (Mirai)", "value": "afb740eed1cd3da41309ed73af6f969f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908204, "uuid": "1c84df41-e9fd-43eb-ad15-e861c0f70aed", "comment": "Malware payload (Mirai)", "value": "fc646062cfb581d6ea11c11d54d91c170e7b37ebdf1ad867ad50bf15ae8e2bd5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908204, "uuid": "ed6b7b02-acd6-4c0c-a7b0-7526c1e731ef", "comment": "Malware payload (Mirai)", "value": "4d2989a1f45adc23ffae724a5df0da2b4644c911", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640908204, "uuid": "caea245e-66da-4e4d-8c22-5f6669db1f33", "comment": "Malware payload (Mirai)", "value": "54a8e85552a4009f4658401a1ca78be0585d1a1962dd3ca259fc33c6dd2aac9691000da68daf8fe2e318ce2cc612e338", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640908204, "uuid": "41060bfb-a9f2-438b-a8d8-3e132ebfc231", "value": "T199E34D86FA408B13C4C61B76FAAF524933229B55E3DB73068D185FF43F87A5A4E13606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640908204, "uuid": "34bab120-630f-48d8-b00a-0579cd2c3b58", "value": "3072:Lu0dThFYrZNXJYqNj0mrGV4px3X8FjNKfaZ0aM/9LG/r:C0jFwZN1QPV4px3XUjyaZhM/9i/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640908204, "uuid": "963341f8-669c-4800-bc6b-c5b966772661", "value": 144135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640908204, "uuid": "ba26aaec-8027-4e57-9310-a6dcad15dfd7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640908204, "uuid": "984a1c54-1d3e-4ba2-a8ee-e8c69fd64c2b", "value": "7ega.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660a790d-699a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640887239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640887239, "uuid": "11bd3eaf-f3e9-473f-b70a-da2b68a72d16", "comment": "Malware payload", "value": "eb1efd7251bf1e72c35a1780190d834f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640887239, "uuid": "df8ab937-c948-4cf6-92a2-6bc0a1f5b3f6", "comment": "Malware payload", "value": "fd1b953cc5368cba5b5ca029fbe1cbd9413b8d3bca7dc8576621534c6c0f856f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640887239, "uuid": "a901e928-d2da-4a48-84c3-dc993d9e9280", "comment": "Malware payload", "value": "49ebf525d90839cb33a82ab3f1502e422c9c5811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640887239, "uuid": "afd59fd9-17ee-47c2-800a-9330964e199a", "comment": "Malware payload", "value": "579663c794700722a14f700e954dcc325bfc1ba4e2e3be55a9d2d704112557f8ac464ca2fabc59952a90ca2a59a5024b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640887239, "uuid": "3cbef4b2-8ffc-4847-b589-24df66d09691", "value": "T17C754A93FC9164B9D4AADA318A66D2A17B31B858073123C73FD097BA1F72BD01E78354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640887239, "uuid": "e36a33d3-30c7-48f0-a1bc-3e91656072d9", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640887239, "uuid": "2b845170-0dee-4c94-9008-e6b489849c22", "value": "24576:8ViqjuMccN3tvD0A1wrGNmSg5hscosyW44D1v:8ViqyMcU3RvZgTsc3yW44D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640887239, "uuid": "f610bd7d-b089-4594-a4e5-3037cea7723a", "value": 1598976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640887239, "uuid": "c5b40dde-de1a-4183-9cb7-6375c9531aa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640887239, "uuid": "9cc13bde-90c8-4de8-b20e-a9fc9ae17bf4", "value": "eb1efd7251bf1e72c35a1780190d834f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }