{ "Event": { "published": true, "date": "2023-04-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-22", "timestamp": 1682208181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ca631e74-8b45-45df-aafa-c4ebc4e300fb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc01444-e0a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682124871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124871, "uuid": "ec1f466d-4fad-4723-a863-f102982310e5", "comment": "Malware payload (Amadey)", "value": "a1a830ec32763ae045f543eba5b94059", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124871, "uuid": "e0937c8f-e640-4dc8-8ecc-cfc6131d3ead", "comment": "Malware payload (Amadey)", "value": "002a61801a9d8bac8ed7036f4a3f594edbda5a2ffc43a0598941c4c1e67ab95e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124871, "uuid": "3da98eeb-123a-4e24-b840-536b39fbb0cf", "comment": "Malware payload (Amadey)", "value": "4f038c5313c5c435ff4e6ad1a26d2a5226dc7fe9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124871, "uuid": "d2c7dc44-063a-4c41-bcc8-51e9f77b642d", "comment": "Malware payload (Amadey)", "value": "66b3efad80d205bd30e4f6bb698776b640cde063ed4c780eb9f576ea250d91a7b0d869fe65e80f149cfc3d0e40656cf1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124871, "uuid": "9df3995a-1561-415d-9fc5-4e82e506adc7", "value": "T10634DF10BBF1C477E96305794431C5A47F7FBCA18A6482AF7208675B2D72AC09E7B362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124871, "uuid": "41c4c4cd-cab2-41d4-a61d-a24f2608cf3b", "value": "8cb869f42d9744fa3286b04b1d083ca7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124871, "uuid": "a3241e6e-cddc-441e-989e-56349944c63f", "value": "3072:4fIvc+SomyJltoe8F4DA5gYkTa45nbFhZOrV:2Iktolltoe8F4DA5gLLYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124871, "uuid": "904eb270-8494-4de6-8473-6ad96206c08e", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124871, "uuid": "c4a80b7e-199c-4917-a375-0e715bdd5333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124871, "uuid": "8f1bc47b-b453-485e-aad8-6ef986310caf", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e682377d-e103-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682164238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682164238, "uuid": "448ad003-793a-4d38-9236-6bea3f003dc6", "comment": "Malware payload (RedLineStealer)", "value": "ab1f78cb73e54f5caf70f05555ff62e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682164238, "uuid": "6d3af679-4436-45dc-8c09-9ddb866f7176", "comment": "Malware payload (RedLineStealer)", "value": "0067e328e717839391d9109e2756c3b23807d25b0e6d04860946a57dedf739e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682164238, "uuid": "f09785dc-fd34-4f08-ac92-fb2c91c1b752", "comment": "Malware payload (RedLineStealer)", "value": "145811440b149f2b76c3ac9a0a423b4ff4ec334d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682164238, "uuid": "31d4af80-f187-42b6-9171-eef771ffc588", "comment": "Malware payload (RedLineStealer)", "value": "0ad282f05f7d219e16c28cd2b1401e021cfeaf9461a35c383063ba11e3755a7ce85dac67b0c8bf0a172b4dff446f3be4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682164238, "uuid": "fd9db1b8-99e5-49bf-aa12-ba0843895c13", "value": "T1BFC41202BAD89132D8F067B059FA12931E36BDE34FB487AB274958DA4CF31D0A531727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682164238, "uuid": "9c4b47ce-11cf-431f-8ca0-e37c8aa2a1ea", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682164238, "uuid": "403769b5-6a0c-4dc6-b16b-c3f8bd7bd5ea", "value": "12288:ly90dTEuRoAD46aQp4PWHqUP6Jd/ypHvGX5bfOMd4ohJWv1rCE:ly4Ro36zQpz/APGX1WMd5hYv1rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682164238, "uuid": "d070f214-b61b-4ffb-982f-b9f215ee4129", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682164238, "uuid": "8cd0dc17-7ed7-4159-a62b-3ca81cc6084d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682164238, "uuid": "a2a4e796-f04d-4996-ab1b-9487f2d7e9e3", "value": "ab1f78cb73e54f5caf70f05555ff62e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e49e97-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682160524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160524, "uuid": "d2a46db6-0cbf-4992-b265-b7a2a7d7e0ee", "comment": "Malware payload (SnakeKeylogger)", "value": "8392c4dbd830b3f877d5ab6dacebb5d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160524, "uuid": "ea32747a-8997-48df-b800-76bed51b9fa2", "comment": "Malware payload (SnakeKeylogger)", "value": "0072635a2bda42343af1afb62d86f500d931498337411f7fbbb0a850a3e386db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160524, "uuid": "a1aa699c-04c8-4281-b15b-abf52b8f6a34", "comment": "Malware payload (SnakeKeylogger)", "value": "cedc9fe840d0faa7d2becde8b13f4375e8b9157c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160524, "uuid": "5099101f-a633-44b6-b71d-dfbc1083534d", "comment": "Malware payload (SnakeKeylogger)", "value": "674cffcf79fb5deede4700394d9dd989c0981385d4aad3a2f9c02239ca832f608d1ac36c4a16929d0e85f2e35c8b0343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160524, "uuid": "611a1459-730a-4ca3-8e12-b71f4eb91140", "value": "T13AD4E1787253AFA3DBAEC9F11158639617E233B37ABC359CAF0E81D116873C0499D492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160524, "uuid": "725dd1e8-63a3-426a-a717-e95c29245ce6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160524, "uuid": "edaa2d65-f5dd-436f-a0ea-59b24ee40f62", "value": "12288:2i6osjs8mStBGJ5VvsBddRIv+AutvnQR0Nsit2wIJD:9bOaVvSddR8Ru1U+sit2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160524, "uuid": "af8fb19c-82b1-47ff-bfb4-d7655013a979", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160524, "uuid": "c3ececba-48e0-413f-92cb-c119a8352ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160524, "uuid": "e51de210-df48-44c0-9053-dc881288619f", "value": "VESSEL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc84da1-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1682160549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160549, "uuid": "1b5a9441-866b-410c-a4d2-342617e4a597", "comment": "Malware payload (GCleaner)", "value": "5a9e75a3a28a65363ab7e58f3ea8e785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160549, "uuid": "737041ee-5aa2-4407-abb0-5e9cf37ff512", "comment": "Malware payload (GCleaner)", "value": "0118948d17aab89c166dccd04ebd0e6df16676abcde79c2e69d5280d3c7b6110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160549, "uuid": "9b66281e-1fcf-4bf0-bbf0-63ef40c7c688", "comment": "Malware payload (GCleaner)", "value": "61c930cccb27c0030482c7654e2b282f8e539a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160549, "uuid": "b72ceabd-94e3-4d71-8398-837951052546", "comment": "Malware payload (GCleaner)", "value": "e0b5a0a1d77dc403da55e4546ed1f10a86f5556ecc4b438928608d91b6cb8fe4756f1f206baa1211132c7d59c2211bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160549, "uuid": "88910122-99a8-4cb7-bf39-5be41e207df9", "value": "T1A46401A07AB0DC36E9B932B4D872ABC51A7FFD550864944B727C3A872E623C05D71393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160549, "uuid": "0ac2095a-10d8-4c8a-9e85-b4c8b5d2e65d", "value": "83f7b03b4e2f4d598c9968669b5cc91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160549, "uuid": "f07c800c-f715-41e4-8da6-9affda9a4bd5", "value": "6144:HWE2tCJNfqPKplNYgnFNoq8ZwVsQl8nNGhFYr:HqCJlqyplPnz8eVshO+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160549, "uuid": "08a82648-fc4e-47c8-aa1e-c745df0ca1b3", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160549, "uuid": "be159031-a103-4115-a2b5-f6f6ee9d67dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160549, "uuid": "b101026d-f128-4e41-853a-cc16e2544b05", "value": "5a9e75a3a28a65363ab7e58f3ea8e785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21455b2b-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137708, "uuid": "1de81943-d167-462c-a3af-269c989d8206", "comment": "Malware payload", "value": "dc66c2a047891d10732daf492bc2730b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137708, "uuid": "2fdfa1c7-85ef-432c-b45f-2527cabcf09c", "comment": "Malware payload", "value": "012652bb5d48f2700cca262a0ad3b88ad9b6bbc7a3c8e00ab08555364f23c0b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137708, "uuid": "928cebbb-e10a-4e73-8a7b-c7d2fe313203", "comment": "Malware payload", "value": "fdd76eacb20263fc8b64a54744b6c2a51890b16b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137708, "uuid": "c06d0b89-05cb-442e-a191-84a7a17262e0", "comment": "Malware payload", "value": "92d6587e2a5db642ef35b5f2d353c005707c2703babcf5377bebafd65a883572ff8e3a0ed7d67a2e1026270a1f2137f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137708, "uuid": "58d308ea-51b0-4a40-b322-334055558d97", "value": "T1C905AED2EAD3C0F1EA8921B952FB5B3B1E3556014322C4E7AAD02D81DE911F1B77F246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137708, "uuid": "2e4c09e9-c3f9-4043-a49f-a6b1e56032fb", "value": "f79ae1492c9d2acb7252931fd0164382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137708, "uuid": "8d508544-a93c-455c-a8d3-421f1cbcd9be", "value": "12288:Pr9shsglMJF15Yj43MNB2Yldq3+ZeW45+6/rcxJ9RmlJDs9GmN8:z9VRJF15Yc3SgN+4z/UYkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137708, "uuid": "613642e7-dc79-41c3-b9c4-e9cb12a8036b", "value": 843040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137708, "uuid": "b9f2f2e5-61e0-4e61-8072-91d5f5a717c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137708, "uuid": "c6443420-5322-4491-9b75-fd5765e738f9", "value": "SecuriteInfo.com.Program.Unwanted.4695.25823.18308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7385db-e0b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1682128221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682128221, "uuid": "bc1634cc-2542-4321-8896-75a53ecc2af9", "comment": "Malware payload (Cobalt Strike)", "value": "b5a59877d15ae44b7e6ae2f87dc55097", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682128221, "uuid": "74e0a793-ab94-42a2-ab05-2cf8a2604ea8", "comment": "Malware payload (Cobalt Strike)", "value": "027c7ef57968b71e87125f6c6a56308ab39ae86c2b4c3abe91bc1033acf7ad4f", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682128221, "uuid": "db01af70-5df8-445b-b5d8-d71271637960", "comment": "Malware payload (Cobalt Strike)", "value": "58e8d064a4539abe593c59e47426ee460a927dfa", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682128221, "uuid": "b3c333e9-d0c7-4731-961e-b8cdc29810fa", "comment": "Malware payload (Cobalt Strike)", "value": "148746ea34a8029a991b6421e5c56d0d134f38b3a2d24c4b298151bacb1e2c59fcb9f458f8bdae4c32e8ffc311631f90", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682128221, "uuid": "a97ea740-5b91-4740-834f-7b96917a04b5", "value": "T1B545944BFBB611D5F4BAC139A552322AFC7234A1873897C792819A0E5B31FE4AD3D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682128221, "uuid": "9f7b50ce-73dd-4c17-86ce-c6c4511648ea", "value": "af7f6932070a3fbc16359cb52768bbec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682128221, "uuid": "9b4d1092-ee1c-4bbd-a874-29d6e690f317", "value": "12288:FZuJcbnE0TeXCEEpH2FMPoquVqfRdjDs4h+liXhZdMLfOGlYkvIu1CdyS:FZ8cbnE0TeSEUs4h+wdYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682128221, "uuid": "48d34869-5957-444c-afbd-c09b9d71fd01", "value": 1217024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682128221, "uuid": "83e65811-9b08-4f99-a49a-f1ebc465c5d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682128221, "uuid": "da9fe69b-857f-4b86-bd4d-67aa0b575dec", "value": "b5a59877d15ae44b7e6ae2f87dc55097.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57a1774-e0ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682162438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162438, "uuid": "f233a6db-27da-4b41-b6fd-4ee5257c8724", "comment": "Malware payload (RedLineStealer)", "value": "a6289397a42b6fd3d523125477e9b908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162438, "uuid": "d5d63fbd-e551-4cbc-87fd-b125b2f1127a", "comment": "Malware payload (RedLineStealer)", "value": "04dd08f36e6d569c9a799187a64454139e55557c0c0bc59310d4f79c56a9a4af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162438, "uuid": "5d2b9de9-de2e-49b1-a280-d0f114760c68", "comment": "Malware payload (RedLineStealer)", "value": "1cd1642b3d3ba3acc84af2015ee4753e8a8dfd0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162438, "uuid": "dbcb4135-18a2-413b-8b0c-0705f5e1b44b", "comment": "Malware payload (RedLineStealer)", "value": "41012eb01a50bd1f8307bfc950422fef17a6832de8158f647affbcc28b40c42ee487a11aeec12921a1329980236ddcd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162438, "uuid": "5bd53489-3007-4c96-b87d-033841f06e8f", "value": "T1AD35235362D80072ECBB07B158FA12830F3AB8A58F6D976B73895ACD5CA32C1D533765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162438, "uuid": "09a0c830-1f6f-4951-8206-27ac506a3e59", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162438, "uuid": "966a28d8-5994-48f9-8230-ffc44a643dee", "value": "24576:XyUqYmvrujz4Z4EP1e/pB/AHdj9qEgXZ7XMEOQjVqR5I4WvB:iS4Z4ENegh918Z7L1VqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682162438, "uuid": "1bbf9474-f4f1-4e70-bcec-5503e98b8f71", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682162438, "uuid": "232de894-bf91-47a3-9ecf-35b3ec1882e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162438, "uuid": "b6e50453-427c-40f9-a43b-78a36fbc9161", "value": "a6289397a42b6fd3d523125477e9b908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9372804c-e0d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682142624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142624, "uuid": "3d01c1e4-194f-402f-a18d-2c0d285d2e27", "comment": "Malware payload (Amadey)", "value": "c37a9e4786a3d25b9c53f5bb831517b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142624, "uuid": "1ebd17e5-9218-4155-a757-9402d77f25c8", "comment": "Malware payload (Amadey)", "value": "04ebf1541755ae54eff8becc94ad35849fb9db2017f812010d23596ba4e79949", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142624, "uuid": "92184f0e-8269-49aa-adf7-28d0d9aff254", "comment": "Malware payload (Amadey)", "value": "04f633febf50e9046a12305ee8fd2e92a5d96ae9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142624, "uuid": "094fd56f-0dc1-41c3-87c5-4d31850c1766", "comment": "Malware payload (Amadey)", "value": "4e280e8adc5ffeccbe337eb4ecc30e4f866c72f91bd6f46486dbab2030865f49b603ffbbdf3d79fbb6a062c7b86ca6a8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142624, "uuid": "da6bf02c-1b0f-4b9e-ba69-9a9a65cbc207", "value": "T1552523429AE85476DDFD1BF029F602870E39BCD25B62C6EF338669D988B21C09534367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142624, "uuid": "a7e885e6-6c47-4fff-98c2-f4fa9de65241", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142624, "uuid": "946fc219-f40c-4876-9859-9e117e136a15", "value": "24576:Ay0GQPjz6DtPxwGlD2kTY2fK2BNXTifcbBpoCLFQxiV7k:HNQPWJaWikTY2n5ifcb/oCLFQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142624, "uuid": "93de7a90-0142-4927-8bb0-5fa769a34da3", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142624, "uuid": "d97beebd-606a-4de5-9039-a269e91bea5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142624, "uuid": "e5338499-02da-4f8a-acaa-000c22e403f6", "value": "c37a9e4786a3d25b9c53f5bb831517b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933aa5ca-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137470, "uuid": "191d494f-64bd-4d5f-97ba-a474de8609aa", "comment": "Malware payload (Mirai)", "value": "e1d51d06151679cae9edba0cdedb3bd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137470, "uuid": "650d7937-9551-42e3-b5ab-d245bcd5ce6f", "comment": "Malware payload (Mirai)", "value": "05729e8b4241c82a5138c18253ad1d5920640d83afe62c632efdfcaf99e4a0ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137470, "uuid": "56c8228a-bfc9-4a86-9668-650141340513", "comment": "Malware payload (Mirai)", "value": "83746edbd966f42eedc5f8402ab327db8b76c1bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137470, "uuid": "b7155933-1667-4a01-8ea3-78a7faf632dc", "comment": "Malware payload (Mirai)", "value": "779c5a90701d2864cc15d26fa59feccdeb6a2cda0aa6ed140cc77772e17162b8dc24a289b1a1045edf17ac6bab6501de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137470, "uuid": "1d646910-3090-4e7b-ba17-8c3dc5a8ae47", "value": "T13D1308662D45B2BCDDF60078B49320A514A3453C3B8CE6F37187A87AEF75F097698E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137470, "uuid": "dae90ce9-8e13-4f4e-93df-a0202f980dd7", "value": "768:LzU+c++Q5TjfjW3MGsjcFbJBZU/ogBlJHsHF:Hpd+0T3W88FbJBZUXuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137470, "uuid": "311df080-4068-4e8e-be86-0ae0f623a5e1", "value": 42328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137470, "uuid": "bb861357-9440-411f-b326-c2012f391962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137470, "uuid": "558e14ba-009b-4f88-b694-d6f762022315", "value": "e1d51d06151679cae9edba0cdedb3bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49496945-e0a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1682124461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124461, "uuid": "6546476a-f475-4705-b88d-fab6b9a6db75", "comment": "Malware payload (Stop)", "value": "06dd1f2ddb4a80e41cb821ffd2018a41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124461, "uuid": "4349a85a-2576-489c-ac1d-55982c2931f5", "comment": "Malware payload (Stop)", "value": "0615c07820c91d1e97dba87624c07968fa9cf17cb8bdae44a050e7f9fdddf232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124461, "uuid": "1d825659-83f5-4d7a-bb7c-37feade15ea5", "comment": "Malware payload (Stop)", "value": "510ae38ac30b83ba63a442133297d39a72e00196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124461, "uuid": "9df2b240-dbf8-492d-ac4f-b20cf1fc4c4e", "comment": "Malware payload (Stop)", "value": "9edd4d79b43bb024c7c69151edfb9e434e211884c24cf96b415ab195497f8a75670b5039341c16e83d66ec678dba1a2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124461, "uuid": "72ff7e0e-06e2-480d-b42c-72c623d83849", "value": "T1D8F4122261F2C436E8AB01754824F2F57A7BFD664165C55F32187FBF2D213C1AAA63E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124461, "uuid": "33d3ee40-4e38-4a41-a27c-829b350fad91", "value": "c2613217b278bbf906136c8e0c29af3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124461, "uuid": "10d29e08-628d-479b-941a-14517adff261", "value": "12288:kwgE+tZkB3NDGTSIv84R4ByMVb/WM6xYu48cupJIv0a+VQm9oTdaRDULWZwp:kwPB3lGTk1WMs749ui9+jiDmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124461, "uuid": "c8e933b4-2b85-4a59-b556-eb85806d79fb", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124461, "uuid": "7c9b4421-9d81-4fd1-9646-1ce27e26f43b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124461, "uuid": "a4381300-fff6-4935-9bff-0b4d088e57a1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228684e6-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137710, "uuid": "e29bd209-1b1e-4107-a331-a5d675ffbc61", "comment": "Malware payload", "value": "28d38562bb6910379889c7c55b24f74b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137710, "uuid": "ecaf5f15-b8ad-424d-b284-c740e35f7d41", "comment": "Malware payload", "value": "0749f360beed3f9daca1dc8dad161310f2f5920c412399c5e6bf253ea9ee470a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137710, "uuid": "a8e20bbe-3e7e-460e-9ad5-40927ebf928c", "comment": "Malware payload", "value": "971acda217fd1d33b391e02d0c69c6a6d6ee6c5f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137710, "uuid": "f6740f28-1945-4f8a-9698-9f2d39f36a04", "comment": "Malware payload", "value": "6995aa6136ef33aa5bbd4803c8bb44a04547d2fe1342e2c775437aeeb57e4eefa5463d57078d728a9842e93e743f5d3f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137710, "uuid": "e72eddf1-a7ec-45f7-8aec-c76e153f8b79", "value": "T193048D013685C034E6BF023A49789B111A7E7DA18FB59ACB77D84E8E1A742C07B36777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137710, "uuid": "572c4897-c5ab-428c-b28d-56a3755a0a03", "value": "b677c4ed10775cf75a844db778818284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137710, "uuid": "08bdd369-7819-412b-b31a-db5d6b123213", "value": "3072:983bw2YtCita11clb5CjyKmu4yfY+Y+UfuUIeZi1Ji1S:983bNYtC+AsbgiAB2+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137710, "uuid": "a9a507ae-de08-48d0-97d3-f435cf32d9ab", "value": 178976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137710, "uuid": "9d01c2f0-f5c3-4fb0-ad32-31516f734881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137710, "uuid": "7c7b8dcd-dc76-4022-a4c2-6a17ebe0d72b", "value": "SecuriteInfo.com.Program.Unwanted.4695.3514.16322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5044d5-e0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682161488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161488, "uuid": "47a434bd-9239-403d-b7f1-f431b2190faa", "comment": "Malware payload", "value": "152b2b03c7bae475c6b957d6491236ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161488, "uuid": "85d58dcb-bc63-48d6-9c55-b20b050f8725", "comment": "Malware payload", "value": "077b2f0fedbb74fa78e5bc24cc9e0de679388589aea62a5e2403ea7a94ab98d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161488, "uuid": "59b306e2-3721-434d-a103-7c027927decf", "comment": "Malware payload", "value": "6f5a0f594d7e1a904e6f44d0a0a5759b95efab5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161488, "uuid": "db03c9dd-59ce-4504-83a6-aa5dd03d9467", "comment": "Malware payload", "value": "78cbf9b9aa2ef707c9f26dada437cbff83346333a4f9aea443472ca2ebae102dbffd18e9395bb2ff51a8ac308d3130cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161488, "uuid": "d8493645-f8b0-4729-86d3-c10b20799c6c", "value": "T17016F1C5ABEC05E5D026D0788B6E8932F6717C590B308EDB15A5B23A7F776E04E36321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161488, "uuid": "c378a4ec-d742-477f-8e55-5405ebd25ef2", "value": "edf648b5b5a1f70a447894f3e677e7f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161488, "uuid": "c378c561-2249-4ca3-8e9f-2840ad584f26", "value": "98304:z0xKMvMqTODN0SkNnxDlpk45vd2KBr5/yRZxl:zevMCuN0SkLx56KrsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682161488, "uuid": "39e4d49f-981f-4d7d-b63d-c02e5c3bc93a", "value": 4357632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682161488, "uuid": "e0006759-0efc-4e38-b470-da7c780a9a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161488, "uuid": "5b609814-1ea4-4784-8044-1018da3b359a", "value": "Coodesker-x64_1.0.4.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da04bd0a-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135441, "uuid": "32fc26bc-643f-4e64-a19a-b856c6878daf", "comment": "Malware payload", "value": "3d0c4f725e31e73377d72f25e240c53f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135441, "uuid": "c4b4e15a-3b72-49df-a5d7-6c1200a5bdcf", "comment": "Malware payload", "value": "09e87a3e082225b856c670037a5bc1236bd8c4f7cfcd5c62c7ae58cf55588ad7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135441, "uuid": "c588fdd7-c9ca-42be-a217-0ba9cead2f7b", "comment": "Malware payload", "value": "f0da7f7281a9fff7026788943d9971bdc81fef24", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135441, "uuid": "7e00b579-3106-4d6a-a4cf-f5888c77f580", "comment": "Malware payload", "value": "4a4b12fe5d28109cbf933f9942e57429aa523766a6b48bbc2032bd1a6e017d2bff98791882f1cc4896c09c7391c9c19a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135441, "uuid": "bfc90413-06e4-406c-842d-e42961ead268", "value": "T1BB94493AF680D537C43508BC8E0FE2E5756AF2302D345D5BB6E51F4C48B96939A2BA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135441, "uuid": "d3c1bdac-f5d3-4713-b323-99bb65ccc5f4", "value": "6144:oq4/ZdjqF1Tov7yuTlb5251VnHgsk+Brlka:dIre+bQ5jnLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135441, "uuid": "c03e45ed-2db3-4995-80e4-4878413dc7c1", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135441, "uuid": "de49866c-62bc-4855-8271-6878bfcf06ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135441, "uuid": "79787917-1b6d-4cab-9b03-7c549c02a9d4", "value": "2023-04-21_3d0c4f725e31e73377d72f25e240c53f_kovter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fa8cc5-e131-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682183732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682183732, "uuid": "70706cb6-c022-497b-ae50-b59d93bb33a1", "comment": "Malware payload (RedLineStealer)", "value": "1c11d3bc670f53d33fc5c58579c85423", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682183732, "uuid": "9a136281-df93-4e23-8c40-6b2a80eea90e", "comment": "Malware payload (RedLineStealer)", "value": "0aaacb8abbf329836ae61e4dde6d8ee3cb131bee3a31465e27ca12268a9fef06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682183732, "uuid": "84383f58-63aa-4949-9f53-adf7f8b68792", "comment": "Malware payload (RedLineStealer)", "value": "4b65e17c0e9c88107239c9d7c6ea69c949b9c6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682183732, "uuid": "7b4f0227-0054-461d-b3e6-9426afac8d2c", "comment": "Malware payload (RedLineStealer)", "value": "276582b3dd87137beca7748447cb7dc959bc5e4f2630d0d34b4f13937e4373f6f2f0f61d56be6d84f6203a63e25a4189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682183732, "uuid": "293f0d3d-4b31-49b1-b3b8-650e7d86da56", "value": "T1B6C41207A7E45172DCF927B018FA23C31A367DA15F79829B17416E8A5C736C8A93073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682183732, "uuid": "7ea261d0-4625-4c45-838f-a490fc668c4e", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682183732, "uuid": "e67ebf90-122c-495a-9f01-db7f3817150b", "value": "12288:Qy90rotk/tJnvWN4CYFy9tKMVwbBQ7pFaMWeKOi:QyKhrY9ALN43a24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682183732, "uuid": "ebdf62b7-a587-4ae4-a151-97e32484b8fc", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682183732, "uuid": "3794a796-679c-44a9-9a38-d19cfd3cad72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682183732, "uuid": "ee062abb-7fb4-44cc-a40f-9923a80a5654", "value": "1c11d3bc670f53d33fc5c58579c85423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfc45ba-e131-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682183873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682183873, "uuid": "0505a192-d242-4815-8876-ebf4acff77c3", "comment": "Malware payload", "value": "4181e822697a7ceea34916edf0d0ea40", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682183873, "uuid": "e8860f4a-c0e9-4136-bcb7-1ba0c18df5b0", "comment": "Malware payload", "value": "0be9c1d1cc81651a8173b6185822c8553cbcaf7f62ac266c4485148734803a03", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682183873, "uuid": "5233c84d-59a2-42fb-b0b3-1e3bbcd45f41", "comment": "Malware payload", "value": "ad76ee628a0991e3f5bedd7d505579f03f1d9962", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682183873, "uuid": "27f900e7-04bc-417f-ae71-df9e48fba6a0", "comment": "Malware payload", "value": "146720bdb58b04fde1f06e4593ce0d677c7ff8e8b65147a5695afecbbe20e34b646b204f30dab73690c200e7d8188baa", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682183873, "uuid": "5e90e0ec-29ae-4fa7-b498-39e001420177", "value": "T19B17339844626D2ABE6D5494CB2F7B77C0C017F60F8E4CE71E49D40E5BFB4A82B26C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682183873, "uuid": "e55d4921-60ef-4ae4-9dfd-d8ce1089a68e", "value": "393216:3NOckoxt6ElDYCjOSVyPHgiPhI29zrJdJxjKcgT0:dOMt3FYKVy4iPhtrnZgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682183873, "uuid": "d84ce5dc-b6c3-4fc7-b442-245c59cc5604", "value": 19305800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682183873, "uuid": "749e50ee-496b-460c-8351-930770fb5209", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682183873, "uuid": "a8abeb28-ade4-4947-9f7f-ce32fece132b", "value": "SynpaseX_Cracked.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01259d6b-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137654, "uuid": "74437648-4d2f-445a-8065-57c474362c04", "comment": "Malware payload", "value": "4d1daa1e671dc60cf8dd98970a51db79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137654, "uuid": "2a0fc172-135d-4632-88cb-aabbf712cdbc", "comment": "Malware payload", "value": "0ca515da87c7f0b0dc2ebc413e00f28290f0faf5c6c319a37f89fc0b79543301", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137654, "uuid": "f74f3cea-8df2-479d-8a59-ee652c26d5ce", "comment": "Malware payload", "value": "7ffb8c0fa98cd77c50d4a942efe8f341b130112b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137654, "uuid": "8a3da335-e738-4891-810e-2cb26020f102", "comment": "Malware payload", "value": "ab388f959a5bfb38abaf97371363471ee5a38e6baff3c0a298f9d4217593041d5ecf1a3247e04ca332e3977a4a8d6883", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137654, "uuid": "617adbe7-060a-42e5-b4ad-f8a0e1a689a7", "value": "T175821B8B5FA53137FE836E7167C9E26AAE73F2E0D791846F10AA82411FC0791372502D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137654, "uuid": "7938027e-b12c-48ac-87cb-36683bd16761", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137654, "uuid": "13856873-5811-4b02-b667-109d94044676", "value": "384:Ghc32cN2AwRm4Nda3hsWpnYPLaiSKTuQiSKRid:y82cN2AwRmEdNWpxi1Bi1Rid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137654, "uuid": "0c9acd11-c286-44d3-9830-d7029660a162", "value": 19232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137654, "uuid": "46d4745b-c809-40e1-9962-b285f498dfbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137654, "uuid": "7f8b113a-542c-4aef-9535-25ffdf38afe8", "value": "SecuriteInfo.com.Program.Unwanted.4695.5809.15116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f876f6-e0ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1682154163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154163, "uuid": "6a587ec0-1ac7-4c15-940a-412d63186fbe", "comment": "Malware payload (DarkCloud)", "value": "16b379e46fac08b88f547c861d6275a1", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154163, "uuid": "d2e63fad-2273-4b44-9475-136f86b553a7", "comment": "Malware payload (DarkCloud)", "value": "0d039e252be161ce77bedbceb89fcb9b1d641075fec25fca928aff41914df2fe", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154163, "uuid": "87d0ea3d-3c1a-4589-98dd-e628096ea927", "comment": "Malware payload (DarkCloud)", "value": "f138506d5c04c0d457999fe8aec457fc2ce96a79", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154163, "uuid": "4a7aceb2-8b96-44e8-8c40-7e031ee45ab1", "comment": "Malware payload (DarkCloud)", "value": "10181501f1162f520864e654d700d9ac53010a277f42797e6ff71254c91af2f49bd1ab05e45cb62f21b85927c348e044", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154163, "uuid": "4bc0be76-42af-47ca-b996-cf471b5622c0", "value": "T1D8551242BAC184F3D06309365979AF20693E7D704F759FCF6790662EDA321C0D2357AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154163, "uuid": "3d3b7690-d501-4396-8645-65cec94926d0", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154163, "uuid": "95c18f34-1f95-4c60-a249-6a61187deed2", "value": "24576:TTbBv5rUDAbVkNoLAXjXXRQFX8KZsl4n5keJpUUBQjqfYTfz7V2EggiVEr5:NBDeoUtQST4aezUUZ8V2EgO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682154163, "uuid": "ae733eff-ec87-4f7a-a8b2-17e70f008cf1", "value": 1311340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682154163, "uuid": "f3ff8137-a137-46c4-af37-4bddc56ee070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154163, "uuid": "bf176a70-897e-4b02-9047-ed7291542d10", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe52fcd-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137645, "uuid": "8a995c58-e205-4115-958d-44224b6891eb", "comment": "Malware payload", "value": "dc6f6175cf5d3da85009132b8c2070d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137645, "uuid": "2edc4f57-8297-4fcf-bba5-9fa4db207d33", "comment": "Malware payload", "value": "0e7cdc20931c57338935c486972602f6eab7fc86683178ca430371c2c18d2325", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137645, "uuid": "6ed9a2f7-22a5-486f-9ce3-3dbd2c5bde7e", "comment": "Malware payload", "value": "112afe0b111090dcc27a5149d0632d983dcfccc5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137645, "uuid": "f2b1e9e5-9800-41f9-94cd-ecfb557d94e7", "comment": "Malware payload", "value": "6d3e0605ceb8e57b3e37a5edd760701344250ca431f3c21c0d43593b72af60137b257dbd3454ac0b5372b1d96456c349", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137645, "uuid": "897f8fc8-eede-4ffb-a996-23a4c317e881", "value": "T10EA25CC60F685212EE8F8D71E2F6C72B5E72F3D0DAA5C55F14E890D26DC1390391A22E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137645, "uuid": "1ba929a4-1a2d-4a1c-bf9c-581141543390", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137645, "uuid": "6abc2272-cf4d-41f2-a46d-ff1234bcc2c6", "value": "384:jdF99O4KtM/1MX9nYPLaiSKTz8iSKQLpiUI:j99Zt+9xi1ci1QtiUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137645, "uuid": "4df3127a-40d1-4eb0-a263-b39c49f16977", "value": 21280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137645, "uuid": "df9e4a7f-50a3-4e6a-8a69-994525bc4962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137645, "uuid": "c641727a-190c-4638-bd62-598c890a62e2", "value": "SecuriteInfo.com.Program.Unwanted.4695.13108.27344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec50d35-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1682160789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160789, "uuid": "8d0fe179-7801-47e0-8b97-6de667fbab88", "comment": "Malware payload (Socelars)", "value": "f1cd6e7fc3e175151d9519b00488c453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160789, "uuid": "f3b38ed0-ff86-4f26-a84a-6355833a3a0d", "comment": "Malware payload (Socelars)", "value": "0eb36f99936ba2cbdd17e45df8c891acafd31d9626cc9d0334a94927317ae5c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160789, "uuid": "957f61f4-67ac-4a3f-835f-bf1b0c5fdfbc", "comment": "Malware payload (Socelars)", "value": "af76092d3a2e28ec734ab66a38e5c8e6b93b2da5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160789, "uuid": "6c1394d1-7d76-45f3-81aa-895651a9b594", "comment": "Malware payload (Socelars)", "value": "8584639397038658e677fd7076f911f21df3fa22916c9b39fd13a36ab81215e57f1fdab3745ce7fac29fd02ca9d11467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160789, "uuid": "b1c749ca-d5c4-4b6a-a11b-710b6c0238e0", "value": "T17F658D21F7C26032E8E310B745FF6ABF9D2C6A11470894D7D3C81C999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160789, "uuid": "5af1c13e-f546-40c9-a9bc-256291b1e441", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160789, "uuid": "4447b049-0a66-4965-a6fc-3da9344436ae", "value": "24576:+GU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRPo5hFS2:dpEUIvU0N9jkpjweXt77Q5/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160789, "uuid": "4def34e4-e058-4a26-8ff0-6ec4cb8e276f", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160789, "uuid": "528a761b-c975-4f42-8cd9-21b3a9bccd12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160789, "uuid": "4d73cde4-b7bb-4eb4-b5b0-c7cfad2abd5d", "value": "f1cd6e7fc3e175151d9519b00488c453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f395c0aa-e0a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1682124746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124746, "uuid": "2c29e235-f794-46cc-8944-52e0727702ad", "comment": "Malware payload (Stop)", "value": "9bbee7a3c01e80121c9187583a103d4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124746, "uuid": "9948d1aa-0d37-4b16-a78f-4ff292e48118", "comment": "Malware payload (Stop)", "value": "0f3cf7eb4a39448632d857ca47ffd0546614f5065512ff1f0b937b4637d78c15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124746, "uuid": "3caabaab-a502-4ec8-952f-3f3a3ddea2d8", "comment": "Malware payload (Stop)", "value": "7c5f510954f7ff990379151df7134d0bfc8adb88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124746, "uuid": "f7ee00bc-723b-4e69-9c87-624add2da617", "comment": "Malware payload (Stop)", "value": "52215c7088ec25763bd1954665daf517d4ec8b87ddd78e872c129ce0a95a5951fb495831bba4966c2ba09c465494a2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124746, "uuid": "6c32893d-305a-4202-ae6c-ba120e70780a", "value": "T1CAF42350B1B1D026F92A0DB56939D36EEA3EBC560611C15B620CAF5F2D723C0ACB735E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124746, "uuid": "9d5fe192-fea3-43c0-a1b2-6acb343104f5", "value": "83f7b03b4e2f4d598c9968669b5cc91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124746, "uuid": "cf1b1bb1-8f90-4129-9e56-d06a2f3733f0", "value": "12288:GuWR58WugZwKbf0b+AtnEive6udjweZz+lZ4saR9Rhu5cfmlpE4ar:Gl8WugZwyf0b+AtnEmuXZa/4DhQnlWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124746, "uuid": "fb9aa42c-eb73-41b6-8016-8bd81f2b3c96", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124746, "uuid": "98f449d3-6181-4296-b56a-15d3a529184b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124746, "uuid": "4605dedc-f6b1-40b9-9567-cc4f750c5790", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d150fc83-e0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682157331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157331, "uuid": "fde4cc12-cabd-4a92-81bd-49f0bc4754f9", "comment": "Malware payload (RedLineStealer)", "value": "f24b0fbfad5b438d1cfe28ca1e29c1be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157331, "uuid": "72d729a1-088c-4809-a913-6042862ed601", "comment": "Malware payload (RedLineStealer)", "value": "0f910fda9a2743b773a4d1272cc49b6d238ebab4262d25e8970a76061c52ab9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157331, "uuid": "89ba0b91-5be8-452a-b310-769c012626dc", "comment": "Malware payload (RedLineStealer)", "value": "158b2af312f49598fdb301b1c3acf16be4f4b83c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157331, "uuid": "92163171-a16a-4767-b8ad-7d1fc2ad48bc", "comment": "Malware payload (RedLineStealer)", "value": "cb73740d9a3a64b1bd302fe9237ab402af39ca739c10e8d1a5c40a3d8cb02a66708108822cc44220cef81fc32680b038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157331, "uuid": "544c4a85-7294-48eb-95e5-dcb050420f06", "value": "T16905220167E05273C9B907701CFE27830B7ABD865F60A39723A69C8E5C731D1D2767AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157331, "uuid": "067eb186-1f76-45f6-b26e-a0006d74a9b5", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157331, "uuid": "2c3c9942-607a-46ee-82d7-0adf27526bcd", "value": "12288:cy90pvVQGGv9dB/VjyDjx9BlxE9JtOg+ed/7Y8OhOObECm7BBVA7YX+UURqgytoF:cywvVQGGdB9KhEPMILPLK7YOLqgytoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682157331, "uuid": "6f45e414-3c1e-4e5f-b330-ec09690c40ed", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682157331, "uuid": "29524834-5085-4561-8a3f-b47fa8cfe919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157331, "uuid": "8e0b2ccc-d6e6-49ed-8301-24ec3370d788", "value": "f24b0fbfad5b438d1cfe28ca1e29c1be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edadaf45-e14d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682196033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196033, "uuid": "4a24d7fa-7308-46c4-bb53-d5e059a3c0c1", "comment": "Malware payload (RedLineStealer)", "value": "af25111a225e484c58996c24c550d897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196033, "uuid": "afe756b8-e6f2-4043-b88a-4093669f42e3", "comment": "Malware payload (RedLineStealer)", "value": "101b57871792d53eac167c7fab7503a5ef8c815283dbcc6682f587a10eea4074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196033, "uuid": "c5a1a797-01ac-4b0c-b54f-32393c082e9a", "comment": "Malware payload (RedLineStealer)", "value": "a0ec04d55b799baea255720efc9e320911f04109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196033, "uuid": "b24c9268-6ce4-479b-8fbf-2630a41e46d5", "comment": "Malware payload (RedLineStealer)", "value": "f420606327f972a96bcc4944bcb44201fbae6d1fbc04b0434839dbf9902d97f2d5b2e299953c70922ff7620a055c9d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196033, "uuid": "0a041e7e-f8d7-4519-8a6a-b22fa8e805f8", "value": "T12EC41252B7E44432E9B617B054FB01C30B3DBCA15F7487A7271A299E5CB26C4AA3437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196033, "uuid": "2779408f-053d-4c9a-bbdf-7281daf36eea", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196033, "uuid": "50030ae5-15b7-4c7d-93e0-d59dc2aa47b2", "value": "12288:ey901NJEMoHcAh9jPFHotQjtmLo9SQsH09YGRDTMifJhUKhdq1f3F:eyeJETrVdtUQpYQDTnfJh7z43F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682196033, "uuid": "5ff741c1-5bc6-4247-b9c8-43ea72d3d5d8", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682196033, "uuid": "3cf4132f-5f6c-4777-ae7f-98b875af41fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196033, "uuid": "b5556054-f33b-430c-af86-a21cf2eff19a", "value": "af25111a225e484c58996c24c550d897.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194f6496-e0f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Expiro)", "timestamp": 1682158740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682158740, "uuid": "a92efe49-ba82-4710-8b6b-c945a1276ad3", "comment": "Malware payload (Expiro)", "value": "3673e5c3ef9bacbbc5ba69a6c1836414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682158740, "uuid": "8baa42c6-a9e0-49d6-8c92-ae0ae717fd79", "comment": "Malware payload (Expiro)", "value": "109e5e87ec6e71df87f51f450e21d4cdb56044043f5e0d6ecf4286964dea0eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682158740, "uuid": "636cab8f-b37c-4f41-b110-0086108a7326", "comment": "Malware payload (Expiro)", "value": "eb2b7233f85e24805ae21bf14b76facdaef45439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682158740, "uuid": "1da8fe59-9bb8-4830-b051-7923eed64a7b", "comment": "Malware payload (Expiro)", "value": "c50e437a26a43bb183164026a2328a90880b63d82d70d3bef0ea59331ec44c185d31891d6a0c0efb36c6c000d876c508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682158740, "uuid": "666a2848-11d5-4dcd-992c-60d7c3d9f099", "value": "T1186523EDA7F5D1A7C12D4F7E0416668E3F3090E3722AC13DEEC7449EAA86B141D95283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682158740, "uuid": "6d2dfa89-7d45-4b5d-afbd-490de74b58ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682158740, "uuid": "20033149-a90d-4f29-a39d-7f59c4ca7e55", "value": "24576:w8yDFSP04t6J3Rlt+So4L+dGahZLfQRotH4W5Ps30moupeD1lsEy0Md4ojF8Uuba:wFFSc4t6J7gxa+lzL4Eg0WED1SEidZat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682158740, "uuid": "ff757bf8-9797-4c40-85ba-a385415872fe", "value": 1475072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682158740, "uuid": "610b9f31-65fe-49f4-8d54-feae869ed080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682158740, "uuid": "049f1b74-9cb1-4b6e-aa3a-a0b8bbed9c71", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8e8ac2-e0e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682149246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682149246, "uuid": "ef24cd7e-f4b3-4f89-af5a-2e5adf0aa974", "comment": "Malware payload (Amadey)", "value": "c0d0a72742fb112e8def67083dab6732", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682149246, "uuid": "58b6b338-4373-484d-8dac-4e3a904e7f99", "comment": "Malware payload (Amadey)", "value": "1377436ef0011a1eb9b7d6951bc1087f2d8f8d75e0f945b71bd1e15bfe9c7bc4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682149246, "uuid": "64e7133f-bde5-46b0-be69-169ad37558d8", "comment": "Malware payload (Amadey)", "value": "9402e592fd75e1b82a62a86a2a4a55d3306b95e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682149246, "uuid": "fed4fc65-c792-4a45-8d27-b304942f072b", "comment": "Malware payload (Amadey)", "value": "c79e1521abf3ff4d65938de424f7ea472ab0a29707f826136b72141ca47e0974a91b99793510e75476c3b97519b6c8aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682149246, "uuid": "d437a4fa-11b4-407e-be63-8bdc7de23504", "value": "T17A052212AAD54172EDF54BB058FB15930B36BDC18F7C92DB2398688A0C725E1E17273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682149246, "uuid": "ea00996f-307c-4949-82ed-6bea8363995a", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682149246, "uuid": "38c807ed-c498-4324-a41a-7fe8d37f01b4", "value": "24576:yyBdjACfw+9aa8ZTdO1NXAlQJpfFt66l:Zvfh9aa+O12A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682149246, "uuid": "f43a855b-c370-49a4-82d3-edbd78a1ead9", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682149246, "uuid": "58a78723-3865-4c5a-8742-079d1eb95eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682149246, "uuid": "b16e3d50-8bde-4195-aa95-b08b732849a3", "value": "c0d0a72742fb112e8def67083dab6732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca238319-e0a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1682125106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125106, "uuid": "6ff35145-49f2-45fa-9eb8-40bca01c2711", "comment": "Malware payload (Stop)", "value": "d0314cb693af51787f761b94d0df39ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125106, "uuid": "0ed7ee0e-23a1-4978-b994-bfdc6a16491e", "comment": "Malware payload (Stop)", "value": "13881326224c43c988e0c42f24ff56a1d5881452df73ade6745e18d3b2c72ab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125106, "uuid": "77fe2cc0-8fcc-4d87-aa17-fee3fcfd7cc7", "comment": "Malware payload (Stop)", "value": "8c62c9641fdb3f49b6d3542b3eaf4a2cd23c4b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125106, "uuid": "7bdc127e-9b85-4790-ab89-0dc09f90842d", "comment": "Malware payload (Stop)", "value": "0841f25400e91feae773af70f961690ad37c53f67f9cda06f7470698f14e53c315a2d620e90da37ce5a66c80504828e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125106, "uuid": "fa7d1adc-771d-4a29-b269-3e82f78acf75", "value": "T179F422207BD2DC73E9A305315862DEFA65BF7D624A488287710C6F2BB9771C08A77352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125106, "uuid": "4f653074-de99-4fb6-81bc-7abbf5791ffa", "value": "61d85d277266f17cfef1e7003ed47fb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125106, "uuid": "7ac4f127-0689-4116-8f2a-29dc19db5d7e", "value": "12288:NZ/TjAEaorYHeCFPi4Tm7AZNUSU++7KG2gRRgDYn5yij:NZ/gEao0HpFTTnCJ72cgE5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682125106, "uuid": "573df8a0-3722-4f2c-9255-fcee9128c3bf", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682125106, "uuid": "ab80dbf1-57aa-4c28-86ce-db502795af64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125106, "uuid": "efdfc010-676b-4f7e-b247-6c894e6a628a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db96df91-e0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682160354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160354, "uuid": "cdac7c40-2254-4e3a-8d48-e52d2399747a", "comment": "Malware payload (SnakeKeylogger)", "value": "f72b59e18d4e0c55ed7810926a3aa510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160354, "uuid": "ac297756-3698-4fd6-a1ab-e7dd7f8d786d", "comment": "Malware payload (SnakeKeylogger)", "value": "1404d60fc92ad4f5e3059a37a50bc70803f25404635f969333b4618b891e64bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160354, "uuid": "e9d3a8d8-14bf-4734-afaa-5d411233bf26", "comment": "Malware payload (SnakeKeylogger)", "value": "ebf5c7d7bac4c53738c62412eeb34a57e19630dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160354, "uuid": "3772aa42-4094-495d-9e73-ab64f67e5b94", "comment": "Malware payload (SnakeKeylogger)", "value": "c38040f8eae1603c642ea9d9a7984dedeb8a0ae782b4e59436c3d29a410a30ab69a358fa5d97ce2a9fbd0c18eb0173d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160354, "uuid": "de39bf10-cb26-4206-8e27-1cf511bdd787", "value": "T1BFD4DF747113AFA7D7BECAF1014466500BE63EA37A7CF1ACAF0E35C916B678009585A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160354, "uuid": "df2c3f2e-aedb-481a-b3f0-e480ac4fd1d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160354, "uuid": "679ce7dc-f375-4d01-aa6c-5cfa1194ad46", "value": "12288:z5y2iNnaMzOOeyM/xOARNW0DAQsyiOZCgY3rStGK:M1QMzOOggAnIyj4rRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160354, "uuid": "edb3604e-ccc7-4f07-a555-d6d6a7d429bb", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160354, "uuid": "4631a019-3dd9-425a-af41-74bfb9cd50b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160354, "uuid": "6455a87a-3a9c-45a7-b7f8-af95f10e82d7", "value": "RFQ 0071HS63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda62237-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137648, "uuid": "7d5af533-b535-4a4a-9ce9-6ef92f9d8f6f", "comment": "Malware payload", "value": "00abd48bcb8a9f178f408605e1266f1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137648, "uuid": "53111ea8-adc9-4488-8395-a3ae3348f615", "comment": "Malware payload", "value": "14405cc69b02830cc2f6221e30b8de8815c25d557117fdea0903747a1475e722", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137648, "uuid": "49bac723-749c-4442-9b66-41dd85fc5ca4", "comment": "Malware payload", "value": "38309cd2f9e6507222c1175e191b3fbd28e212ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137648, "uuid": "b2a06d2f-36e2-4128-96b9-0244c2b3df85", "comment": "Malware payload", "value": "e8ebca5f2dc559243543dab45ea21a207a0242edf36d87547a2b51e88e5a888f9d9f86268f4a9785058c510629f0ed74", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137648, "uuid": "04cd8d49-8cc2-434c-a7cc-db22a2ecaf4c", "value": "T156823AC61FA93066FE867DB257CAD25ED977F3D0DAA1C46F106D92822EC0751375402C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137648, "uuid": "70d27586-cc85-4d1a-a1b2-a550e80a6285", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137648, "uuid": "0e1744ed-09f5-4815-9ad9-4ce94bd15a0a", "value": "192:RCiAtapiUldITpl4CvTczSogll8vXnYe+PjPaiSsFc4waCyFiSsFc4weJwh77bjJ:kiAta8UHIFqu+nYPLaiSKTCeiSKfciRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137648, "uuid": "2b05f778-4ca2-4aa9-a476-5f3cbef0ced4", "value": 19232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137648, "uuid": "fb4b0cfc-ebfd-4dc2-8c0e-f82af6c1d9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137648, "uuid": "7b9300d1-c85f-4b51-9891-7e611ebfe20e", "value": "SecuriteInfo.com.Program.Unwanted.4695.13612.3607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ddcad1-e0d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682142326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142326, "uuid": "a3d035d6-ccc7-4334-a188-97be82299910", "comment": "Malware payload (Amadey)", "value": "ba7ee3e2923ed85fd62772bf14913618", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142326, "uuid": "58282bbd-f29b-4ceb-a08c-93dd31a30ccd", "comment": "Malware payload (Amadey)", "value": "154f0355e471d9c80cac0109ed5444f7d9a74ce328d795758bfdcc790b19abc5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142326, "uuid": "bfaaa14e-26e8-4844-ac4a-a7235ec87401", "comment": "Malware payload (Amadey)", "value": "56bc8258d4ef395072b94300f764f465367afd8a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142326, "uuid": "feee04ed-5b30-4875-8e33-5924daa4624c", "comment": "Malware payload (Amadey)", "value": "8e08facf8c95345cacbe70beddb0255bf1d4a173c77c7c3bc192ba89255c96102178d2883e2694aadcd751bbe60c9c70", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142326, "uuid": "88c3c52f-93ff-45b2-9ec8-fbece93764c4", "value": "T1EC25230336E89176D8F6037054FB41D30E363CB29B6845DF2384A9AE6CB19D8A672777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142326, "uuid": "572dd45f-9833-4bd1-b918-bbb7b64a3af9", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142326, "uuid": "cb7a4b43-8f55-4df5-959e-059b730ec85b", "value": "24576:zy63N93LXzYUnrWbcwYl/eoZ/8F6I1m/gFoKe/b:GGpLXwYdeoxIs/gFoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142326, "uuid": "aba95f1b-a6d3-4a3d-85ae-473bbbd76465", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142326, "uuid": "aa4ccfc0-1126-43e7-9578-7d1cea80be5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142326, "uuid": "7076786c-37f9-4d4e-a792-4dbebcae7455", "value": "ba7ee3e2923ed85fd62772bf14913618.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25778e47-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137715, "uuid": "fdffec54-d527-458d-8352-3cab5eaedc9b", "comment": "Malware payload", "value": "5a292e19619e21b2ae7795f4dfc715b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137715, "uuid": "192c1667-eb29-48a6-8bbd-d10cc552bb87", "comment": "Malware payload", "value": "15c146aa1e18516b86a6eef03f3c803813b79465cfd9d63985360444ffd5d7c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137715, "uuid": "87d1925a-aba6-4f70-ad0d-88272363bb00", "comment": "Malware payload", "value": "499a39da013c49936332c898250286aeff36c4ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137715, "uuid": "29a7b316-f15c-4971-9ac2-29f89bd8bdf2", "comment": "Malware payload", "value": "7c9e2edf8fb32d1d86567fa335d69766a0b42c685b20f48261321c9c24ecf59eab657a5f22470ab8efe3d140fa5b16fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137715, "uuid": "94c36f51-a3c0-4778-8fcd-e9ab18442cad", "value": "T11DC25B861FE89222FFEB4FB158F3C2151F32F6D19965C60E24E941C86CD1F506AA432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137715, "uuid": "5084128d-2923-41bf-95a3-78f1ac5c4825", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137715, "uuid": "0d3511dd-01cd-4b3b-9a06-a100884538da", "value": "384:w6LY7rFj/YVeTk29Spu6oRf9qzjZMd8nYPLaiSKTLPiSK+AiJ:cxj/YVq2e9YjZE8xi1vPi1+AiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137715, "uuid": "7e9ed237-8b12-4454-a5cb-34f3e382bc58", "value": 25888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137715, "uuid": "fc30cff2-660c-499b-8384-4cdf3f50a74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137715, "uuid": "568948f3-5d7d-4175-bf2d-627c0c6d7539", "value": "SecuriteInfo.com.Program.Unwanted.4695.17381.11051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275a5f15-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137718, "uuid": "39bfa4e1-ae69-4bdb-a230-a58c54861bce", "comment": "Malware payload", "value": "d261e048290f37c1c37bb60444d4f234", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137718, "uuid": "fe661de9-dcc0-4f62-b1eb-9cb3c0e9e1d1", "comment": "Malware payload", "value": "15f7803247c03ff4a4f4048c40a614854ec2dae8542019e9775539ac574ee2b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137718, "uuid": "9ddf9478-0789-4635-94d7-ebe0f883aeca", "comment": "Malware payload", "value": "c6fc2d7f81c7e221328e830e7fa24947d04c9438", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137718, "uuid": "1fe54ba2-d5a9-4fb9-8cfa-2c8a8145d5a0", "comment": "Malware payload", "value": "31811c05bb2d1f7bae0c9b083066b0544addc8733f821accaf5cd15fe9251488c4060a07e18da74015edd944a3be27c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137718, "uuid": "faec9b2d-7994-4568-ae70-f80870aac0d0", "value": "T1A0230A252AD93136F9227AB29BC9E75DA766B3D49743C6BB20AF43C317C4A407723134", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137718, "uuid": "ab60c95c-8fa8-4e00-99c1-30923a1d4726", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137718, "uuid": "1a427fa9-b0fd-41ea-8224-f127dba9f508", "value": "768:834u+88SzKjU4Rt+InUekOLcsjOw781XP0Z6HVPaFMejmSbcTomkIA2nolPTdh4r:8IlMs9AyR4Aei15i1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137718, "uuid": "dfd34d3a-c122-42be-a962-a426c464bd56", "value": 48416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137718, "uuid": "9d1b385d-d8db-4ba9-946d-3ff817dd0aa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137718, "uuid": "9d64c20c-574a-4eb9-b14e-f9f311d07bb4", "value": "SecuriteInfo.com.Program.Unwanted.4695.27791.24159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0096fdf-e0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682154752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154752, "uuid": "1ca84ef4-1a4c-4472-8435-483e42d945ce", "comment": "Malware payload (RedLineStealer)", "value": "d9667c523017a7b69f20934a3f1850af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154752, "uuid": "ead2fd90-e89a-4ecc-ae78-7e280041b7c3", "comment": "Malware payload (RedLineStealer)", "value": "17495c26695c34bbf94c733fd2da2f92a1916ed1ca12b8ead023231d0faa39c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154752, "uuid": "61f9236a-6bc3-48f0-b74d-9eff91097cfd", "comment": "Malware payload (RedLineStealer)", "value": "693e6463c93b4008ebc7d2dcbea3adb0768d9b7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154752, "uuid": "fd492b6d-ad9c-4ce7-92c8-c0ae1b30b84d", "comment": "Malware payload (RedLineStealer)", "value": "93433ce1cd7b19b498e41ff4c6d36a9757383175c493c622a63e9a6e45b58e77fac50db6778c7c5e707203d695308883", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154752, "uuid": "392f4ea0-63a5-4e39-9db1-e0acee3d3fca", "value": "T1F9F41253B3D81072D8B1177008FF42831B79BCA15F7997E7239A6DDE18A22C1963636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154752, "uuid": "001a53e4-7fe5-4972-85db-5f7cde70e0b1", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154752, "uuid": "36910315-dc24-41de-93ed-6b53edc1331f", "value": "12288:My90Jo3W/FWXKtKGrDZzYlCvgmXpzwnnqOoc6F/cu8wFToQgyllOV:MydmteKtKedzYl+xtehoblmmly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682154752, "uuid": "80bfc0f0-c1ec-41e5-bc75-0e37bdd443dd", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682154752, "uuid": "ea980a78-5691-4f5d-a9c3-ae8b3d330b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154752, "uuid": "9bddaca1-fabf-462d-af28-67c8faadb1bc", "value": "d9667c523017a7b69f20934a3f1850af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d231b689-e113-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682171076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171076, "uuid": "b06f5b98-06c2-4ff5-ba44-bf8268a26a13", "comment": "Malware payload", "value": "f5d9c79b3bb3a0cec4e462c1e677783d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171076, "uuid": "0611ea9c-5b3b-4a2d-b356-3dd752e44399", "comment": "Malware payload", "value": "17625c6f18e2ab976e897ce0ef3aff56c2404cb464f8dd53a8232517280a730d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171076, "uuid": "4e75dc61-c34a-4ae2-a3c7-32fb4f18bbc4", "comment": "Malware payload", "value": "cd03dac7de7c573daa52d5dd94923d24538c317c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171076, "uuid": "2e2a10d1-4152-4986-a065-0845ad6bd3c3", "comment": "Malware payload", "value": "edce98a356daf24e30ba744e7fbc0048ce5d224e98d9743ebfd421b641a692b243ba167a652ebf08b053d738c20bf6e1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171076, "uuid": "71963de3-e6f2-4531-b395-34f2127b2f73", "value": "T13025337167D8F52B508C1A19B0E1574EA4F0A6D68FCEE168F5C493A00ECF870758AE7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171076, "uuid": "a94d2cfb-ff51-4deb-8f10-f76774669b6d", "value": "12288:KIGt+cnAXl6JLH8j/40GbNw5f5rMdhK2GGOz25mbo9gRXM5Y95ffrLgy3jjkAHE/:RchJQJQdhBGGOzzbJL3/XTzmGi/forUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682171076, "uuid": "1a9d308f-ad94-4606-95ab-ca80b7baf26a", "value": 999748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682171076, "uuid": "9af01075-b2e5-499b-91ef-7445f10b4f6e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171076, "uuid": "be4e3877-a9a9-4465-908a-a3b55bd162e1", "value": "Bard_AI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d10b072-e115-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682171739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171739, "uuid": "6e1fa02e-1616-4bb5-b9f4-b628ccc325dc", "comment": "Malware payload (RedLineStealer)", "value": "9387aeb56628d9c1a99f6e534f8bf081", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171739, "uuid": "92fc3869-d14a-48d4-bc18-4490ae32ab95", "comment": "Malware payload (RedLineStealer)", "value": "18707aace701f7b096f81a7a06ef73c88e309fbf33eaf59e144b848918e72357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171739, "uuid": "661467cb-8826-4a9d-8c59-08b647721029", "comment": "Malware payload (RedLineStealer)", "value": "6c0ddc1e82222841fa741c0f4fa950f4dd2be0e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171739, "uuid": "aefa46cd-e014-4052-b487-b845c37665cf", "comment": "Malware payload (RedLineStealer)", "value": "b6705f5c5b29e1f155e9542310da08fd3e7a5daee08c43a0fd3ede8e79afb3a64f0c87b8eab3259d0870074c0bc2e470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171739, "uuid": "c076dbea-5799-4ef8-9146-e644094dc7bb", "value": "T14E352351BAD95A72E5A027B008FA03130F31BCFB9AB4A3F752555EDA1CF2184647237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171739, "uuid": "cbe389f6-40b0-4759-882a-87d39f70374d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171739, "uuid": "86f2e102-fc42-4e76-96e7-cccacbecc505", "value": "24576:oyK9uv/d9y+7lFWEZTFh+TU3x0pCaOkUNDr0xJ:vKcv/d9dlFWEZRkU3xyONRox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682171739, "uuid": "63ad73c6-5c53-4f53-96df-02f98c29c838", "value": 1139200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682171739, "uuid": "c3dc40d6-e26c-498a-962b-a0498332af44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171739, "uuid": "b0166748-5e1f-456a-a21f-d67ce5b55605", "value": "9387aeb56628d9c1a99f6e534f8bf081.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5687fff-e0ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682141419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141419, "uuid": "9912d507-67e7-4fb4-8114-bb74115d056b", "comment": "Malware payload (Amadey)", "value": "5707ceeae6ee47fddd4c64e5f984d119", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141419, "uuid": "2774c28c-340f-4d98-9cf9-29bf2e69e005", "comment": "Malware payload (Amadey)", "value": "19d6c00f2165c08f5e82d10d37ef57752946432d45a339294026f3d007e83b70", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141419, "uuid": "63a0eb57-5922-4b9c-ace6-c54c2f2b45d9", "comment": "Malware payload (Amadey)", "value": "0f4f588b3998d52f25e351f15f9c29629528fbed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141419, "uuid": "aafe3240-de8c-4327-823a-cb28f4a20bff", "comment": "Malware payload (Amadey)", "value": "5383b7b5633b7be116c1d08a54f7dbf14ad56ad4737bec479bd4e5c8942fb49653da79ca73ab96a046f75961d227cb58", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141419, "uuid": "56e062ca-b2a4-47f9-8778-b8d0d196e9ba", "value": "T13B252213F6D88123E8F617B041FE66830B3BBDB12B6852970794DE9F68B18C4B531766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141419, "uuid": "df720e78-eaed-47e7-b1cc-a4df834ce406", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141419, "uuid": "418ec0d5-145e-4928-86be-2eaf4a6cf222", "value": "24576:tyoUkEXrJX2WbIsf8eq+ySTogghbLzaMuQSq:IoU9Csf8eq+ySsVjaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141419, "uuid": "f72ffb99-e165-41da-9ece-6deed1351d24", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141419, "uuid": "9980bdf0-7bd6-4868-878e-8c8c307770f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141419, "uuid": "0ba1d24c-1964-4173-878f-31a780e123a4", "value": "5707ceeae6ee47fddd4c64e5f984d119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb4d9f2-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135444, "uuid": "71f02132-cab7-40ec-8098-f86390c13046", "comment": "Malware payload", "value": "7da83e0a63039ac6aec5b8cbc31d20d6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135444, "uuid": "07ebfdf2-3075-481c-a9a9-391c7a46a3b7", "comment": "Malware payload", "value": "1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135444, "uuid": "d136b3d7-8e0c-4f15-83bd-8ee577fe5f40", "comment": "Malware payload", "value": "6b1d7db9600cc88922b9a213f7b30f29fe5bc20e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135444, "uuid": "49c25a62-24c0-440d-83e0-87c348776b26", "comment": "Malware payload", "value": "a99948b6094daeda9de0d61581bf6f30634b9965b0dbfa9ef1f322e3ea576b4671b31084430f1261b176a111e819dcf0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135444, "uuid": "5ed3e88b-0cb5-4c61-8ff8-a071fd23faf3", "value": "T177947C0271F08572E9A219386CB16AB6436DFC741F60C6C77788F5AFAD712C19632397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135444, "uuid": "5b916d52-151f-4168-bd8d-cd027f66b974", "value": "12288:iKPmrLbovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135444, "uuid": "0b8b3025-e79f-49a6-acf5-e1f525f4b5b8", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135444, "uuid": "776e459b-3e65-4a90-9672-a5ddb3fa9505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135444, "uuid": "f2b5ad12-c279-442b-90e3-479dbb13a79b", "value": "2023-04-21_7da83e0a63039ac6aec5b8cbc31d20d6_locky", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f5e0b6-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137642, "uuid": "b09d7094-19e9-42c7-afa3-3d1b55ce401a", "comment": "Malware payload", "value": "6cc45d2a9c47036f94ac99c06a780e3b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137642, "uuid": "b9936c60-d8d6-4f16-9559-25ef6ddda38e", "comment": "Malware payload", "value": "1e806495c5a93321e5fed76d2a61318b18ea6494b3019847e9b6fe68844cb4a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137642, "uuid": "bf9eb3e9-5c55-42e9-b834-27523f3a5a89", "comment": "Malware payload", "value": "d03979ad41d0d250f89f4870b9d4a5eafe8da07e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137642, "uuid": "aa837c1d-0ba8-4985-a503-e2947998eadd", "comment": "Malware payload", "value": "9c1920e306678ed7a5b45513e110c83c814a59a3da9b0a98df13a7e14626dbe6e309996b03c6c6fe7378bc9b44c1ca14", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137642, "uuid": "314370cc-e5a7-4cae-88e6-70801524bc09", "value": "T14F5339DB322D9225DD6E4BFE80E38A114771E11456AACF07146DE3294F433D82E5B37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137642, "uuid": "0d532eba-c424-4629-af76-25cb287b6264", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137642, "uuid": "80557488-6b86-4a12-bb6f-fe6d69a20b01", "value": "768:xexl81nX6ZxlvUAa7KoBv7epginbCe7AXjuw9tL0Duxj7tr+BrIxFSWxi1K1i1W9:xexl81nK34PJepgqcVzACi1K1i1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137642, "uuid": "a64ebf21-efc1-4406-b70c-85454e9a96fb", "value": 60704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137642, "uuid": "98b5ee16-8841-4f14-bbda-19bac4d00e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137642, "uuid": "f7d821d3-9705-4df2-8a07-0707fa715b42", "value": "SecuriteInfo.com.Program.Unwanted.4695.532.13878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662f2cf1-e116-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682172183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172183, "uuid": "62cf08e4-80db-4e90-9b70-69d04dd4f94f", "comment": "Malware payload", "value": "d8831eb73305f2d7b557c199ec55126c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172183, "uuid": "c5402591-b2f8-472b-ae6d-33f3db06f9d4", "comment": "Malware payload", "value": "2094eaaed1bc72c47e2cd38b442272b9b6286185c14000a7bd61662f51f844ea", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172183, "uuid": "85d94c52-6a56-44b3-b1e4-2ef2e273a8b2", "comment": "Malware payload", "value": "b8084ba792224d3acafa281d8543a0ee9dc308de", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172183, "uuid": "a73d2705-3fae-410a-a406-c5f9a11acabe", "comment": "Malware payload", "value": "83cc8c7783b58ae75150ceddebde22abe138be63cae8442496d255993a820dca13304940852f0467d204adfe6fab2ea2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172183, "uuid": "97b0c693-e62d-465b-9986-3b4f39595929", "value": "T183253334AEE33A075ABD54AC3F5C53837BA169070E05D3B752D39C621BAAB211760FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172183, "uuid": "50f0f987-b8f7-4bf4-a168-5c39f38d4f60", "value": "24576:n6ZjFJeVXShWN1cBb1JJgelxdkwcaTPKLGFieK2oZRk:axJuC41cBvJgebQajVi9Xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682172183, "uuid": "8f2b98a3-a9fa-4e6f-92ce-069b37eb8343", "value": 963534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682172183, "uuid": "837b1c46-2b6f-4b97-99bd-b15e352feeb5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172183, "uuid": "e38808b1-a626-4743-b27a-be32c696387f", "value": "GPT4.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396ec84b-e0f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682157935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157935, "uuid": "78bddd3b-8dc2-4c94-bc86-4deff55febca", "comment": "Malware payload (RedLineStealer)", "value": "21b7091e08a580a9bdfb27ec7c8a776d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157935, "uuid": "22d47828-5fb6-4ce5-859d-0634ec6918d3", "comment": "Malware payload (RedLineStealer)", "value": "20cad4d7ac4f62c30f39494be0945563e5327c3f103eea1970887b2ebd9116bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157935, "uuid": "ccee5466-df04-4baa-a537-e63b8f17d713", "comment": "Malware payload (RedLineStealer)", "value": "08f14d5b7d6372307c186dc0f3c87a6b4dbbd719", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157935, "uuid": "60af8749-c9af-42cc-a5d7-54f361b8dbfa", "comment": "Malware payload (RedLineStealer)", "value": "22562efe0edfd5e329bc0181a0b25d2d593f728020ca2fc6029905abdbf937fff0d435a2641d06c5149ef701a8c5c43e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157935, "uuid": "12f3daaf-160a-4a93-b175-d8cb4141e018", "value": "T175C41212BAD85073CCB507B028FB13C30B79BDA65B7092D722D99C8B5C722D1D63A75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157935, "uuid": "749838b1-bb9b-463b-aa69-8d64994881ed", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157935, "uuid": "298831d2-0096-49e4-b44a-3ebfa210fd0e", "value": "12288:Py906srtUFvsOVx9fzxE9JmObJH6/mO8aE5lxk:PyKkvxEPtYwl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682157935, "uuid": "fe64b651-daad-45ef-b703-e2e9d6586466", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682157935, "uuid": "219c160f-3457-4acd-b442-cf981ffd40db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157935, "uuid": "bc7c7144-08e8-4fc5-a16a-06dfcb87acc3", "value": "21b7091e08a580a9bdfb27ec7c8a776d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c704b1f2-e0a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682124672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124672, "uuid": "2218ab7e-ca37-4907-9fe6-731aa77badd7", "comment": "Malware payload (Amadey)", "value": "3227cf9827621d6010cc21b7bb63bfd2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124672, "uuid": "92775a27-4a89-4c84-a647-dd83f52e7437", "comment": "Malware payload (Amadey)", "value": "20da7e9360c16d75af7707cb564fd5533f9bc4170116d77caad04425f375cfdd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124672, "uuid": "a3a2da2b-96fc-46ac-8383-c017db654416", "comment": "Malware payload (Amadey)", "value": "a99da33316dc498de5131f1327879902dab7cc32", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124672, "uuid": "c4fac9f6-b08f-403e-ab66-f4322d66180f", "comment": "Malware payload (Amadey)", "value": "d91354a05cfe495e262f3084241915b4383752dc9c37509edbd35f80a900d839e4d956cf93de15ffad90d20e61ef5acd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124672, "uuid": "fecc4117-87a7-49c2-8bd5-030d4b8e4a5c", "value": "T1B734D05076A2D876E56BC0B45471C5E46E3BBCE29A59869B371C3B5F1C333C18EE2321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124672, "uuid": "e2f67946-5d03-4122-8312-842b1ba1c285", "value": "83f7b03b4e2f4d598c9968669b5cc91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124672, "uuid": "c582044f-1ac2-489e-b473-3965417ecf7d", "value": "3072:pjKXQ61mzDofDKO+Ttpbjgf5u5MRTzMdqx53ZPFhZOrV:l56ozD2KvzRQWSxYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124672, "uuid": "776cccb2-c188-4e09-a763-301bb0318dac", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124672, "uuid": "3b325ea4-4a9a-427c-8602-33c394ba4cd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124672, "uuid": "a3b54231-3bac-40fd-92c0-4cc4c674173f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de981461-e0d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682142321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142321, "uuid": "6efac4d4-a880-4ef1-88c2-9c67d61074ba", "comment": "Malware payload (RedLineStealer)", "value": "a94ca210b267343d468ec7482e717ce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142321, "uuid": "17833bf2-ba39-4780-b3c2-e92049ba0fe7", "comment": "Malware payload (RedLineStealer)", "value": "20f85916f0fcf158a51f426790f7e94e33709a3d87e103f4c817c2ed2c4d8c42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142321, "uuid": "54d3783f-727d-44bc-8048-953d7cdad21b", "comment": "Malware payload (RedLineStealer)", "value": "3a598e0fecec0e7ee9e6528cd0f7fa4c0fde779f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142321, "uuid": "b4a3d0a1-1f0f-422e-9753-db5cc0e62c7b", "comment": "Malware payload (RedLineStealer)", "value": "e2561f550a3928bc4d3d1d9cbb98d3bddd1a1b7351479238a11f2e76af5557c2a5e2219991688054e564e0a2a8863cee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142321, "uuid": "d1059344-b92e-45c4-9ed9-f44859775ef4", "value": "T1D705220377E98132ECFA277054FA16D30A367CD19B6492DF7656A8AD9873AD07831323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142321, "uuid": "9e16f59e-c782-4fcd-9fba-e23a664e1cb0", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142321, "uuid": "538cd98f-9000-455e-9915-70a9ffa34852", "value": "12288:oy90cAcXxIglUB13cZgUJ/QpKMX2DlEfix8BZiD56513QDak0aTTkzen4RNP:oyHAYCzLUJBRRK/io13v2T4K4RJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142321, "uuid": "c9e89963-fc10-4518-8ef2-1525abd9254f", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142321, "uuid": "79b353d8-606f-40b9-967f-dd2ea4ee2120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142321, "uuid": "a66445ee-1d58-4093-b131-7c355cbf097a", "value": "a94ca210b267343d468ec7482e717ce8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e649e1c5-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1682160802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160802, "uuid": "ea7a3a2a-0cbf-4945-ba59-192c38274ccf", "comment": "Malware payload (Nitol)", "value": "5637b80c6dfa6a096df3684c7fcf0309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160802, "uuid": "a385d47c-02a7-466a-b112-bc2453dc563d", "comment": "Malware payload (Nitol)", "value": "2166039dff43718f7ec551e93353c1c439a5299a9afdad6286ea6e3054ae7f0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160802, "uuid": "5e702b5d-dcef-4dc2-9bc8-2800bac14050", "comment": "Malware payload (Nitol)", "value": "bb9feca97658ba25e31677f7844692ef4b9d9e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160802, "uuid": "f80ad64a-f92e-480a-ad12-14e8dc73bbfc", "comment": "Malware payload (Nitol)", "value": "38183353b7e0b12cb5949a9fdaa0ad06546632fc07f4a3c227534ece31f9c99d0438b01d0893d486695a292da6b7356c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160802, "uuid": "b61f56f2-971d-45fc-a684-b15d7ee548e4", "value": "T1E91523423FAA0B48E7BB4FFA55A182127E71FD1195404B25C3E0FA6E3C93BD0B835916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160802, "uuid": "0cffbb4e-5f22-4654-bc49-daff880bb4e5", "value": "608188c7c0bf10f35cb49f7601f1929f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160802, "uuid": "370ab4e5-207f-4195-87fd-0a32cec47af6", "value": "12288:WXwncX7nekNJyECJlBfsyiSLb0b3w99n/3GYECzqFwdFslbDeYFKi8xlzxrC5VBA:WXccFnyBflRb0s99nJADv0Vjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160802, "uuid": "c1039c40-8cf3-4214-99e3-27361642db0e", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160802, "uuid": "ce9d5023-2056-4902-8c1f-8c830b835728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160802, "uuid": "67d9f4d9-ae88-4dff-b3ea-9c3a70b87b6e", "value": "5637b80c6dfa6a096df3684c7fcf0309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6690f0e0-e0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682160158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160158, "uuid": "c4fd0796-d906-41ad-80d5-a2cd27c97ee3", "comment": "Malware payload (RedLineStealer)", "value": "15699240b209a1faa3228f9b461ae717", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160158, "uuid": "91069c72-4d11-4d5b-a6af-e1cc46102f38", "comment": "Malware payload (RedLineStealer)", "value": "25a16cba3bc04adbffc1fe5217ee820b932fb518ff6fddd08ad4e28c331f8b8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160158, "uuid": "114c3040-3554-4d1a-8f4f-be003a099f5e", "comment": "Malware payload (RedLineStealer)", "value": "cafeafd6d31d5ab804e02889f9ba4eb8ca0b638b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160158, "uuid": "ecde9120-8471-4198-9a0c-6fbbf282017c", "comment": "Malware payload (RedLineStealer)", "value": "40eb056833d3328c76114f38b2c0e1449012829b448e31ff89a19143ffd191f0d110e7e9756304ece06e590520f0d400", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160158, "uuid": "b260c815-54fd-49b1-a6b6-3fb0ad316802", "value": "T1D0C41207B6D84232DDB90B711CF622C31B39BCE25B64C2A73256E99F1CA21D4A53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160158, "uuid": "f644865d-d19d-4e50-bb6a-2ed6d39d9e95", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160158, "uuid": "c1128d1e-34aa-4600-b8b8-400571ad8118", "value": "12288:4y9059f0YIbnWBFzSx9EHxE9JbOSoC6/IF8VfB9wI:4yo9fGm1xEPiflXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160158, "uuid": "3f0393d0-fd1c-416b-b738-22116374cc2a", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160158, "uuid": "f9b2d6ff-2dc8-4d2f-ad78-f21e8b8bb649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160158, "uuid": "a026523a-b600-4567-8b25-9ee1e93ebc7c", "value": "15699240b209a1faa3228f9b461ae717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0471e01b-e0ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682126493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126493, "uuid": "2dcf9fa6-6fc8-44b9-870b-11ca42a64acb", "comment": "Malware payload (RemcosRAT)", "value": "dda39f87fcbb3e92a907f3e45fc4bb03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126493, "uuid": "e26ae97e-e859-46c6-b4c1-09a0e6d3d7d8", "comment": "Malware payload (RemcosRAT)", "value": "25ffd09183736426c73f73d36565cc56fd6caa83afe96970ae44e9193d07082d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126493, "uuid": "2d4f23fa-0281-4db1-a68a-679929723966", "comment": "Malware payload (RemcosRAT)", "value": "a584f9949a4e6396e6254d0d24e3b8eaf311397d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126493, "uuid": "f6512430-bc4b-4651-8f08-a92ccfe3c124", "comment": "Malware payload (RemcosRAT)", "value": "cdb3e1822717d5f2ba6c5a3109be345c20c97c46265194522dbfe70a2127027f32c26c487635a86d2e990eb1b934b160", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126493, "uuid": "a7f9cde1-6b9b-41f8-a431-61e014bdb268", "value": "T17825126DB37EEE1AD1AC467AD0D6041103F16646A427E7099CD630CE662FBC24EC1F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126493, "uuid": "4ae449c4-eb16-4926-afd8-5ff58e410a97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126493, "uuid": "6168711b-fc77-4f6f-b0ea-9cbc354988e2", "value": "24576:7MusL8g2DOwmiVzDxFskhhnfwfbUV44oh+N:Wd2DO/ezZzfwfbp4K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682126493, "uuid": "f5099d1b-2b21-4b34-9875-5b9d0ef3ec73", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682126493, "uuid": "e8a6ed54-b70b-4e56-ba64-1aaae36dc074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126493, "uuid": "ec4e9e11-d044-4a11-ab16-cfe05570106b", "value": "dda39f87fcbb3e92a907f3e45fc4bb03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709d2247-e0a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1682124956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124956, "uuid": "2c58b09c-9c05-41de-b680-7bc7c26ad04e", "comment": "Malware payload (TeamBot)", "value": "2507457dc74ba35692289735b816bc33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124956, "uuid": "22fb2749-8283-4883-bb9c-336f04bc85ab", "comment": "Malware payload (TeamBot)", "value": "28182eeef1af984a72678a4c52478d74f67c9729f4b1a4bc33c3068eead62255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124956, "uuid": "a28468b6-1d08-486d-ab52-fa637d936a8d", "comment": "Malware payload (TeamBot)", "value": "fee3651f12fedaf4cd149dbfdd5da55ac773280e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124956, "uuid": "7586eb39-c9a2-417d-a3c2-1ad278790704", "comment": "Malware payload (TeamBot)", "value": "6678cc3a3bab2e6985e88bf7bf595e8ccf7c435e2feb4395e8e6f1f6618510341dba94b7628002e2d32657f3a215a671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124956, "uuid": "4f7a1795-f6d0-4a78-ad87-5529f26e7759", "value": "T117F423417073C8F7DD274076D464D7A5EA2DECE95A4AC7ABB3143A1B2CF238056A3362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124956, "uuid": "2923d0dd-43ae-48c4-93d7-a8e35aa0d4b4", "value": "8cb869f42d9744fa3286b04b1d083ca7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124956, "uuid": "57ad5d97-f118-491b-857a-aac12286de99", "value": "12288:mKCPTMtiFp8UhZYW4Na3UMJMgY2cn/S7FnD/1CmgwOYIlPHcloW9WAPCvQf9/z:mKCPfFpLHAU3UCs/n/S7BD9Cx08P+F93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124956, "uuid": "9af17074-4f7a-45ac-a4ba-b293d8cb6a61", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124956, "uuid": "0acea576-d55f-4054-b733-04c3b2fc10e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124956, "uuid": "26b0bcb0-a811-4f76-af0f-5d860a2a4960", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb55af7c-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137644, "uuid": "1099033e-3f99-49ee-9ad2-3529cb008879", "comment": "Malware payload", "value": "bae88344706c8e870cd1ae8c8f80ac01", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137644, "uuid": "2cb1e89f-3508-4cd4-8300-17c1d4dd11bf", "comment": "Malware payload", "value": "2a0e5f033f28575d48f59a21c7f60520e7149d55da96ecc377e14db29befc24a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137644, "uuid": "fe1d0fd0-2093-47e0-a997-b678529d975a", "comment": "Malware payload", "value": "f66d06a8e475a104bcaa9e544c74b266b42a2b87", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137644, "uuid": "99a67ffe-3308-4aba-a624-072eb05af009", "comment": "Malware payload", "value": "6d615c3651d1d1d8c48033ed1d88e7e1d39c38abab2e70ad023e1b30e358ea5d53e0ba4287d9bf52dbf21b89a34c92af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137644, "uuid": "fe063c38-4e33-4341-8207-d471acf29415", "value": "T190A34A01B6029078FAF700FEDAEA9A1A4638767567A800D77FE912999FD1BF13C31507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137644, "uuid": "6395765c-4508-47eb-8058-f480e32754aa", "value": "3f5bb09e0b89ea194dabd8ec2b778bf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137644, "uuid": "b3f02a09-cab6-4cb3-b978-7d64f5eb9f77", "value": "3072:ACLsZSFMEPCl5ikSF+GbTib1iecberx5i12i1h:ADEPCl55E+GbTib1iecbertU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137644, "uuid": "1a9fedc5-b204-468b-a95d-7d592fdae1ed", "value": 107296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137644, "uuid": "18e3a2d9-30c3-4bc2-b4f3-7e231adb7b5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137644, "uuid": "eb2631c0-2e8b-4523-884f-c4f6645f550b", "value": "SecuriteInfo.com.Program.Unwanted.4695.27582.28104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04562240-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137659, "uuid": "6cbfb762-a7c8-46fd-a3d2-a84c77189828", "comment": "Malware payload", "value": "84f43d7dc83d4714d800f7def1ea3b6c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137659, "uuid": "77c0f3d3-4ab0-4b7a-88ea-34b28cc3c6b0", "comment": "Malware payload", "value": "2a5b1db800fbe7b102667f536a560d5f51cf194095ed833517b0379cdbb849ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137659, "uuid": "d8c50293-b6a2-492b-bae7-9ff8fc84bee4", "comment": "Malware payload", "value": "38d01b21e604ccf347e913f178de755f74499aed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137659, "uuid": "edd703da-bb8a-4881-bd83-211bf66dfea1", "comment": "Malware payload", "value": "08374f72b65358de25d178fe4849915f6e27b98756407eaea40b12ac265741ae18b83e65bab53b903553d52df02df52d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137659, "uuid": "29485ad8-fa22-4a54-85b9-855e232bb197", "value": "T1D4820ADA0ED97177FE836D716BD9D25ADD32F3D0EAD288AF206582811EC07A1375402D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137659, "uuid": "ae3f591d-7c66-4940-9602-35ea10a178d3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137659, "uuid": "1e287149-5c0e-4b53-bfde-5fa36c238fed", "value": "384:zipxl8UUv7alG9CyJjnYPLaiSKnc9iSKCGiaE:zipxlhU+GBJjxi1wi1CGiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137659, "uuid": "72ddfd47-45cb-420c-a616-a727f8fe2516", "value": 18720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137659, "uuid": "b2de87c9-76e0-406c-9016-bc2ad3a8faa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137659, "uuid": "97657ba3-c57b-4be5-8015-41c9d3badb55", "value": "SecuriteInfo.com.Program.Unwanted.4695.2303.5566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de88429e-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135449, "uuid": "5b804ddd-0efb-478e-97da-f2088dc0b2f9", "comment": "Malware payload", "value": "d600d6c7d26ddb9f4aa0f0474aba5cc4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135449, "uuid": "3244694d-1e79-45b7-9fb1-0339f3eee64e", "comment": "Malware payload", "value": "2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135449, "uuid": "578baaa2-1315-4e55-bfca-bc8cb9b25ef6", "comment": "Malware payload", "value": "a0944d3cef8e03dcb71025c1ab5b6c6bfb638789", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135449, "uuid": "4ff2c927-9f79-4037-8e05-a05dc62a86ff", "comment": "Malware payload", "value": "19ee04eb4c97d7902ed8eb33d955c6c59e2b1a17310c8761a1abf672f8fefc353bec9010d82bd6fe4afb69d3750816db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135449, "uuid": "aab2ed70-e622-4d93-b060-dbc4dfb926e8", "value": "T1C8947C0271F08572E9A219386CB16AB6436DFC741F60C6C77788F5AFAD712C19632397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135449, "uuid": "8161e351-cb6b-44ec-80a0-d52591d0bd36", "value": "12288:iKPmrLeovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135449, "uuid": "ff541853-98ee-45cd-ba5c-c9a23a852610", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135449, "uuid": "1c518ee9-6f5b-4950-9fad-877547fe1f0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135449, "uuid": "2f4335b7-c12c-4891-9f7e-a9f56b58292f", "value": "2023-04-21_d600d6c7d26ddb9f4aa0f0474aba5cc4_locky", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c305c1-e0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682160148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160148, "uuid": "4b4aa993-adc6-4487-8887-4d62926a3580", "comment": "Malware payload (RedLineStealer)", "value": "9efb3ec9a1e8ad2042ecc523d1d4d2e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160148, "uuid": "b90c2a65-961f-4fdb-b7a9-64cd21ab7b2f", "comment": "Malware payload (RedLineStealer)", "value": "2ab46b3855ce10086d2cf135a2e4b11057050a6e5ebbebba124ec5ea5c6a7d4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160148, "uuid": "ffa69674-22f2-4c87-bf4b-47ef05e81e39", "comment": "Malware payload (RedLineStealer)", "value": "b3bd4e668174d3006beb321bc30c09735544528d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160148, "uuid": "bca3268d-98a4-4e35-8607-fa538a1b94e8", "comment": "Malware payload (RedLineStealer)", "value": "4a29072dd52fa2836c56e1df360b70927aa797ebfce00bd3ecfa9f4133367099f0bdf757aaa4b8d416bbf89bbcc9d192", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160148, "uuid": "cc2d91ac-10c3-4cee-a8a7-153539e4e449", "value": "T19EF42323A1E96033D8F917B168F552C32735FDA14F79C7A325D998AE18F36C4A43132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160148, "uuid": "c736ab13-07af-4da4-9e6d-a65c4214c5c6", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160148, "uuid": "f9eb39d6-4ac2-4f86-8009-a2894b29a0dd", "value": "12288:9y90bHOnptKMKcI9tNdmjVIlKLZfIYK/+cOFi6h/cR8VxpJJYE:9yzfK0QmxIl4ZHtzbpHYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160148, "uuid": "6ee899bc-a7c2-4765-87da-b17a0d5fbfc7", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160148, "uuid": "5a56dfc3-8a2f-4f0d-b11f-9db3a8d0d560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160148, "uuid": "3612475c-a2f9-4854-ba6e-cbbcbc4f3ec6", "value": "9efb3ec9a1e8ad2042ecc523d1d4d2e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4398e6-e0de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682148326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148326, "uuid": "f626dbc3-5ead-4c5e-92bd-bef9d5a1540b", "comment": "Malware payload (Amadey)", "value": "0d709ef4b9a300dd725f16b275b42b2e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148326, "uuid": "d49725af-f427-4316-b865-f767d05db354", "comment": "Malware payload (Amadey)", "value": "2b46fc922a0e16552f09f9b2d1a9cbedfada367fa985e2c0a15b815acc03f806", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148326, "uuid": "adcd260e-3440-4dff-b794-48080afed518", "comment": "Malware payload (Amadey)", "value": "2cee1020015fdb5ec7c0197d98de0396f8f7c390", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148326, "uuid": "e8417191-4879-48de-bbe0-4be60ea99bb5", "comment": "Malware payload (Amadey)", "value": "5d164675f44f93706676cebc163261227f504048aa11b228373dad13361fbe6f445af62243934c66ad7d5a730f0a5342", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148326, "uuid": "6f4bb517-ef82-4414-adbf-0132dc575087", "value": "T13235231397DA8032ECF92BB1ADFB068706317C14EEB143AB2296A4D95D722C19734777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148326, "uuid": "62dc4a29-3cc4-4c4d-87e9-50db3a93fa7b", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148326, "uuid": "4701b659-5cee-4253-845b-afc3bad14894", "value": "24576:YykNL4sGvVLMc6pCyizFPdhVxYNy6CddvMkR/6cw:fmgtLMcCizFPdhi0dMkRCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682148326, "uuid": "68ab1c4d-41b1-4dd8-ab3e-565587ca2660", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682148326, "uuid": "eab16a8a-4491-4b5f-a20b-8e38874b6596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148326, "uuid": "2cb8ff0f-2b0e-48bb-8304-394236949d1d", "value": "0d709ef4b9a300dd725f16b275b42b2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0059c63a-e100-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1682162564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162564, "uuid": "dd42c73b-2545-4ee1-9565-a1e2c3706d93", "comment": "Malware payload (njrat)", "value": "d06cbd729fb7485052ddb9e29e475957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162564, "uuid": "256bd639-91e0-44aa-83d0-71438a7c9113", "comment": "Malware payload (njrat)", "value": "2bb3f25ddf4d90260ea675287688c0d502d31958ee587d120fc1970f5705aeba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162564, "uuid": "aceb23d2-c91c-40e6-8417-fa89550edbeb", "comment": "Malware payload (njrat)", "value": "63cd17105b48cd1f0c85a01bbd4fe319436270e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162564, "uuid": "92842e1d-4e62-41ca-9f7b-77070e1abb21", "comment": "Malware payload (njrat)", "value": "183012831bc895e2025c2787f4f0df58274914c320cb3d8d4ac9b0ab3b6e42e6d32661f5eba8e00d03ce847134bab52d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162564, "uuid": "50aef895-0038-4ff5-a6f0-5e91f84d3e8f", "value": "T1CAB3BE6712EE7CE2E5780A707B3343C0C32CDE046A03E22E58E43565D9BE69779827D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162564, "uuid": "40cdef5b-5090-452f-91cd-358c9db53b3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162564, "uuid": "4ef226a7-7fe4-4c6d-885b-a370277e21f2", "value": "3072:b7grvwc2RKW4omGSQyghNw9bOC0UBmoe:Pcv2RPhSQyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682162564, "uuid": "d9bd84e8-ff15-46c5-8280-de0001120818", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682162564, "uuid": "2de649de-0e0f-4037-9dac-542653408b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162564, "uuid": "ec566dfd-21f2-40ee-899c-45e59178d1bd", "value": "5555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088e8f2b-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137667, "uuid": "13f6c8b0-990b-4d20-bd73-e4896f59528b", "comment": "Malware payload", "value": "5dd0852c10ac2d07f8322df512fe23e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137667, "uuid": "fec59139-b852-409e-b53d-70841071ac8c", "comment": "Malware payload", "value": "2cb8da2f65212fdbfe5085d84f4689494d40ed58c77150fb8dfd0a5d92616dbd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137667, "uuid": "bf2c011e-ec7f-41be-94de-c264e58a8b70", "comment": "Malware payload", "value": "6201fe85b85a141a89cf19bdc9fe889522a0a91a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137667, "uuid": "271b79da-2afe-4141-be33-221ed7012353", "comment": "Malware payload", "value": "48aff47e059b22c716de425e8d7e2a259ba0db7415d048d3e083a0c4091816a4d710aedefee64f1eff43acfd47acc68f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137667, "uuid": "715c36bb-0c58-4206-a45a-492bbe05659c", "value": "T12DF3E7D232296034EA2DC57BC7E706742371B7516A11CF42328E5772DF9128A9B8B37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137667, "uuid": "d1bb9735-b744-4f76-9959-b51a18618d9b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137667, "uuid": "533a215f-fa23-4420-bdf0-e2a404290722", "value": "3072:SZadMZC3fkpOTItC3MhmLwF62I5IfO9cjSBgn2FUraJYv+NMzCRw3mVE7KZo/ud8:SZadMZC3fkpOTItC3MhmLwF6n5IfO9cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137667, "uuid": "0f8d25d0-04d4-4159-aad3-dab7310b4bd6", "value": 167200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137667, "uuid": "2cd623b8-74f1-4169-b570-acb716d756d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137667, "uuid": "edc97f8a-a207-4200-96cc-f41519bcc5ad", "value": "SecuriteInfo.com.Program.Unwanted.4695.18668.26946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9550b1a-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137641, "uuid": "a38d6724-8337-40e6-9623-ae8c8de1f228", "comment": "Malware payload", "value": "5c2a3df3a1b406000de15bfbb3113d51", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137641, "uuid": "59cbff16-b9e3-49af-bc67-85787949d968", "comment": "Malware payload", "value": "2d41dc30f71d4cebcb0bfbeae163c2a23d97f5401013362f255ed9e94ae9c564", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137641, "uuid": "90878077-90e4-416c-a622-7f2af40b270f", "comment": "Malware payload", "value": "de5b17dbcc6b80565233f880f0439a12c88d7814", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137641, "uuid": "430210e4-b4f9-4d61-a28d-65704bab1217", "comment": "Malware payload", "value": "64eb36cf41b3fdb6d5bdcced25c61b8624fda8569410ff5a15cc9d106e5afd2fb2c9754277b8104282d1c70bd9ff80f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137641, "uuid": "5e6fba0d-f0db-44d9-afce-83b828511d78", "value": "T1A753EB1576DC303AF96179B2AFCDF6ADEB25A2D48343897E30AE714327819457723138", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137641, "uuid": "9777128e-a0cd-4840-91f8-b6bbf2134b36", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137641, "uuid": "95d90399-6efb-4460-94c2-2d3b6f9a3afd", "value": "768:gydYubWjazi4j1ep5vynq8RU/N+DSKcM0S7sSxvHoyGS6YKKxOe/dBF5cLWuhIpp:gsL74SeyWUHiSOi19xi14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137641, "uuid": "faa16ed0-f18d-4678-99ad-16787bbe5c27", "value": 60704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137641, "uuid": "1816bbb7-219d-4a12-8af4-b8b098a4d4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137641, "uuid": "ad90b629-5482-4324-ba98-f937f88a7bab", "value": "SecuriteInfo.com.Program.Unwanted.4695.15214.665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afef93bf-e0a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1682124633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124633, "uuid": "1fabe9e3-d639-48dd-af7f-19d0c0f0cb77", "comment": "Malware payload (Stop)", "value": "dc765cddb28f5325c4e9412f8cc6ade6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124633, "uuid": "3fbfed6f-f37b-4a6f-bea3-35b506195c37", "comment": "Malware payload (Stop)", "value": "2d9d77331ace2f16271408e2a93b20aeefa2c796e44b371863335d0f834af6fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124633, "uuid": "830e0248-8997-4b25-86c4-20be7d5f569c", "comment": "Malware payload (Stop)", "value": "8735a08061b5f1aa458b54d28a0daee9604bbdd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124633, "uuid": "48945466-3e6d-4fd7-8a99-bca59ef171c7", "comment": "Malware payload (Stop)", "value": "2a94ec5f24692854e981b9e9fd2a3f2498e6acec4a2f6d2c6068403de7c9c4bd534f5f2f98dd0ae46a435f3ae71d6e99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124633, "uuid": "f96c2a07-017c-4221-a7bd-73980a2cdb0c", "value": "T1B4F42350BAE18C33D6B735B49423E6AE592B7C76CA95C2DF210C364F2D613C09F66352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124633, "uuid": "04e66f64-07f0-4a71-9030-057453bffafa", "value": "83f7b03b4e2f4d598c9968669b5cc91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124633, "uuid": "7c1c90e1-f212-4348-933c-2ca02c84037e", "value": "12288:chpzw5WtzLCSWARhMEWIpfbCZTVma8P0t1IVPiv9r9gjfeqrlKr:chgsVtRhUIpfb4TVmajtoK1r9SlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124633, "uuid": "3c6b5339-233a-4d5c-b48f-db66e58e2cc8", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124633, "uuid": "18ba8cca-8ba8-4dbd-84ef-721d76014b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124633, "uuid": "bf08428f-7326-40e3-aa7d-550aaf10f9d7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84e3aed-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135438, "uuid": "26dbd472-6ad1-44ca-987e-6c20f9c1f53c", "comment": "Malware payload", "value": "f8bca5d0de5f50c6abc8ee7274e4507e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135438, "uuid": "a2d4ce9c-2d64-4158-944e-213362ca9b60", "comment": "Malware payload", "value": "2e0b2c69cb0c57a8c2dc9ec44e4ecf2afd19c494980d3b3800c67bf768b38bd5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135438, "uuid": "e0fda19a-8b7d-4b69-8c89-4a38f9b9230a", "comment": "Malware payload", "value": "d753d5382adadf2f5fb7cd8b8d8f97ff1f7f1afe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135438, "uuid": "72e89d2e-9a00-4269-8cd1-a29a0fe6b8bf", "comment": "Malware payload", "value": "a01221d35085c2e4f8974d015442a34e65a95c5f12b2f1880b439941b28d8ba8d8f67f9a4fbc0752f7dfa2ff9f7dfb58", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135438, "uuid": "a9aa0300-d092-4b89-b1b1-36cfe886008c", "value": "T151845A39F680D537D43159BC8E0FE2E5A569F2302D351957B6E51F4C88F9283AE2BA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135438, "uuid": "1605cebd-f1b3-4032-ae0c-213f5d115894", "value": "70ecac21951390289e31a1a3b129c186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135438, "uuid": "98e79df8-6aaa-4f05-899a-db577c6c6270", "value": "6144:u/6XWr0/M0OTrgZEBCjXm2Zpair5vpofIP2NFFL+In:PXWr6MmyBI22Zp11vpo4aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135438, "uuid": "c4a9f339-ef52-48dd-96c4-a1f57815f259", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135438, "uuid": "a9d86e11-8352-44e7-935b-4608a8742954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135438, "uuid": "bdd82f9b-0f05-4a09-b04d-a04880985c25", "value": "2023-04-20_f8bca5d0de5f50c6abc8ee7274e4507e_kovter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0750f76-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1682160685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160685, "uuid": "b2d61d44-4c89-4208-8a47-0fdaaf90054a", "comment": "Malware payload (Formbook)", "value": "611fdc57ef0e2874f14eb885ed7c759a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160685, "uuid": "ba840bdd-7a17-4858-a802-9af91bfddce7", "comment": "Malware payload (Formbook)", "value": "2ef75197721efedf4bb9e71f77cf6feab3029ec28035016c91d6734b9c1effdf", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160685, "uuid": "906cfec4-6236-4076-9dae-981bd6938f83", "comment": "Malware payload (Formbook)", "value": "7f359e7d8d1ce1c3f8d85fc46aec06eb54e4c218", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160685, "uuid": "f0dba3ac-6c15-496d-aa2f-6a51754c94e9", "comment": "Malware payload (Formbook)", "value": "39672ca5d0a9f6907e092bc7329a26955f3a5f1c7879c8a89ffc48c282f8ced1bc0aeccd6f66228ce1f42a5ccf165d83", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160685, "uuid": "e71e1b45-7b83-432e-8f7a-b6e7adbe50a2", "value": "T17A84D04884F988E9C179C4B30CA5F99DB2537C099C214E564E53F9ADE8332C22A77E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160685, "uuid": "e61db0d6-756b-4b3c-89b2-7e6c2c4f0636", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160685, "uuid": "e31019ab-a1ba-423f-831d-53054c1423cb", "value": "6144:sYa6w8Ih9PsfRGzU5UPzQqlS87sZ8ON7EUPR/Yqzg68YTHL8IY0:sYC8Stucg+PzQGs3vLFrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160685, "uuid": "339e03f5-98aa-4695-a20f-e6ef320c3da4", "value": 390173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160685, "uuid": "a7989cd9-6d7e-4b8e-b209-c86fcf91f3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160685, "uuid": "bacb0bc7-fe9d-487b-aa11-9ea48101bbb4", "value": "DHL Notification_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfa0504-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135448, "uuid": "8f37d35b-7a10-4271-b6f5-ffdc1cfbc2aa", "comment": "Malware payload", "value": "d2aca9c2e8c21e607b4dfd8b2fe46d67", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135448, "uuid": "1ff52371-9819-4d20-b407-a840348ad2b7", "comment": "Malware payload", "value": "33822d87e0c398e90deea5a4a3ad0fa04beab1888d61f1d21c6b6b6839ae4bac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135448, "uuid": "1e9f60ee-2b00-43e3-9bc3-35083e533096", "comment": "Malware payload", "value": "b0ebc27761ab0e6ec6a96d0c470601fa76f96ee1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135448, "uuid": "e4063bc4-22ba-49d9-8478-902d78dffbe7", "comment": "Malware payload", "value": "1188a06afad12f8d247d56cb98de7b869c4993314ac99d4123ba989ceb9846f30f25724a91bad57a614494211d645a68", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135448, "uuid": "f5430936-7661-4f9f-909d-de4fbcbc0934", "value": "T129C49E026612D477D4A708716B6CEB66A4B95D304B6D81CBBF80EEB50A39FD2327C347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135448, "uuid": "018f1289-90bd-44ca-9685-19873554bebb", "value": "3072:IP36YQgDABWbDFp7yz5RwXZwnt+XOCGNjYQohYmUZi+ZhJMLx8sze3xy+TRpAO:sZqTntxVYQ5mUXhJMLx8sK3xyoXAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135448, "uuid": "6202069e-e370-4a2c-8513-5bbcc7e725da", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135448, "uuid": "af158d05-080c-405a-a325-37ebce3fb6ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135448, "uuid": "0477db5e-9122-4ee7-93fc-279b4c880be0", "value": "2023-04-21_d2aca9c2e8c21e607b4dfd8b2fe46d67_teslacrypt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c285ad-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137687, "uuid": "f9a70ba1-4345-462d-8f86-28d555e20b52", "comment": "Malware payload", "value": "a01cf3fbeba07fe6ecc2aa8f5beaf3d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137687, "uuid": "8fec458e-f05d-488e-acba-32685697a777", "comment": "Malware payload", "value": "358bd6f95163e7fbfc8a405e308b0acd3ab583aae2531afcda17ce02e357a666", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137687, "uuid": "82210f4d-86ea-4926-8fce-de0aa50796af", "comment": "Malware payload", "value": "9e4a3eb05d69dd20d8974732148f2bba30458640", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137687, "uuid": "92ce24d2-4d24-497e-bf78-ede6cdd6a7ab", "comment": "Malware payload", "value": "d029f0d51cdca3cd08677c6bd69d7a2950436b0ca16685435cffe13977fa7ff20be54eb6aa743ae4e3fe32e86ca8e620", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137687, "uuid": "5f0ce5e5-9422-4428-b52b-62155fb39efc", "value": "T11F754A01B691C024F9FF16FA157EB278983D39E11F6484DB33C127EE5968AE45C31A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137687, "uuid": "8bfed740-3772-445e-83b3-4d8cc2d8dbe2", "value": "cd42ec775c91efd2367fa09fef65a372", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137687, "uuid": "08c34c92-88be-47d6-b772-4e7ee7843a83", "value": "24576:HoYsYW6Fixna2BNy4ra7hsXZPa1P0i6Q6335lL3BhdJXmNZqByzYZ4C:YYWxla5P0i6DHXLv7Z4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137687, "uuid": "6e602c0f-bdc4-4548-bd0e-21438c1a5655", "value": 1658656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137687, "uuid": "5d083332-238f-46d0-8d0d-b8dc2c45b66d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137687, "uuid": "b9939ffb-5158-478d-b1dc-8d958bb38a2a", "value": "SecuriteInfo.com.Program.Unwanted.4695.17675.8464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e52eb18-e142-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682190934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682190934, "uuid": "2f8e3a3c-d194-4f2d-8abd-a009dedb9458", "comment": "Malware payload (RedLineStealer)", "value": "fd0c43c6c094839728be3b5230d3c1c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682190934, "uuid": "72bf37e6-48c7-4a38-9aa4-3d70d91cf0e6", "comment": "Malware payload (RedLineStealer)", "value": "360063a59194421f8f20ad26d2788ab18160c30a822b880314b5035a76e0d4d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682190934, "uuid": "fdeaa33a-ebb4-4514-9256-99662329595e", "comment": "Malware payload (RedLineStealer)", "value": "c0b5cfffbe30fa825371c10d77e2e100aa704a93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682190934, "uuid": "429af429-1fc4-483c-bd8b-8e8409fe45c0", "comment": "Malware payload (RedLineStealer)", "value": "b45003b4a13bb813a869dd41d632edd4b3d40471cb99c01447560c397159f9d5cf03c4751f7e19fbcb6bf0cbf4d4cd31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682190934, "uuid": "b5874c90-0088-4ff8-93c5-f49d4b00be81", "value": "T195352316A7D46062DAF407F21AF926431B623CEB5F3843D72B99A94D08B35D4B13273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682190934, "uuid": "75b8e300-304b-420d-8a14-2ac575f18ed6", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682190934, "uuid": "92bd866c-6813-450c-b9f6-8ab091583a35", "value": "24576:sycddRQu864ijH3b7w6I25IyaatFFBT8LsuAbjZ8QNmix/W:bcdRf864ijXA6IByNSAhyix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682190934, "uuid": "bb4e9d63-fa22-468a-9c35-090ec86c0a5d", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682190934, "uuid": "17e6dbcc-582e-4a02-9a6e-f2e26cf90603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682190934, "uuid": "bde23cc2-a8d9-437c-83f4-ed2983c25564", "value": "fd0c43c6c094839728be3b5230d3c1c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381d2ee3-e0f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682157933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157933, "uuid": "34b9b506-9e39-4396-9793-5c2fc0b3b498", "comment": "Malware payload (Amadey)", "value": "2b2c6d2857d5442e1d38a724c05d17fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157933, "uuid": "9e1c1a63-a322-48cd-bb4c-959a8552dba3", "comment": "Malware payload (Amadey)", "value": "36108347fe6895016fba031c06791828e168f88c3199e683710874bd05173987", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157933, "uuid": "5bd34654-538b-4ad3-bee0-cf73e8b7ab3c", "comment": "Malware payload (Amadey)", "value": "99ae73718cb56d9dbc6bf61773ae3994cce55d58", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157933, "uuid": "78a9a5d7-c0cf-4c69-8ede-93f02295e052", "comment": "Malware payload (Amadey)", "value": "b8b891da76b5e735d3689a50d3fa2c5d6ecf403044586d8defd0cf1c383fd13349d3947ab414259bb50f8a2a1826094f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157933, "uuid": "3ffa45a0-e450-4562-a2b1-1e8ad2b7187e", "value": "T1BC052307BAD89036DDF513B016F512832E777DA147B5C7BB27049C9A6C72290A6323BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157933, "uuid": "3f3f0df9-d9b3-4799-be22-a57912bd7d3a", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157933, "uuid": "3eaafd01-4eb2-4151-b2c4-7fd75af415a0", "value": "24576:myeFxsRdrM54UNouOIKS3W91gvuR1ckxA2cZEC:1qQqGUNomKS3W9pYk+2cZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682157933, "uuid": "aca69f43-d738-4088-9910-43475f3419d4", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682157933, "uuid": "aca9e210-6d1f-42ba-8f84-245c2eeec7ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157933, "uuid": "4e583428-99f7-4d60-a988-063ea809b2b6", "value": "2b2c6d2857d5442e1d38a724c05d17fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4f93da-e0a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682124303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124303, "uuid": "419c7950-0017-46ba-96b2-ed27e264e48c", "comment": "Malware payload", "value": "39b70dd3e44ee8f8e2afaa127883de02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124303, "uuid": "7f302d3d-bc58-472b-85c6-ab3497fb33c7", "comment": "Malware payload", "value": "36534145797ac78972987952f9e210532aae1c66b3fe0bca48a769ed8e7739ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124303, "uuid": "7b9b4a83-3e55-4808-86a6-afc4c5b9997e", "comment": "Malware payload", "value": "27aeb37b097321b2840f5c96defbfb765c18ffbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124303, "uuid": "db1c45dc-24bb-4ed5-a0ae-6f1a6f9697c4", "comment": "Malware payload", "value": "7e2dbba9e50e507297cccbf3728b7dcf32c624fe808ca6aec7d2d64c233f70a596277fd1b368911ca7f2a67585361921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124303, "uuid": "7c32773d-83f5-4bee-bd98-f0a057de6479", "value": "T16574BE21A284C07DF87BE9359CFAC635627C39741B9F51C3B3D8162E8A612F2797610E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124303, "uuid": "f5b74b8e-122a-4714-b613-75a5cf5a64c6", "value": "6a6337ce6b49dbd232588f00332200e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124303, "uuid": "d027cc0a-1052-4602-88fe-051967aee64f", "value": "6144:+LvyKqZVicRk8q9rWmj9ZYfNqBYLoywEJK+XI7/ib49LZy9:MKKqZcnWmjcfMBifwZjiiLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124303, "uuid": "d272652a-bdbe-4768-a6b3-e85847d6e30d", "value": 340128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124303, "uuid": "75bf7ed0-a6a6-41dd-b94e-8892a1d2d1f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124303, "uuid": "f3044bfb-a5ab-4c36-b3bd-8f4a9660c719", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c451fc1e-e0ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682141417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141417, "uuid": "4afdb575-f1ce-4cd8-8009-969272ab1ba4", "comment": "Malware payload (RedLineStealer)", "value": "537ff95d2fef0607b1a9ea1722d5ad5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141417, "uuid": "5b138491-0f4f-4a34-906b-93cd234efa44", "comment": "Malware payload (RedLineStealer)", "value": "3acb0a322fd8facc64222e1a774f2152bd3c8568e53410a60a52e0aa14d3f805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141417, "uuid": "2adc61e4-8788-47b8-895c-b46751b43569", "comment": "Malware payload (RedLineStealer)", "value": "93da780a907053b05b33832fb290e9253fa78b4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141417, "uuid": "74d38ab9-cb21-44b2-b078-cd119e067d65", "comment": "Malware payload (RedLineStealer)", "value": "0a908c98d396270c004b2d18aa5452b06492e2e05f3c9317dc36948b26a29263d6eb9d91c7758d4f46dddebc103a9648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141417, "uuid": "be184fb7-bb65-4383-98d8-a508eb1633d6", "value": "T15D052312ABE84272DCF917F019F452871735BCA2AF6092DF2655AA4F1C716C0E73272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141417, "uuid": "b242ad35-afb0-4e3f-a1fd-5778cf552c72", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141417, "uuid": "4e68e58e-0296-4470-aea1-9374b839853f", "value": "24576:Oy5kn4dZutB9G0JRKsacSNlz1CbcOVzZJCKMO:dxmn9/WNlzeVKKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141417, "uuid": "94f43fad-4f4c-4feb-a7f5-32d44affbbe4", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141417, "uuid": "873b71ff-12e2-4317-b3e5-78a79614b08f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141417, "uuid": "9918c954-1d97-403c-bd67-b5d1b92ac40e", "value": "537ff95d2fef0607b1a9ea1722d5ad5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72f1da2-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135436, "uuid": "a838a89a-d2be-43f1-aae0-3848f6f718cb", "comment": "Malware payload", "value": "a8bdd3f5d4e14cc9dc029630df8e0458", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135436, "uuid": "193b3f14-d41e-4c3a-8c45-b3487bcc4251", "comment": "Malware payload", "value": "3b0c95d97843299822c4bca2d1a38116c3f9b89b0a4a0541d7c0b1da10ff18d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135436, "uuid": "0c5374d6-2ca4-4de7-a60e-640219afa146", "comment": "Malware payload", "value": "77061bc9ec70e76b9ce16141f0072eed13a5b0b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135436, "uuid": "52f14c1a-48cc-48cf-b75a-2a2e0e0b8ae8", "comment": "Malware payload", "value": "6f9917ac8b036c1935ac92c9c03c7c88a4b5bba163e9cb04daedad63712b593c48b4d2ea89cb1a91204f6273af4b53c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135436, "uuid": "579ba7f7-3ed5-47dc-aa72-710a317502ff", "value": "T178042C14D050C7BAE0A244F9C7E90DBDB8364D50234519C7B3C23E79AB91DE5AB31BEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135436, "uuid": "7725d91a-8f2c-42e1-9103-929908d3683b", "value": "3072:D6il7jPiQ4nId7Dr4wnEch1mfcGIR8oL2AA5NWCdxN2UnPF1ELW5550:DhiVKDr4wE4MfcunAA5NWCdxN2UPF1E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135436, "uuid": "a6949082-9e5d-4047-a409-f866a3088e0c", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135436, "uuid": "65e5454f-7947-4292-b0e0-56d665a15cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135436, "uuid": "86cf39cd-5a11-4d41-8d06-806cb75af984", "value": "2023-04-20_a8bdd3f5d4e14cc9dc029630df8e0458_cryptowall", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa42658-e168-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682207436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682207436, "uuid": "359b509a-6dd6-48cd-8a05-962a09822292", "comment": "Malware payload (njrat)", "value": "cfcee11e3100662568f6dc68a1058a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682207436, "uuid": "709771d3-5e36-4002-8fdb-26bb12d4bc33", "comment": "Malware payload (njrat)", "value": "3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682207436, "uuid": "28fad05e-71a6-42bf-96f4-5cb2b6fc26d4", "comment": "Malware payload (njrat)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682207436, "uuid": "d242ac2c-c9e0-487d-922e-35e63da741d7", "comment": "Malware payload (njrat)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682207436, "uuid": "ef815b3b-8939-4880-8db0-726ef3389b17", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682207436, "uuid": "25b15ff0-faa5-458c-8776-6de0bdb03a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682207436, "uuid": "6e514ca2-1b94-4124-8891-1d7b81b1fd91", "value": "cfcee11e3100662568f6dc68a1058a7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db239ea8-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135443, "uuid": "acb27a1b-7655-4b72-b6ec-f8e7b43d8ce1", "comment": "Malware payload", "value": "66ec0f1426042dfc88bd922956428c9e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135443, "uuid": "55d675f6-9e7d-46b9-af54-2b9b758a6716", "comment": "Malware payload", "value": "3f7458e658401c15b675db78a2e9871ca3eeff3c6e299c4545515e56b66466df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135443, "uuid": "541165e0-7c02-4739-a628-80872f95e971", "comment": "Malware payload", "value": "1524ceb090b9b40273a38cee2e3566d2e9631ce8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135443, "uuid": "2def35ff-c51b-4b7d-89ee-114f3f14adb1", "comment": "Malware payload", "value": "65636a90e826aea6c80b0da65b1b168921451d890b58daca87859f3f51b33c8da73f8eb8bba79c827ebfa39baacc8664", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135443, "uuid": "2de2edf8-c4e9-4266-ab34-410e5d3cb084", "value": "T19B742835F240D677C4265CFCDC0FD2E96569F2302E38294BBAE54F0C98B55936A2BA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135443, "uuid": "f0f649ba-515d-4a21-b9b2-22305660ee99", "value": "6144:DSoywCFI00FkyFQkjmkeOcbhdO0OR3rROCdP/gTfEb/hurQhq+17:DSoFCm5NDGdoRfifEbYrrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135443, "uuid": "0cfaeb60-8e81-47df-b81a-95dc31a1214e", "value": 337452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135443, "uuid": "6b31b4d0-a434-4755-bccf-aa0d7aade477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135443, "uuid": "e56e69f7-6c35-4ace-9028-25ff3dd96026", "value": "2023-04-21_66ec0f1426042dfc88bd922956428c9e_kovter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d8e4d4-e0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682157072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157072, "uuid": "79c752df-20c2-44d6-83c8-ebea291be2df", "comment": "Malware payload (RedLineStealer)", "value": "85029323b57eff7f1d0ea0d4b4161275", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157072, "uuid": "c983e2ee-316f-4473-8951-9af996e2a6b1", "comment": "Malware payload (RedLineStealer)", "value": "3fc813bc68fb6063fadae3f02b625777db2282a89a66969168b15a1a20e25394", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157072, "uuid": "649f1157-99ee-4b80-8831-639d2e8a6e30", "comment": "Malware payload (RedLineStealer)", "value": "c2d2ca021b579370e03b677f991bac4d43d867a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157072, "uuid": "91388332-fa8d-4aa0-b132-640417f41cf7", "comment": "Malware payload (RedLineStealer)", "value": "b97439e0f653c7586f8167c9331b52538f73910202da08501fe7a6407f1e94b9aa8393c5a4faa8a2d3374e14e78d0c7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157072, "uuid": "1d734587-0e3c-415a-9dac-72c7f197c800", "value": "T1EAC41203B6E91073DCB517B008FA16C31B36BCA1AB34979722A6AD9E4C726C4E535377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157072, "uuid": "65e5f8e7-05f5-4c14-badc-61de0cc80ce0", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157072, "uuid": "c2d14006-58fb-4f82-9f9c-ee75dfa178af", "value": "12288:3y90eEHkSMQw/t7O8eCw/xE9JKOfZb6/3D8n6moAP2I/a:3y/EHkSHw/tvwZEPBk7AuIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682157072, "uuid": "94ab2eee-3b84-47c7-ac7a-e9c0f1252cb1", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682157072, "uuid": "4b01a9b0-77c4-4ebe-9c48-501c802eee4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157072, "uuid": "191242d7-5818-44c5-bde5-a2555f456207", "value": "85029323b57eff7f1d0ea0d4b4161275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe33f06-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137706, "uuid": "78ed2722-6661-49ac-9c43-738d8ba299d9", "comment": "Malware payload", "value": "9ce992200196bef2f63bcf1bc5cbf347", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137706, "uuid": "95cf9f8f-8a8f-4641-a927-527d08631ca2", "comment": "Malware payload", "value": "3fe8d9bbfa7657d2f266a535dc004e72180a583512a3666996d9d9f5d426ef9e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137706, "uuid": "71e0bd5f-c109-4f38-86f1-b0a12fe1d391", "comment": "Malware payload", "value": "c191c83ba86519a1b4f65eda568a012e63c43ea3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137706, "uuid": "6aa10b01-2b86-453a-823b-5afe026d47f1", "comment": "Malware payload", "value": "1b8a12b1f545f24232959a046ada0c921087496ef7228a8ca87ab55d81ff1f8ba1293f56041e797fa2e1f398e7cf591c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137706, "uuid": "b17e6c91-5a0e-49e0-bdfe-39e6c5da6a59", "value": "T1934382602ADE30AAF501B437DE88EE0D7DAB52FD7F97836720682D7B36D14205729139", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137706, "uuid": "0b15b2f1-9bf1-4bf3-af2e-3d30eeff6492", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137706, "uuid": "dc019280-f05c-40f2-b894-82dc917657ef", "value": "768:mZX+kM04KCP4MN94KTl52ffDl7xCWIFQUZFOY+PlXkjAgprBEOLO6WBPi5DzuK1z:mdpDlTNPmB1jx2UAbDZXi1+i1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137706, "uuid": "51d5d060-2e92-48bf-9d5b-aeae0665fa3b", "value": 56608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137706, "uuid": "f95ed72e-df32-4f3b-b1a0-ed2b20c9e2ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137706, "uuid": "640b6f44-945e-4998-9ab7-6415684371ca", "value": "SecuriteInfo.com.Program.Unwanted.4695.29091.29628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87055c4-e0ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682126473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126473, "uuid": "efe32d8c-0b14-44cb-a4fb-d7d8c766dbfe", "comment": "Malware payload (RemcosRAT)", "value": "0952ce49925290f3d8708a2b87432d7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126473, "uuid": "0b7b2269-1dc1-45de-bcd6-19d21b3c64f8", "comment": "Malware payload (RemcosRAT)", "value": "4143a027af3c078d252c462f6101cc1b4b849402280371d9279e6fa62ee6cf75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126473, "uuid": "a2eebb28-fe50-4e50-8410-2774b0367fbf", "comment": "Malware payload (RemcosRAT)", "value": "e71dbaa7c7607c4d24eb048f691e9ce8d0e33fed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126473, "uuid": "130489c3-9fed-42c4-874f-5068beaf2ce6", "comment": "Malware payload (RemcosRAT)", "value": "589a45989f6ec6bd866be38092392cfb49326cee648f53b4fba10b91b7189fafbe4a72c4f17cc456daf58f3230dabf1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126473, "uuid": "1cd07444-b47f-49f3-993b-954f5ec18bce", "value": "T1B42512A9F37EDD2AC27D0A76D4D3041803F052469993E7096CD620CF562FBC94A92BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126473, "uuid": "7a82095f-d095-4a72-ac6a-dd9b3065c505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126473, "uuid": "0232f4f2-b823-4e3f-8103-11f600e8986e", "value": "24576:fzL8g2D4wmifQMfkOyoyU0NqrjTpJf2v4fYD02+yxPs:fvd2D4/Kk5lU0UrXGvOunP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682126473, "uuid": "2608f84d-e8a6-4064-98c6-e231b5e13e2a", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682126473, "uuid": "c4e829da-dc7f-4400-8c13-998c737bce4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126473, "uuid": "d13b354a-7910-4a84-aca1-df251a214258", "value": "0952ce49925290f3d8708a2b87432d7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e375dadf-e0c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1682139322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682139322, "uuid": "13d14499-045d-4a75-b74b-7562884b7f0f", "comment": "Malware payload (RecordBreaker)", "value": "c9b0611f7cd34b068a589b0c60e69817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682139322, "uuid": "42a33941-5522-465c-8366-9ae543006e34", "comment": "Malware payload (RecordBreaker)", "value": "419ea76a411bb0e0471ea28a4d81bfee5e53558ef26225678f43bc684ff20d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682139322, "uuid": "d4689cdb-e795-49ae-b807-73b8e6b40c99", "comment": "Malware payload (RecordBreaker)", "value": "1cfe3935de0f15b08a23f830bd12b8f8fca6deb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682139322, "uuid": "fd28e52a-0b9e-4bee-883c-c54a9c58d8a8", "comment": "Malware payload (RecordBreaker)", "value": "1275bfd98c55bd7c5c4a84fea9e59f5db3b795fa1e050b111c8ed72b24306fb4a0d734a76447f0a79c408f9a99edf903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682139322, "uuid": "593e0958-c95d-42e1-a3d0-6844e4842f1e", "value": "T1C9152243EAE08637F4B663B00AFE4257577578D04E3593AF2A9564EC69326C089BC31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682139322, "uuid": "6b9ae952-62df-4cf6-b90c-f5a91d131403", "value": "2339ac77bf9371500ebbf86df3a10d43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682139322, "uuid": "c0c5dab3-c305-43ac-a3a1-453840b8db82", "value": "12288:tLovNt0iqP6jTPvnsmC00943vDG6XMaqFt7eDC6+WEWTksUFJIMKFd9GcSOabsMX:+t0iqIM4LG46ICZF6dIvOabrFgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682139322, "uuid": "3698917f-6dd7-4f9f-a3f3-66d16841b790", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682139322, "uuid": "ba059123-e8ab-4196-9700-298de2c430bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682139322, "uuid": "c74f9be0-52f9-45fd-b583-64abd442f920", "value": "c9b0611f7cd34b068a589b0c60e69817.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e83a2d-e0a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682124242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124242, "uuid": "c1b8ed64-caf7-4e5c-abc3-87798099c7ad", "comment": "Malware payload", "value": "8e5957005e038a8f07953820136d8eb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124242, "uuid": "b3c0e17b-3933-4743-b0f7-262d3a724e2d", "comment": "Malware payload", "value": "422939cea48c91fcd37e8e0c43202ef93afdf7d65a2013b68f3b635082c2e283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124242, "uuid": "28e49615-85be-45bd-953a-c47c838841cf", "comment": "Malware payload", "value": "9c9bdba0ef007c586e3f244cb5f51e1f235d754c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124242, "uuid": "8f0e3f59-11b8-4366-b690-fc643a02f06a", "comment": "Malware payload", "value": "e0f0ef5b46a79417cbb0923d681f338106b5ed92535c904ed2fb444962726dca552c77347b440875486f1245fc837a45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124242, "uuid": "6c2fdb64-5f60-4f32-b740-43b202119860", "value": "T1A064C0023388903AE12BE9340CEAD534ABAC7071379F65DBB7891B5987357E1A63531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124242, "uuid": "41f12862-0e89-45cc-98f1-3a7f84a2108b", "value": "7ab88a2560b399bb2f4b089a0ec1f31a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124242, "uuid": "628f39e1-5ae6-4e22-b100-3138f97843ad", "value": "6144:gYkyBK4G2jNLxnl6XVJbi9WqJFFK3ojNmTHWzU:giI4GsNLH6XjCWqJTV4THWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124242, "uuid": "5a52de79-2cdd-41e7-be9a-d83e6971fb1b", "value": 315040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124242, "uuid": "3ade73ec-150e-4091-9c4f-c9e787425cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124242, "uuid": "70428687-6a54-451c-9818-cd4d16abc0f8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a66661f-e0cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682141723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141723, "uuid": "4ee08b21-41b4-4a50-822c-12456bc93069", "comment": "Malware payload (Amadey)", "value": "5d3c85218cec5e5c91db5b13bd931f2c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141723, "uuid": "53f0ae26-d1e7-4ef0-b566-72d409b14f46", "comment": "Malware payload (Amadey)", "value": "4506917f5cd8be78ec581d74085c21b75b17c2ede56f0af2dc38bc3f09e96caf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141723, "uuid": "012dacef-db0c-4a98-b92c-31ef7d143dbb", "comment": "Malware payload (Amadey)", "value": "60780b5e84809bf2273c0096f7d346c3844bb03f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141723, "uuid": "a40e440f-b46e-40a4-a9ed-2d08f54bac8d", "comment": "Malware payload (Amadey)", "value": "29fb3803e6dcfaa988e45171399c37711a8a4b7fc8245171e4635afdfff8b77f6cde224a7c5346e6991c82347df78eb8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141723, "uuid": "de676700-0101-41ef-9a34-3ac791ab5699", "value": "T151452347B3D81023DDA423F509FA56830E34BDE28B6092E762CA499E4D336C9B535777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141723, "uuid": "68cd7bde-ea3f-441f-88d5-5d3dc5fc4ce4", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141723, "uuid": "ccf10612-c166-4a9c-b25c-c32a92af66ba", "value": "24576:pyCfzsb467yOaaFY+M6jtKVD3dNJDhDi9P9/7bfWH:cCfgByH+MBZDg1be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141723, "uuid": "b90f0720-1929-4d1e-b32d-2cd3a7ca673a", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141723, "uuid": "cea4ad76-1b67-42ee-8461-dc24becc2bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141723, "uuid": "f029da41-4dd4-4895-9ae7-1db396ec882b", "value": "5d3c85218cec5e5c91db5b13bd931f2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0222a81e-e11b-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1682174163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174163, "uuid": "fdedb4ea-98f0-4742-95ed-1d57ec1e198d", "comment": "Malware payload (njrat)", "value": "a118ee31e68cad149975fec84cf58543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174163, "uuid": "b4cdd0de-58c3-4d39-a2b9-38a317b41977", "comment": "Malware payload (njrat)", "value": "456cc4e4131c6a7b6587d48148e0dc9dbb20ce34c285dc8db9dcb61f7fec7c41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174163, "uuid": "d078bd11-c4b7-4795-b69b-3a5aabc5c8bc", "comment": "Malware payload (njrat)", "value": "b778aefc62b4b43a182f1ba75a95bdf71a19e365", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174163, "uuid": "b83f3dec-ec81-4822-87c3-f9a264f17f44", "comment": "Malware payload (njrat)", "value": "9b1d6f119a3ce552151cc3f331ad0a062da3ec9d27281513f3724fbfac5e5cfc0f32d6fa7d776840a47547289e68aca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174163, "uuid": "89230bf8-1db9-4e48-9653-9d3e016369d2", "value": "T12DA3930A29E54DA8DF6F14735032C6307175BF4A18B2B9B589DBBCAB71729C1CE1E138", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174163, "uuid": "b67137f2-3c00-4b0b-8dd5-ea5f6ada2122", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174163, "uuid": "5aed5b77-b280-47c8-9b34-000a0d0c19d4", "value": "1536:hzRN2ltJYXS+gRJNSJ/u+CEhWFah4CH5Oj:hz32jMS+yJEJ/u+EFahv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682174163, "uuid": "c79f6009-8cd1-4d36-9c1e-3343cb54932b", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682174163, "uuid": "7c42df6e-3b11-4333-a1a1-43c18c39d693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174163, "uuid": "88188452-b00f-431b-8363-cff540dd1b20", "value": "a118ee31e68cad149975fec84cf58543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170111f8-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137691, "uuid": "2b76241c-0768-470c-89ec-58df00dd7d94", "comment": "Malware payload", "value": "44c655d5ebcd9237883d9560b2201e01", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137691, "uuid": "6f440b58-a51a-42c9-84b5-48b93f3c32e4", "comment": "Malware payload", "value": "464d89f07f36f31ca3e18eefe1f595b8e3ba46c79b2b84241357cb43b82c7128", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137691, "uuid": "57558e46-ff5d-46ae-b575-24895f477b5d", "comment": "Malware payload", "value": "181a7ac31b88ac4534b1c758d04b4833073e830d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137691, "uuid": "87d9750a-d443-4fc8-b82c-1a9e25e20142", "comment": "Malware payload", "value": "2603f18fb68069f2558b8ff594ca9c72b594d8d66fe57cff6a15f7d7ad7e651188c71f80128e6cf1ca83711b18227abf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137691, "uuid": "dbc141bf-d0c5-42e4-b7e6-ce1b284c7f18", "value": "T161A50920EB418019FDEB02B39BFD55ED94687C204FD844C770C956FF166ABE26A32687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137691, "uuid": "44c87337-2139-4925-851e-b1025a581a8b", "value": "6aab53df585ba7cf4764c9ff81cc3be1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137691, "uuid": "4e45a17e-b547-4e26-b77c-c8dbc834e3f7", "value": "24576:YMpJXKn9CihIYh0iG4c+YIkcF1ZaFPVIqXtu+50vcvvN6hJ:hcAid9G4c+kcF169HyEvohJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137691, "uuid": "1c47c230-674c-4e63-91eb-2df89c4cc897", "value": 2142496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137691, "uuid": "6c6527af-c716-49eb-a4c5-3d19dbaf55d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137691, "uuid": "b6bedbf0-866a-4c2a-b96b-a5a2e3f731db", "value": "SecuriteInfo.com.Program.Unwanted.4695.30660.18465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb02018-e0d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682142322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142322, "uuid": "5ec13d5d-d54f-417c-bb79-b67ae64e8787", "comment": "Malware payload (Amadey)", "value": "a778cbdb723b0530721c209a3d665429", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142322, "uuid": "a59c96cc-841a-47c7-aaab-79e431439276", "comment": "Malware payload (Amadey)", "value": "4700b09654b2536a283c7692a03e837b52474e6ca4acef43293ca21a9c403717", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142322, "uuid": "ff91b5e0-0491-48ba-b955-4785f86ab00e", "comment": "Malware payload (Amadey)", "value": "d5d7b5b577a781775858f3ecdfbd7a6738e7f91f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142322, "uuid": "82edcc3d-83ed-4e7f-863a-babcf5798695", "comment": "Malware payload (Amadey)", "value": "e3df5b69a9c5c6608eb80b3bd4861eef761ee15129856c1f06fbca1bf3649d3bc75733b3d4cbca0c3cba2959e4c4578d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142322, "uuid": "0f15997e-24d4-4948-b073-bc3821f5124a", "value": "T151052312B7C98177DCB547B098F616C7073AFE92AF78D79703908C8698322C45A7672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142322, "uuid": "0bcb88f5-85d2-437e-b89b-d7bc01ee3091", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142322, "uuid": "a7b3d0bb-641e-4c5a-b094-76a44eb6d00c", "value": "12288:0y905srFJqGHaZLwz12oKlDoOQqdOPdY8803JMua5HzpEF8IxGosbGTEp95NV:0yZvHaJwz1IlD//OP/80YHFFFG4p957", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142322, "uuid": "e70a4f5b-20b7-4ccb-bcaa-6651947961a7", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142322, "uuid": "037512d6-12a9-479b-917e-04070e752aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142322, "uuid": "e3b82a1e-f883-46ea-a903-7dcaf3437d08", "value": "a778cbdb723b0530721c209a3d665429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0094cf62-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137653, "uuid": "0a7502ed-2d38-4fc2-9b01-57c8574d3ed3", "comment": "Malware payload", "value": "8af851d321a00f5bde13d6974474aace", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137653, "uuid": "edf53787-00e8-4618-9f93-86e11d6053bb", "comment": "Malware payload", "value": "477155bca26026a6ec13866b6798ebecb9dc02b8b36c76a5b6a34f63fef55c94", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137653, "uuid": "f84d51e7-0b1d-4597-b81f-332c180bf1ba", "comment": "Malware payload", "value": "f9f449ebc146e01840e83522855f1a87a70da7d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137653, "uuid": "380ad11e-65d6-496a-a9d9-b2dcf628ce00", "comment": "Malware payload", "value": "0fff574fca291b25edc416302c05fd2ee4f212a6a1b17d99671b3e9b42da5b551006552221071618e017eb7779129706", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137653, "uuid": "f8a8bc5c-f963-4050-98d3-4ca494087cb3", "value": "T170921B9A0FD93163FE437DB197CAE35B9A32B2E0E695C4AF106A82911EC0790372553D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137653, "uuid": "0ea001b3-2cda-4f0f-8640-0e22aa030a74", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137653, "uuid": "6d77ce2f-0958-4b37-82f7-1826a91f99a2", "value": "384:J4Ic3CJHA2ws5c8UpPcYGMGnYPLaiSKn5PRiSKniX:J4I8CJHA2wsy8UpPctMGxi17i1niX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137653, "uuid": "d270cf7d-c076-400d-85cb-587dd8e1fb0e", "value": 19744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137653, "uuid": "f1f7645f-f8e5-4c29-ace8-29f4a5e6ab4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137653, "uuid": "77ceb0bc-c968-45cc-b650-24db336a6009", "value": "SecuriteInfo.com.Program.Unwanted.4695.15373.29109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7470dd4b-e123-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682177791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177791, "uuid": "58218aee-6ba7-49fc-b030-2fedb8d987c5", "comment": "Malware payload", "value": "0000efd7a890e1e1a93e481288f5bd2a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177791, "uuid": "13514e8f-d210-48f2-be38-ca74f3cb1bc2", "comment": "Malware payload", "value": "4799d051f0e40b15ec67593ea838df901613018d26b612d6d2447431323d4a01", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177791, "uuid": "201939ca-86fe-462d-9241-755c9c26c1ce", "comment": "Malware payload", "value": "b5c5386dcbd850262a7a81ff818343dc306e58ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177791, "uuid": "9e1f4437-9d53-4349-8a2d-b65c1220ab40", "comment": "Malware payload", "value": "6f4d8e561c86be6525ae576aa8486fd893a96825ca7c4e3b84f951b40720a812c041fb88cad2ad7ff0867c11e7778d21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177791, "uuid": "06a7093b-a4d6-486e-a246-4588d1cb6b61", "value": "T1CD44AE51B2D2C8B1D81B41718825C960062AFD73AA7041DF2AD53E3FAEB12D2967773F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177791, "uuid": "ec7d5b33-5af4-4ed7-85f6-6299b424a58a", "value": "7332a4a6efd535019dd7e3059bed7a73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177791, "uuid": "d1b7933f-6e00-4dfe-ae27-a49e01e42fd9", "value": "3072:mnHLnmkpqfHMcPHow/Bw+Zw0jlyNMCCZTImdM1LXjwOYuaF7ZHWAAfne:mnrjpqfsc/H/a+ZRjlc1sMtUuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682177791, "uuid": "641afc8d-a64b-4d94-98ae-5b0315a97f45", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682177791, "uuid": "34e12c93-812f-4a0d-b65c-79ce6e7820e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177791, "uuid": "b2915d57-8349-4795-89ab-e06d9184cba0", "value": "Nemty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c4d406-e0ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682127616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127616, "uuid": "c54ac531-f10c-47c1-83f7-0723ba2fdf86", "comment": "Malware payload (RedLineStealer)", "value": "b48eb1e7e377f6e7356e9fb62c94ca46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127616, "uuid": "6966022b-cc33-4837-8fdf-53a95033c986", "comment": "Malware payload (RedLineStealer)", "value": "48211c6f957c2ad024441be3fc32aecd7c317dfc92523b0a675c0cfec86ffdd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127616, "uuid": "16581389-8a4e-4477-be68-186073a6c64b", "comment": "Malware payload (RedLineStealer)", "value": "b07b9f0a199ad4f859efd13fe50aecc154353bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127616, "uuid": "68618b11-96b4-43c1-931b-841821c56f89", "comment": "Malware payload (RedLineStealer)", "value": "dee9c37dd686c19f30a33f69d95682edbda5033f9f7078bb36420b798b1953cb81ef7ca550801579dbeebf69c53d779e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127616, "uuid": "b27baeaa-d7c3-485a-a3c5-074c0851c559", "value": "T1A796236752655285E4E6CC3DC937FE9236F703678791F839ACDA39C23612898E213B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127616, "uuid": "e95ff1e4-2cb4-4efc-ba77-f6c6f9596648", "value": "f540b6d6dcfc33b21d0deb0ccba24751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127616, "uuid": "1699f385-4128-40c4-accd-fa5e1a52a868", "value": "98304:/IAOnqfjWvGRCbRwpo6xJgye1pNiFQ4rPaAmGDyF7b97vUg:/IAmttgHgyePNiFQ0PIay9b9Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682127616, "uuid": "4fa88da0-abd9-46c3-bdb7-1cc8a63abe13", "value": 8885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682127616, "uuid": "fe203bc1-3c1a-41c7-9f22-bd1392ef8c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127616, "uuid": "9d651fe4-b31d-4ec7-b9e3-d3e2d9714e75", "value": "b48eb1e7e377f6e7356e9fb62c94ca46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c52041c-e0d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682142021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142021, "uuid": "75b9dd39-f11e-4f1b-b88a-d8051e26b389", "comment": "Malware payload (Amadey)", "value": "9510792c928a08686dabbf23ba524050", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142021, "uuid": "5d60e62f-fdb5-4dcb-b7a0-f37fb2ed4451", "comment": "Malware payload (Amadey)", "value": "484e3606f0d87761fb2865f3d1d1eba4d84c1ae32538eb45b01824766e881195", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142021, "uuid": "7d76e377-4d83-4519-bad5-c599c1b32d6d", "comment": "Malware payload (Amadey)", "value": "40f48e7ad407b2979180264faad26ff9ad0f3e2a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142021, "uuid": "fc35a8aa-8f8d-4452-9c2a-82693280c32b", "comment": "Malware payload (Amadey)", "value": "0425aa3da2079a58f1a2289020ebc26b96091cd18ad2caecd6d813249aa9523bd3bba8f86f0a5e17d1f5d207afd64be7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142021, "uuid": "b869c159-740b-450d-a9ca-c73c41f11b1b", "value": "T1C935234A21D90033ECE45B701CFE17470A3AFDA19E65C7EB1B48A99E6D73A94843136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142021, "uuid": "aa4f013f-bad5-414e-9918-a1572bdc1c09", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142021, "uuid": "e7eccd0f-c12e-4871-81ac-59ace1276619", "value": "24576:FyW4N4L3jZD8CHmW5A1p/zgpAxPSQFCUkDspqJDMa3fkRf00BP:gJm9Q0mW5A1p/0p2FkYMDMa38Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142021, "uuid": "32ec8820-2485-4cc3-93e0-96c7a0124865", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142021, "uuid": "46698159-74c9-4478-a287-e8caacb88f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142021, "uuid": "df9824d2-26d1-42d2-9da0-e76e18d74823", "value": "9510792c928a08686dabbf23ba524050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c10f9d0-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137672, "uuid": "dbd09dbb-9b3a-42d2-8f9a-3cd40370ffaf", "comment": "Malware payload", "value": "917d5cecd8bfb15fecbdf1a309712b98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137672, "uuid": "53652c61-068f-4dc1-b286-0f9f503fffac", "comment": "Malware payload", "value": "4855bcd6f42b7c7fe9c5b7f9735e749e08297ff3fc973ff644bb411702d8b838", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137672, "uuid": "61e884f2-0f03-473a-b37c-3ad38848aa3e", "comment": "Malware payload", "value": "2f9ae35a14f147ed9fb912b2022549f55b7bf21b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137672, "uuid": "5e3450ee-f22f-4099-9c8a-2ef9552ae64c", "comment": "Malware payload", "value": "dbed180e0e75d8fde20d7039ce5c74acfbe6d7c2cf874813127853ee2d2bc3b88565e4570ceb8cf3723c9e82778b8ccd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137672, "uuid": "dac3c6c7-6d97-4b16-bd84-99775e5881f9", "value": "T14733394A27DDA063EBFF0E302AF4D0496B32BAF6A8B6D74F3504406A1D53BC09924757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137672, "uuid": "33d03c80-e58f-444a-ba54-9937f39e7e96", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137672, "uuid": "a2cfeca4-97f5-4fe2-a663-472e82658bf0", "value": "768:T4JxKxYIP7NGp4mbOLfjz+xEqDAXjIXayxi1gi1RiY:rxY67NYofjzr6QyaOi1gi1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137672, "uuid": "ccb1155b-42a4-49f2-8f3a-9fbd331b5f1d", "value": 50976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137672, "uuid": "b0fe15be-356a-4411-90ba-f836929f8152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137672, "uuid": "974b01fd-47d4-4183-a67d-5365da9de707", "value": "SecuriteInfo.com.Program.Unwanted.4695.20114.30204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d8bbda-e144-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682192131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682192131, "uuid": "de8ee1f8-c68f-479c-9d4b-625e89bde291", "comment": "Malware payload (RedLineStealer)", "value": "4cc815fed7815c8b7a176c18517272d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682192131, "uuid": "9afa3571-8013-43f4-a4e2-d21c2c424477", "comment": "Malware payload (RedLineStealer)", "value": "48bdc991235cccdd9c83cf4630429235839fdb02fecb43150de05ca2806ed120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682192131, "uuid": "905cbee4-9ab8-423f-95d3-4d9d665aefd6", "comment": "Malware payload (RedLineStealer)", "value": "c92d7f664686319179c4a06273002f46bb5686fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682192131, "uuid": "08df9f8a-5e42-46dd-8c33-aea21ef342d3", "comment": "Malware payload (RedLineStealer)", "value": "e13a1a083f32809f34c56865a31d40a7b0a307b401c69f2c4f0f9108d16c899c0613adc5b82c5d9e81efab580df4c279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682192131, "uuid": "6a8eeb5b-b269-4b47-8293-84afc4782810", "value": "T12EE4121665DCD072DEE71BF059FE03930635BCD25B72839B2606E99E08B3684E23176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682192131, "uuid": "39284d58-07d7-46cf-ac8a-e01919bc2fef", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682192131, "uuid": "8316f73d-f5f9-402c-b62a-9e4e69cfaea5", "value": "12288:jy90KtsdeO3tNWUEIeVeEfYzYrDBWGOVynpqQ86LyMSCv/G5aLUunXCcvFk3pUC3:jyO/tMULee4DBlOcZ8HMRve5avSmk3a2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682192131, "uuid": "22b1dc2f-65e7-4c29-8b12-5a579583601b", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682192131, "uuid": "2c3175e7-8d8a-4a18-aa51-a036ec58eea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682192131, "uuid": "bdf86436-0ecd-4bcf-8776-f2b5a1efa1f4", "value": "4cc815fed7815c8b7a176c18517272d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2ff8f1-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137696, "uuid": "4c61c586-fa00-4f3a-a66a-63fb8b774189", "comment": "Malware payload", "value": "a11e6df96057ec42bdd44bd12c5c2c5e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137696, "uuid": "7e48acd8-89b7-4e0c-9e50-728ce07f6cb4", "comment": "Malware payload", "value": "49c42bea91ec6245de2f0ee6dfe5fe47102e26489ee4df6f67b992bf8cdda4ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137696, "uuid": "7ed29f1e-71e3-413a-b54b-619c7666b410", "comment": "Malware payload", "value": "93cfd2dbe5273b0d050207d4abb9a2979b017543", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137696, "uuid": "73efd688-cf7d-49c3-b395-ef0d37340cc1", "comment": "Malware payload", "value": "e1231cad4f02c776a44049ea2b116102ad135b594a82dfd3220613aef1970fd6cf56662c58f1ac1c2b95fecad424ae19", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137696, "uuid": "fea249fa-0331-44a9-b352-192568870187", "value": "T1D453E92A79DC3079F9427AB3AFC9D2AED725B2C8D243C67E206B528317C55887753078", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137696, "uuid": "77a67256-79d3-4eed-a000-967d27c528fd", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137696, "uuid": "93e98d70-69c7-4a11-a3da-8496001b9624", "value": "768:uQ+RRfR4534ujddQxEt/WUj1bTXg2HRlRxmPAc/12jroH/QEnCL/sNb6n2+BnEyz:uZ3Pz7+ZCYrZqoUCmi1Kzi1gE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137696, "uuid": "78af49b1-ca19-4497-ae9d-d7eb1f85fbf3", "value": 60704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137696, "uuid": "4ef29571-3a35-41ea-8ecf-f8891c44035f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137696, "uuid": "c6b61c12-2b04-48d7-a7b1-40fefd09fd9b", "value": "SecuriteInfo.com.Program.Unwanted.4695.31519.13354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08097aa1-e116-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682172025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172025, "uuid": "9df2d85d-cb30-473d-acd9-5773e33a1552", "comment": "Malware payload", "value": "d9995eaec957cd6fd2e02e0e6a1a99b0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172025, "uuid": "a8690eaf-53ac-42dd-afff-f83a237ee254", "comment": "Malware payload", "value": "4b10bb186a99ef542d431d21e7babcb3fadb7b34f2c855c19711682b4f41e813", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172025, "uuid": "a22e0873-0806-4092-96f3-26c5a2a46a13", "comment": "Malware payload", "value": "681e3bcf347890022089e15f6fbb8f299af102b6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172025, "uuid": "f526caaf-2016-4a03-b887-21c432891a8e", "comment": "Malware payload", "value": "81522b5400c61253b78313b9c24d80e917f8655a5d42c5154b20caa5db425b622ebe15c39a8a172c98255d81f870e5ec", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172025, "uuid": "a7b1e204-0452-4a57-955a-1b51e85c5ab8", "value": "T1C655F1017AC79732D1BA0230257FA7B06B7DAC305EA5861BA3D47A1D3D71290A375FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172025, "uuid": "04ba7d4d-2363-4c4b-ace9-0e228c9c3bef", "value": "24576:VEVOxtwYXcBTwrZLiqqHUitwwEyDCejj6Y:VEVEt/cBErJiNHUrwP+iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682172025, "uuid": "db5ecefd-5345-4b5e-9e2e-840825927f72", "value": 1319936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682172025, "uuid": "cf93c419-f78a-4418-b618-48d20e58f2fd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172025, "uuid": "f072aaba-f3c8-4a95-8a72-5634afde80ac", "value": "GPT4 1.1 setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789e7f23-e0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682161047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161047, "uuid": "a1b6a666-cf37-425d-84c5-4722d4690773", "comment": "Malware payload", "value": "c9e1d85a893bd7bfc5b2493a5f72efe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161047, "uuid": "31b27a86-ab58-4321-9134-6216bd1e4556", "comment": "Malware payload", "value": "4b9a143d4edfd41ac72e01d39e654ef7571c50ffe0a881abde096e3f731a691a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161047, "uuid": "8650c2e2-9932-46dd-a224-440ac9df7f24", "comment": "Malware payload", "value": "a86f90ac6c290546882725378859ff85d5fff3de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161047, "uuid": "9848549c-4b09-4ce5-9587-34ac77186fc2", "comment": "Malware payload", "value": "83d588e6d063025502785db5e72edb6c941a8c2280180460752c80edf0b14c1442952e8a751b1ff251dd645d09c152bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161047, "uuid": "9fa042fb-91da-4c9b-a137-a2a122c478ff", "value": "T194557C7177E0ED82EBEE0771E82106045EF4B8436535E75F9C6682C63462F80BD9AD3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161047, "uuid": "290fb704-7f13-4c78-91d7-e3e0b7dc11a2", "value": "24576:yiE0BwNL6HwaygQ94d3qhHOeCmzL3Nlz4N:dxAWwah3xIL3fz4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682161047, "uuid": "6ade9984-b2bb-46fd-ae37-37417856a1dd", "value": 1354469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682161047, "uuid": "fa07b483-0a66-4fd4-8cd9-fd9388c60b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161047, "uuid": "96ca7c17-6755-474d-9b74-1438e48b487f", "value": "c9e1d85a893bd7bfc5b2493a5f72efe3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47511f2-e13b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682188233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682188233, "uuid": "778f601b-53e4-41a9-8679-ad239c3e3d58", "comment": "Malware payload (Amadey)", "value": "e3ebd1462933df4e79b5bf0d64cefa3b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682188233, "uuid": "df582b3f-d374-4de0-8ff1-ae37d0319bbf", "comment": "Malware payload (Amadey)", "value": "4c8f8899d02737d9c1c00f8848f73298a2749ff7a1a75a0ca2acd68117d2b515", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682188233, "uuid": "47788bc4-610a-432b-8c53-95d16a3343dd", "comment": "Malware payload (Amadey)", "value": "d1297a830d102507355691b5cf5b7d4b5407ce5f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682188233, "uuid": "469dc818-fe0b-450f-8d0a-fa254b971035", "comment": "Malware payload (Amadey)", "value": "7a584293c2723a3113837c6d27e8567e63d627c561456b6a4a688d8201fb0db0e0fcb6215d13a714162b7c6134a950c3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682188233, "uuid": "98cde450-a405-4fad-b18c-523a11ec8800", "value": "T16D352316ABE45232DEB92BB148FB03531A35FCE29B7087E7418E855D58F27C0A631367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682188233, "uuid": "958d5238-33e9-4af9-bcb5-cff71ce532d2", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682188233, "uuid": "89ca675c-d289-427c-b71f-b7463e493953", "value": "24576:6yNCdMAZKm0nIbg0OGyfhma8xytYJGZ3nd5ofU5ibbLPKQ:BRXR0sfhQxXGZ3dribHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682188233, "uuid": "d15820b1-d984-4f5d-b05d-60f2797ac7c6", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682188233, "uuid": "c43aa0e5-6cab-4b91-9147-59d3b9199809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682188233, "uuid": "b3ba8ca6-b44e-4b81-aa57-69d719fd5bf4", "value": "e3ebd1462933df4e79b5bf0d64cefa3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1fc133-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137724, "uuid": "185d1302-b233-4760-9c76-5e00dda300bc", "comment": "Malware payload", "value": "0f0343ff89243ff0f8916f5cd51f0edc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137724, "uuid": "3efb44ec-0af6-4fc0-8704-34a88e0143e5", "comment": "Malware payload", "value": "4ce4e2df226ef656094e022d8c6e6efe03ce76d70251e7fe188a8b3652753007", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137724, "uuid": "e36ef870-3c6a-4a7f-87d7-198431e847f0", "comment": "Malware payload", "value": "9d86568f56a75d33ef78fe8e5e0a28cdae821651", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137724, "uuid": "d4878071-08d5-4211-96e9-6f916bae331f", "comment": "Malware payload", "value": "34428e7c2784bbc2a79f04a9c66d5d7897a08d88aa06c2523492274dcab629d56d9c1e93e761c8d56bfc0e4712362c43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137724, "uuid": "ff4de0fe-de3e-4b26-a23b-9f2479ca9552", "value": "T1DC6523BEB3C31831DF8B497C1705A2161C68AF09D50CA5B66642BF04A95CE427B7FF46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137724, "uuid": "37d81da8-c4ef-4a7c-a7c1-8688dc2fc27c", "value": "74d8a52c051b08fe32eb17a015265157", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137724, "uuid": "67bf4c31-5d36-4eff-94e5-292705278f3f", "value": "24576:bpxBYFKp28zKqr/kbjDZzZ0TlSltUbA4L1FaVDV3TiAmxwZi+q4H4nvMJbikMq:Uqz6DZF+GtIA4Lva1pWAmxci/qumvMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137724, "uuid": "abe25303-d338-4f6e-ad28-458feb3533e9", "value": 1454562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137724, "uuid": "e4e38e5e-33f7-40e4-8d50-90d123865162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137724, "uuid": "405d08d6-b059-412d-b556-4d5d19d1404b", "value": "SecuriteInfo.com.Trojan.InstallCore.3772.7864.813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b824588-e0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682161025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161025, "uuid": "88cab4d5-199c-4434-b86e-89d57024ebbe", "comment": "Malware payload", "value": "03eee769018844d81e279fc5da4cbd27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161025, "uuid": "b746f5d6-df9a-49b9-af25-c874041ca22f", "comment": "Malware payload", "value": "4d8f83e81b95bcd8eaf29dd6a0c4d4cc0edf85ef0a1bb3bf5966192136255ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161025, "uuid": "5bb789ec-cd0b-4631-9769-566fdabb759a", "comment": "Malware payload", "value": "cf182e690f1cb8900443ccd4f7516e65b1a59acf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161025, "uuid": "f68e5273-02a4-4154-a046-e51700145209", "comment": "Malware payload", "value": "1456698df3fed63c23ba71c7568b19c0872038a697839feec0b93c9712cb12fdd925f1d09ae2641bf4c603ac25b9edfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161025, "uuid": "18beb22f-0e68-4c61-89c1-72007c4e65af", "value": "T10E758D32F9909076C52313709E4D736977FAA7711A7A128726D85F3C39F0493AA386B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161025, "uuid": "de154790-54b0-445d-ae5e-b72a7977f72e", "value": "8745df7883a801a0067a7a9eb683d9ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161025, "uuid": "a73e639e-f1ea-4a48-aa24-86269c5486b4", "value": "49152:NVqbjZKLyw3B8HLuiAf4XpO5i3l0hH1bRWydv:Wbjsyw3BKLujJ5iV0hH1bRWydv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682161025, "uuid": "da98f30c-37ba-41a9-b993-2f621f7cbb21", "value": 1654513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682161025, "uuid": "fb88c94e-8b8d-4194-b7ae-bb1b8ff754c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161025, "uuid": "cd1fc226-9b62-4424-aa27-86cd7535bc52", "value": "03eee769018844d81e279fc5da4cbd27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e7fc3a-e0ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682141116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141116, "uuid": "557aaa25-1923-4df6-a823-8215e0d4d776", "comment": "Malware payload (Amadey)", "value": "0a0c79092ef172c615373293b83d7b9c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141116, "uuid": "082e4cab-e679-4a8d-b990-068c6e891eb2", "comment": "Malware payload (Amadey)", "value": "4e47f3f3d862575dcfda3bcecc80dc39ebd007961bb6343ce3b5369044b02e30", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141116, "uuid": "daeb9349-4952-4b3f-92cc-1c5f20f2683f", "comment": "Malware payload (Amadey)", "value": "4f49600e9972e104bffcf232d0339ee32a6037cf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141116, "uuid": "06866c26-3349-4d49-b037-8f135edb1fe9", "comment": "Malware payload (Amadey)", "value": "b6a3690b3f95204289b9143b5f1717fc6cc8de1704ef663a2131903c2a264c0e63ced67969152036fd570cd32e407c2f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141116, "uuid": "777f2be9-ece5-45d2-9972-32e31ec9dbbc", "value": "T1C0052312B7D4C4B2CDB217B054BA1AD30B36FC935B2885DB23865D5A48B39D47831B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141116, "uuid": "24ed6dd0-dd46-4455-8ee9-a323132fbb12", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141116, "uuid": "6dc17810-d700-4d51-9605-65c3eba3df89", "value": "12288:ty90qo6TL3RdT6MzcJEI95huWg8Qp2ZH2DYaixXBEHpIqJOTX4R5XJzen4pdOsf:tyAIL3RlAPhuWBOQdgIiR5XJK4pdO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141116, "uuid": "633ca8a3-0f2a-4d41-a173-7826aed119cd", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141116, "uuid": "6178dce7-add6-415a-96c3-c82b1f1d04bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141116, "uuid": "74d06c40-4851-4a49-a1d3-400b569c57d9", "value": "0a0c79092ef172c615373293b83d7b9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b8f061-e0a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682124916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124916, "uuid": "a3d9d3da-a898-4e4b-945f-b6e930eddf1f", "comment": "Malware payload (Amadey)", "value": "ecf6c8be4adce2f2f2edd00b366a9087", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124916, "uuid": "c753ca47-492b-40c0-9c04-e4f1f24cb035", "comment": "Malware payload (Amadey)", "value": "4f19e0dad062e3090433e2d497d6b37b810be58e3069f6e48eeb5f4316e0170f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124916, "uuid": "697f4362-fa40-4ba8-a10f-d8a44c328f5e", "comment": "Malware payload (Amadey)", "value": "79671341e01bd2657d35857ca7034231ab6499ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124916, "uuid": "8d4518f9-1b17-4a14-a1c8-9b4a1ff57bce", "comment": "Malware payload (Amadey)", "value": "3a989f645a796e83355c1b7f9532bda1431290e8840a46cec535b194752062d72108494ee3dc129c3dd046ebbb944370", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124916, "uuid": "1392fc91-fde7-465c-9aa6-3c445c41fcf4", "value": "T15E34D0007AB2D472E54770B54864CFF46A2EBDA19A5BB26B3208677F1D313C08BA7357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124916, "uuid": "411d006d-0633-405c-aaa9-b3c905ebe0b1", "value": "8cb869f42d9744fa3286b04b1d083ca7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124916, "uuid": "2a1d495b-e229-4cf8-997d-c8e6d42a8dfb", "value": "1536:Emty//neNuTHm7dHGZteuS8PXa5FIhuxgiBE9yextKwLijW277foKtobMuf23nsp:NkGa+8/Duxg+e3KwoRwO9uo45HCaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124916, "uuid": "e7c53f09-1a19-4594-9bed-7a8074ca95dd", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124916, "uuid": "7e17e784-4412-4e50-9150-52132c2b36d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124916, "uuid": "5278ebc4-8604-4e9a-9977-ec00668b626c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0e2f51-e0e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (MoneyMessage)", "timestamp": 1682152435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152435, "uuid": "e72bf075-1970-4aa1-91a3-444342ff2938", "comment": "Malware payload (MoneyMessage)", "value": "abe3c3cc45dec9c01762ba3e534564ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152435, "uuid": "9f1155c7-ba7f-49b5-85fc-ce9da09e6fe8", "comment": "Malware payload (MoneyMessage)", "value": "4f8bd37851b772ee91ba54b8fd48304a6520d49ea4a81d751570ea67ef0a9904", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152435, "uuid": "97480be4-3427-49d2-9d10-2d30ae91e493", "comment": "Malware payload (MoneyMessage)", "value": "3b4ecff980285461642cc4aef60d4a1b9708453e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152435, "uuid": "3031fcbd-7cff-419d-b1b1-1a5444fba19b", "comment": "Malware payload (MoneyMessage)", "value": "37b2ac54b630d21811a5c013c83278e11e5ea7478c0962d48492b5e3a19c43ee1a6f9c0be3d2d6a95224ab0a1029a772", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152435, "uuid": "b62d2888-607a-48a4-b7ab-0d78adcb9598", "value": "T1EB850907ED9A087DC4CAA7B51B8F5337A734BC7A463529396644CF216E62E80D71EBC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152435, "uuid": "e4b238d1-1451-4ae6-a84e-ad86364af0d2", "value": "24576:PvYEtKXAjCSEPK2jO2/AkxtyrSjesHUklDH:Pv/jCSwK2jO2/AkSmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682152435, "uuid": "1888acde-8c9a-43e5-a849-0d71e07db84a", "value": 1847766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682152435, "uuid": "c8b5d7bc-2704-45f1-b1ce-71697155154a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152435, "uuid": "2f1054f2-bdf9-4742-892c-54ecbbab6de5", "value": "4f8bd37851b772ee91ba54b8fd48304a6520d49ea4a81d751570ea67ef0a9904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bd6bab-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1682135437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135437, "uuid": "1f5f2e89-f945-462d-940f-e20d38d23c6f", "comment": "Malware payload (Sodinokibi)", "value": "e4be3e7aa3e471f7c42ec7ba35c3d69f", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135437, "uuid": "a7212001-19de-47b5-9562-bd64baf7c969", "comment": "Malware payload (Sodinokibi)", "value": "50fdb342de90ce63c31625156beb9ed968bf11527ce7c4c3bd4a3f3f7c4cf730", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135437, "uuid": "9594155f-9da6-43ff-b658-e56d3c8e4d80", "comment": "Malware payload (Sodinokibi)", "value": "5640beca5831e8a49031cd335a31415bfc8f3282", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135437, "uuid": "4dc3966b-7521-4827-86f7-2c3a128051d5", "comment": "Malware payload (Sodinokibi)", "value": "f51a3f6793ec586badc40fe1337bbe77ecc59d584aa5e2eb91d7f123a989bb1d8399ad9d710363855b9a0897866b2314", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135437, "uuid": "70e9f855-566c-4245-88e9-c370a173b356", "value": "T165F3E06BAA5182B2C49781F3137F3F6B99FEFD30022458B7C77198C496265D1E20366B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135437, "uuid": "c942d13d-1b96-455c-8ec6-d312fa9f97ae", "value": "c88f20b29592f2107a629e815db6afae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135437, "uuid": "a71658c0-3671-46e3-a736-76373635b170", "value": "3072:eCEq0R0nZ5ys5n4Y9doh7O79siUs/NaV4mKI3EeUO:lw02sJPi7O93NK4mKI0VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135437, "uuid": "d0bcf972-39eb-44e7-864f-4bf1d479d795", "value": 168980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135437, "uuid": "97eb4b30-8ea5-47e6-a1ba-73d5a79e4185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135437, "uuid": "c9ed6f67-c2e5-41d9-8f6b-e3e9267e2004", "value": "2023-04-20_e4be3e7aa3e471f7c42ec7ba35c3d69f_revil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677b056d-e100-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682162737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162737, "uuid": "030b642c-c929-4101-8b56-6c80b86b8e3a", "comment": "Malware payload (Amadey)", "value": "f34b3a2eddc7bbb1714b3d5b256b24b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162737, "uuid": "ac1ed951-f0e2-40b4-bf49-57986e4ed170", "comment": "Malware payload (Amadey)", "value": "514d7fdb59eb0225a784836750ff0d7f565cc8fc45a1417640e4d6dea3cd2cdf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162737, "uuid": "17312cfa-23a4-449a-bb4c-64354cacfd37", "comment": "Malware payload (Amadey)", "value": "3242e921c7badc72f05e64e050600aab6ea0c5c9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162737, "uuid": "9ddd7e8c-5a41-45ba-a448-1ea3533ba49c", "comment": "Malware payload (Amadey)", "value": "ded6871d450afc1d532443c1994e8081400b447fae2e7d1490bff9d58df7240fbd19d2a5e3fce87b4931cf725591a732", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162737, "uuid": "49021d70-cc6c-47b1-8110-29df2ef66547", "value": "T10705234262D81133DDF2177028FA06930B76FCA22B249B933799EC9A6C731D1D67572A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162737, "uuid": "c8379ab4-1ac1-46c4-8d72-7697f4a6cb28", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162737, "uuid": "b29fe648-a5c0-4b4e-8617-0668d0bf967f", "value": "12288:hy904JyLtH/tXXc/64tLgG6xE9JVOfiPl/Sw85fdb/PRGxfSGWzlRyMstltL:hyALVhXNYtyEPE4IJ/cduh3s/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682162737, "uuid": "c80b22dd-437b-444f-bd52-b3fa472e178c", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682162737, "uuid": "0da03a0f-0c89-4840-83c8-588d8b6f58ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162737, "uuid": "06cb8400-8743-4a5d-85a2-e8a20e6a627c", "value": "f34b3a2eddc7bbb1714b3d5b256b24b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c9e2b1-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137638, "uuid": "96865bea-2152-4e5a-806f-1e1677dda837", "comment": "Malware payload", "value": "1576e9b9144826568f6c6d68be7b16a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137638, "uuid": "0b952a86-3dee-47ad-81b7-9a4fab50a2f7", "comment": "Malware payload", "value": "531366e501dc8a784b0ce1fc9784bdff8c4e5ce15279daf1851461349f7cdcea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137638, "uuid": "3ce2454f-53e1-4cd4-ba1a-1936c853d204", "comment": "Malware payload", "value": "fcf8267a8ed808fb197b17a9e62347ca2eb3bfb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137638, "uuid": "b67b6ecc-8b19-4ecc-aea3-732720d77ffb", "comment": "Malware payload", "value": "8cda06edf4b815fb5bb9abec06e157176e6da0147f2f12b42e687a4b9ec1b2941700b6fdb8a93102e8e1ba824e4dab19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137638, "uuid": "2a79e6a7-4e48-430a-9c13-e8bc5bf343f9", "value": "T187C67C12E7DA4071FAB716309976B339473BBA204935CE5FE24C594E5FB39908822F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137638, "uuid": "182145c0-5d4e-408b-94ae-d1d9645b5254", "value": "152cf2825a1c7cef8f499dba022a2441", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137638, "uuid": "7f155696-5813-40e3-afd6-7ee2da463d0f", "value": "196608:oOywEbBMspT29rGo9HmY7FPyAkZ28Z+1XaNpb8HT8aIexjwpL0:oDwsBMspaw7Y7d8fZ+1opHKwF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137638, "uuid": "22489aee-8e11-44cf-8095-5bb036cd64b8", "value": 12269328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137638, "uuid": "5ccacb80-9978-4648-9770-7ca3a4adebce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137638, "uuid": "4f66734e-b08a-4186-8f73-95fb48ce69a8", "value": "SecuriteInfo.com.FileRepPup.21677.15893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773567c2-e0cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682141718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141718, "uuid": "0301daab-25da-43db-8440-12346326f6cf", "comment": "Malware payload (RedLineStealer)", "value": "5d4346f78393bf04e6fa6d9094e3eec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141718, "uuid": "a884930a-3630-4f6d-91d3-90701c6b0470", "comment": "Malware payload (RedLineStealer)", "value": "54c104b84feae2e6d742de8d38c60591341b5f692d7f03d212c0ad2681ed2e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141718, "uuid": "d805403a-616d-47ba-bced-08b3a3b6ffa9", "comment": "Malware payload (RedLineStealer)", "value": "668cdc7d5ba68644d6b8e9775d6a8c30e7c4a295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141718, "uuid": "f83788ac-dec5-4d1b-ba1c-c539a965864f", "comment": "Malware payload (RedLineStealer)", "value": "4a03457146f9050fa689ed6d7264a9f95998c6c1c2e128fec46f79aba1002be54c2885aadff9a0ce4d81ccac90224d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141718, "uuid": "99a34578-b54e-4fdb-ba8f-67991f6cffab", "value": "T18A051212ABD864B2DEF817F028FF03830A35FCE39A64539B624A599D48736D5E530367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141718, "uuid": "08f9a42d-59fa-42eb-8ea8-a7e4cd52a6a0", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141718, "uuid": "aa365a52-c40b-4177-9d23-24a38edb48d6", "value": "24576:QyY9mhDiCesi9yNk/VY08DSTKxiF6Fd4jBg:X3biUNk/VYcQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141718, "uuid": "8906b172-bbb1-447d-ac0f-483f8de3e630", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141718, "uuid": "4c420331-fe98-494a-aeb1-cf4f5eb6a919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141718, "uuid": "3ccbe105-b4c2-400b-8bd6-3d23ea4ca230", "value": "5d4346f78393bf04e6fa6d9094e3eec7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e149ded-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137676, "uuid": "1e871dc8-e478-493a-b7fb-107e84920f94", "comment": "Malware payload", "value": "7a1d43aeba2a1d460df31ebd8463ac07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137676, "uuid": "c11566d4-ec16-40d2-ba53-3d853dec89d2", "comment": "Malware payload", "value": "55232ec88f1f24f83153768b6a50e97157c2690184e2f5070bc3a9590a5b0d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137676, "uuid": "5fd64c1c-4d85-4f10-87ea-3a020aeb262d", "comment": "Malware payload", "value": "16d9ac046940d8a0a0130a5051c0e82bf36a5398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137676, "uuid": "d52dc0ac-e52d-4a11-9179-b45d08aef4e6", "comment": "Malware payload", "value": "986aebfadfda0ff91041af10b1ce1b909c1ea816cd785396e57e83dcb817817da3ee181f7483880be1afe040649f406b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137676, "uuid": "225a1eed-d070-49fc-b891-0cfbdd6b7802", "value": "T166D53308E67288A9E2D64FFA4FB3921D497731B14E72419031A982EECF677C3519732D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137676, "uuid": "30f2fd69-ad34-43fa-8467-3b97afd155f1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137676, "uuid": "9be5ebad-3745-4312-872d-7f8a5e4462ed", "value": "49152:/2zT/j0AG7BmgYBf/ZkYDXAOcLxAcEUc965WZZSmTE7LXMUHsH0V0XM:enj0JVm/peYDXAOcVARUygeZSmTEXlHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137676, "uuid": "c103107b-e95d-4a70-8ec5-5042914de9e1", "value": 2901238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137676, "uuid": "a234e044-bc6c-40ee-a90d-f84eef5cb705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137676, "uuid": "871cf779-0809-47d9-9143-967eb0954926", "value": "SecuriteInfo.com.FileRepMalware.25619.15433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07ddefe-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1682160792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160792, "uuid": "bb8cfebf-f9dc-4fa0-aa93-eb463bed60b0", "comment": "Malware payload (Socelars)", "value": "492717ebebb6b8ec588f891312af2dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160792, "uuid": "b08c142d-42a7-40b6-a0e2-0216f35388c0", "comment": "Malware payload (Socelars)", "value": "578b735db80b086f0455a4d70f83cdc96d5f316885cead5b8241415dbb0672bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160792, "uuid": "fe07a5d6-955a-4f6d-97cf-5ed9f21df169", "comment": "Malware payload (Socelars)", "value": "8784cbf2a9552ca95c03a432625b4069a2a391e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160792, "uuid": "ac5bce06-6cd2-4984-961c-ce23952bf683", "comment": "Malware payload (Socelars)", "value": "4b3be34b36a2f35b39e14d5114c58ca6dc234b989d4c5044f398df60c2db71fd6c5a1db5463d1b9e31176a78ead6cee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160792, "uuid": "0f5d83c5-de70-4b4d-b750-ff0c0e7388c1", "value": "T173658D21F7C26032E8E310B745FF6ABF9D2C6A11470894D7D3C81C999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160792, "uuid": "abfd81dd-8f31-4ad1-806d-b45724d478f3", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160792, "uuid": "9b0f6752-8a70-4353-bef9-59c59f2e8b77", "value": "24576:iGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRfX5hVS2:xpEUIvU0N9jkpjweXt77v533", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160792, "uuid": "5d9d6e3e-3799-4e68-83ef-e815f82b295e", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160792, "uuid": "4ea5784c-aca5-454b-90fd-6bebbab4a8f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160792, "uuid": "d5a1b7d6-ea85-4230-a790-75a024067153", "value": "492717ebebb6b8ec588f891312af2dac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4cf6cf-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137669, "uuid": "92dfb125-a13f-4a35-8bed-fd3aa64591f2", "comment": "Malware payload", "value": "5993ece7821672beaaa555de896e3909", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137669, "uuid": "91b2680a-769e-45cf-ad4e-34f9367e5fc2", "comment": "Malware payload", "value": "580226351f15d0f98c4f59f3bc368cd99f83b9c9ceaee21e01f084022813eacc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137669, "uuid": "004c5ef4-d2e2-4848-94e6-ab5c379471c3", "comment": "Malware payload", "value": "0c3b10422ee08fc12b24c62de48dc45a812854eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137669, "uuid": "405ffc84-06dd-4641-b4a0-f7be4e703bdf", "comment": "Malware payload", "value": "96f475b5ae293359b7263c0c9569c6d68b99e88b905e379dea009dd431bc1e906ed5077b3ced04b8cad3c9b6206d005a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137669, "uuid": "fd9de7b4-11ee-40a0-a521-bc8e027620e9", "value": "T1D74317C63625A112DDAA9AF545C2862AABB3F940A573CF13113CD3776F8774029C1A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137669, "uuid": "0decaa00-a93a-4232-ae12-24ca80b88375", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137669, "uuid": "7159e9a1-bd54-4d58-9d6a-63337c613151", "value": "768:odKVoSyxH33PyGaEVDTOsNpgw3wIcAlJCP5ym5xi1yi1yiY:6D/y9E1TOsR3lJ6Li1yi1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137669, "uuid": "22a96993-b2be-4d17-951d-49d7e3fe28b8", "value": 56608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137669, "uuid": "782b5195-47ae-4d38-b3bd-cec3d6bf2ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137669, "uuid": "26d783e5-6c80-4cf8-8be6-a70c47ede116", "value": "SecuriteInfo.com.Program.Unwanted.4695.3455.32757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55eb1e6-e0a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682125179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125179, "uuid": "ae42a02c-d2f5-4465-8cbf-e168bd790fd7", "comment": "Malware payload (Smoke Loader)", "value": "20b097376ceeb9615515cd3052d2160e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125179, "uuid": "6cbdb435-1770-45a7-b827-44d3a9c795c9", "comment": "Malware payload (Smoke Loader)", "value": "58ac415968f877b6b6442785da0986292d6084ad8561ee60bf41fb7ce9df02e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125179, "uuid": "9c8ed78f-dcee-419f-b6fe-b585089fbae9", "comment": "Malware payload (Smoke Loader)", "value": "adeb2daaef23862c277c069149b644097938ca0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125179, "uuid": "fd22ec4d-93a8-45a2-a40a-d5481a4061f0", "comment": "Malware payload (Smoke Loader)", "value": "2e69b21f95bb3e7f114a7afd5e9e16474856acb8af33aad29600ee51f50469220d845dcd747f2f85426d679d9053f9b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125179, "uuid": "bffb587e-0bfc-4f7d-9425-e5b87a008e60", "value": "T11744E11276E1D4B2E9AB46B05430CAF46E3FFD624755C19B72186BEB3D313808AB7316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125179, "uuid": "82bc83b3-ebb0-4240-9cd5-99266504e358", "value": "c2613217b278bbf906136c8e0c29af3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125179, "uuid": "7fa9e99a-53b9-40e6-8ff4-e0eef013ce49", "value": "3072:BSUv4tbpgx11/GE4jUEsDuxDSNhnRtMsbNPSjK5XZzqIFhZOpV:sUvnrxGE4gEwpNhnRtMsJPDZzzYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682125179, "uuid": "728050fe-ade6-4052-ba47-e4ba7bdd8b6d", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682125179, "uuid": "86266d43-5195-4605-97bf-b19f4037022c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125179, "uuid": "98724c79-0a8f-4116-b7fa-2737be8a98a0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1b1d12-e0f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682156275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156275, "uuid": "25367582-f850-42b9-9670-7d6967c8726a", "comment": "Malware payload (Amadey)", "value": "4432905642edacb5445239b965125155", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156275, "uuid": "ba2522d3-d6c8-476a-ab35-dfe6d880efbd", "comment": "Malware payload (Amadey)", "value": "58cfd9a7920ddd273b36b24eaa22e16228e730772c86e26e1a989c72bda442d6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156275, "uuid": "5ea6ae5b-971c-498c-a0ff-083e3eb97812", "comment": "Malware payload (Amadey)", "value": "f6e5c0817d6798777e593d21a908ba3ef2e50f27", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156275, "uuid": "c5d4e5a7-8746-43bd-847f-14326d8faebe", "comment": "Malware payload (Amadey)", "value": "0551046989e39f0e4c3f741844cfd96f6487601e2561a477db89db9616192dd4e4732b4b04e7e6b3ecd68b6b9ee0becf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156275, "uuid": "92d1144c-a16b-4958-8175-b11cf55b0c7a", "value": "T12B252202B3E984B2EDB507B108F692D71B38FC965B7487E732105E8E6CB2191B735762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156275, "uuid": "5b910c71-78b9-49ea-a5ee-db668e3b18fc", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156275, "uuid": "055d53e7-9b11-4704-9f75-36aa538a8003", "value": "24576:LyeOUFdGEtJAOGqjYoSZoqto2EPXoRLi:+eOUFcEzGOYoyBE/oRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682156275, "uuid": "a9917548-b42f-4cf7-9c4e-a619284894f1", "value": 1043968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682156275, "uuid": "c6eb19c6-79f0-4a6f-9a49-653ef3a8370a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156275, "uuid": "de77b4bb-4648-4b09-81c4-7b49b7a7cfb6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851950d2-e0f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682157632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157632, "uuid": "1e7c32a8-c3d7-4c22-904e-b52b6e566a66", "comment": "Malware payload (RedLineStealer)", "value": "202bacb665c3227e40cb29802457d6db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157632, "uuid": "462aaab7-aa03-4c1e-a455-ac63afff4e99", "comment": "Malware payload (RedLineStealer)", "value": "5b0eb4f3999ef201c157872e04d9e0344508a548d92f4517cdfc067e0eb98086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157632, "uuid": "c4f527d8-1735-4caf-8645-dde86936920f", "comment": "Malware payload (RedLineStealer)", "value": "82f08326ea6c46637efd61b6642b0051df094b7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157632, "uuid": "6153ef33-96cc-4149-9bd9-6cf4eb0a937e", "comment": "Malware payload (RedLineStealer)", "value": "b1a22a66299e42876697785c3eb548e0c91852b1c0de33638fc6cca0b2568966be35d35c59d9ca4d14746fbcb1c56101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157632, "uuid": "a766849f-9905-4e63-852b-ddc24c531640", "value": "T1C8F42223AAD88033CCF257B058FA12430B31BD689F69D3A7A6555C9A4C73AC5D53237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157632, "uuid": "f23eb5fb-7df7-4245-9503-733260547bcf", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157632, "uuid": "fa91c98b-3a1f-44ad-b8fa-6ba668d27c79", "value": "12288:Fy90LJKW3mopVKgiImHEQM5/GtdmuOhztC1h4p70tRraU:FyqKW3mOVSImH2+euOhU/g70bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682157632, "uuid": "e02e7698-32d2-4595-ac06-b490dfd132c6", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682157632, "uuid": "f240677f-8532-4edf-ae49-ac66b3cfcdc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157632, "uuid": "1e8683a0-9fdd-45f7-a672-b49854a569ea", "value": "202bacb665c3227e40cb29802457d6db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd67fa06-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135447, "uuid": "b55cb312-1c3a-4f17-be40-97593f8a31d5", "comment": "Malware payload", "value": "d2623fa5d0ce3b4746b1803caed0fdf6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135447, "uuid": "a6a3b2f5-5e9f-416e-b9f3-d5feff1a9f2f", "comment": "Malware payload", "value": "5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135447, "uuid": "25b96acc-61a2-4205-bc3b-d3ca69e0a904", "comment": "Malware payload", "value": "339883e34e0cbc23f4c7a6ddb2376b420066fa1f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135447, "uuid": "14d1cc85-72eb-4fcd-8738-386b340e3a0a", "comment": "Malware payload", "value": "fbb2905bf7092bb6f5e0d8db047a22179cd354e276724e00204ad96281ebd0563f4977067c6a934e8a89e79ee6207c29", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135447, "uuid": "b824c54b-1e61-4eb4-9df6-1b0f2ac7612f", "value": "T1DAB2E70977FA5A39F6FF2F785CB251506775B853EC3EC75D188A004D0923B8C8AA1B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135447, "uuid": "9f1886a4-6ce7-417b-9342-501957b057a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135447, "uuid": "70a094b9-6fa6-4009-83cd-6f7ff40843f5", "value": "384:a3MLWHn3kI3fcSxlR2WpOYsBNakQJgr91Czxb5fe6uaVyZK:+n3kIE69pCYgr9ixbZe6PVyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135447, "uuid": "ff75d533-5ab2-4698-95c9-6a0248a792ce", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135447, "uuid": "c8614e9f-3ac0-469d-9bce-137c0fcaab1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135447, "uuid": "48edd15a-2175-42c2-b999-2e9595dbca71", "value": "2023-04-21_d2623fa5d0ce3b4746b1803caed0fdf6_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261e54bc-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137716, "uuid": "afadb509-bc83-472e-bc91-1c2a26812352", "comment": "Malware payload", "value": "0d334a4dcb30cdd2f5d509dc01abacfa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137716, "uuid": "6f6fba69-18db-4020-855d-77e980f53931", "comment": "Malware payload", "value": "5b969c2a5999e5b712a8ec4944c729638fa620690d558442b46ec1583b6dc358", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137716, "uuid": "eb03d93c-4d69-40f9-a2e3-342d2d7ae7c9", "comment": "Malware payload", "value": "2a21fe673557f15aa64b28f1fc8aa6f438b49359", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137716, "uuid": "af80cca6-0292-4e1c-8a67-d8fca9944ae2", "comment": "Malware payload", "value": "1a1414566209667aea667dded07126bc2d8c849239f5e02af676616f2fbd9473d02d83c6e3343e706c4cc0f4b067e6e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137716, "uuid": "cd03cb65-a61f-4b3b-9a6a-854a62c7477c", "value": "T140430B2139DC3476F9637AF69FCED26EC716B2D4A643C6BF509A928322C0A447723434", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137716, "uuid": "67dbcabf-d75c-456d-a449-77addbe83c68", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137716, "uuid": "7437cc9b-032f-43b8-8d4a-01533410acbd", "value": "1536:MOfcj1/YdYzydz+ChJ1bnHOymmEYofXKeai1gi1c:UU7eai1gi1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137716, "uuid": "b51476d3-3f7a-4187-a0dc-6a7e2cb77963", "value": 56608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137716, "uuid": "d5cd8f1b-7b65-46cc-9db6-fb1385be4394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137716, "uuid": "3da00bbc-795a-4de9-99e6-93c32e29e125", "value": "SecuriteInfo.com.Program.Unwanted.4695.14058.29607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a350b75d-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682160689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160689, "uuid": "59c91de1-a3e4-41b7-af1a-61b8befa5c79", "comment": "Malware payload (RemcosRAT)", "value": "39e34599c3a6d780ce53a40edcd410b0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160689, "uuid": "76aebcd4-54f5-48c1-9ef5-ab33cabd6273", "comment": "Malware payload (RemcosRAT)", "value": "5bead06b0713ddd5f4847fdf85910029870f33aec2f7793062a5691c520efa19", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160689, "uuid": "a2732ab2-34f8-4556-9b66-6c100a4cce47", "comment": "Malware payload (RemcosRAT)", "value": "b713d184087510573eb8aca77caab3b65e8bb148", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160689, "uuid": "12f961c2-5f7d-42a1-ac7c-5a4d5dfedf7c", "comment": "Malware payload (RemcosRAT)", "value": "d6b1eb4c9770e745098e683cbb71a0e6df7b2a0238557c32f2446119279bc7b57330f1bf3ab97a333896dc7f7fa597ab", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160689, "uuid": "5e618fec-c348-48bd-b390-48a7cec3ee4e", "value": "T1B2A549343DEA501AB173EFAA8BE479D6DA2FB7733B07645A1051038A4B23981DDC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160689, "uuid": "eb5906aa-eab9-4244-904c-21a14ea15d85", "value": "24576:qOe3D+jXMuQnj0fUc+56hXwnp8MwlH3IeuerhiRAqnY:C3mXaj/Lt/0uiER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160689, "uuid": "fc48daac-485b-4d8f-9256-90e41dd16cc7", "value": 2151936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160689, "uuid": "dc19301f-5380-4ddd-ab8b-2c05d69dbd00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160689, "uuid": "d9e66141-aa89-4b28-8ae4-405b8dc37d1f", "value": "DHL_MS-WORD_881220128163_10TD01_20230128_173666 Docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fbf1c4-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137719, "uuid": "c745c95a-e066-49dc-b134-d25c7c47e4d2", "comment": "Malware payload", "value": "34ed8f915ce9c37dc9c9fde7f86b934c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137719, "uuid": "ee66330a-8620-4891-90ca-631e7e0b61ee", "comment": "Malware payload", "value": "5d1128b60c85b72e1aa050679d955e4dedd62b93caa3c1d2871df5fe2bd16d1e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137719, "uuid": "321d3898-af3d-4b62-b36d-64be046e571b", "comment": "Malware payload", "value": "59815a742dc814dc1f7ea1a542aa726ef64bdb60", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137719, "uuid": "501c915f-2e29-40e7-9a22-e1d3641c494e", "comment": "Malware payload", "value": "a331ff4d313e6c07a823c162ac88cb88c879d42ed198d4853e240158c2bb33de1dd6fc534e82d2ed6e9ecdcd05044e83", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137719, "uuid": "1e586c7a-b0ca-4843-a07b-a0b74dd72055", "value": "T184544C6533ED1A4AE2FFA778F8B0164187B0F8964627D30D7CC160DE5C26B80A963767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137719, "uuid": "2f46e383-b8dc-4181-a898-e83fff343d01", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137719, "uuid": "745ee491-ec13-4d01-b871-2a430fb98ba6", "value": "6144:+jM6Mb15iJrFxrFPs2FNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchF9:+j0h56rtFNFaFeFOFwcGF6cmFWc0FWcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137719, "uuid": "fafa150e-b7d0-4c6d-9fae-fa6dd5846ca0", "value": 290080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137719, "uuid": "84e357bb-40b5-4020-88c5-5afc08f5c1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137719, "uuid": "b3a1c2f6-ed4a-4008-b231-ee8ff58d6a0d", "value": "SecuriteInfo.com.Program.Unwanted.4695.28276.24959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbff7b9-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137484, "uuid": "c23f315e-27a8-4df2-a1f5-106cd4813863", "comment": "Malware payload (Mirai)", "value": "6eb364fe6bd4b13f8fad1f824cd081c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137484, "uuid": "89340211-7534-4dd8-87c1-041c98636a88", "comment": "Malware payload (Mirai)", "value": "5d85239e1f679e546ff203759f6a1055cf78044839fa1231347d3f2e78c841fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137484, "uuid": "f944ee76-c878-4d2a-9d43-2e8c344bd8f3", "comment": "Malware payload (Mirai)", "value": "fcd5d08398cdd10f4c93708705f4f993be48b2dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137484, "uuid": "9a954d3f-e53c-467c-a402-c1c5a0825a5c", "comment": "Malware payload (Mirai)", "value": "df8e5be13ba1ffa06da9556ca6c20d7cbdf8dcfc777e15ddda3de342964e347ec65930a9491c5710d7417520ea7db879", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137484, "uuid": "61df23c1-0a97-495a-bd77-dab0fb9333cc", "value": "T123632992BC819A02CAD423B6FE5E51DE331613D9D2EA7207AD15AF2037CBD1B0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137484, "uuid": "c5bf3dc1-9786-43cd-8be3-cab0ede7c175", "value": "1536:saitzDqNWCyCRscNbjVk7wqHpyn1uC7sUHm7vb:sa6WNWQ2Fk0Q1rJCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137484, "uuid": "2630b6a2-51ed-4877-bc32-a8d5fdc465ad", "value": 72020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137484, "uuid": "1f32b177-f910-4077-9cdd-b6e4ec58f025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137484, "uuid": "447ceae5-8634-4dcf-bbdb-932e1a6ed9e0", "value": "6eb364fe6bd4b13f8fad1f824cd081c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb39c523-e0d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682143228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143228, "uuid": "e6da46d0-a2c1-44f6-853c-7a62722f93ab", "comment": "Malware payload (Amadey)", "value": "f0976aa785f72d90ffa2686609d171ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143228, "uuid": "4c04a203-f1cd-4d36-a7b3-67810b7f0356", "comment": "Malware payload (Amadey)", "value": "5e236758fe65d4c618a6dff6fb331c6f9ddb0a978a2463157874cc6b5f78757d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143228, "uuid": "9daae20b-fcec-443d-b2f5-3da56a0bfb7c", "comment": "Malware payload (Amadey)", "value": "6b6ef8119e6b1ddd493c68f6feb978e994ff4ce1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143228, "uuid": "781be6f8-acc8-45ba-a926-c69a80eb12b2", "comment": "Malware payload (Amadey)", "value": "bad0adb2bb47f1457801ee513b64f1649e17f07979af167ceb9f5790acee1ce91f4df80d365c2750f5becb67787fed4d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143228, "uuid": "27c223eb-67d3-4287-9945-385c2632c074", "value": "T1D7252306B2E84573DDF9577025FA46830A35BC604B7883EF5FC694A99C73288A4713BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143228, "uuid": "4dda6328-c349-41cb-8197-fded7e3d9dc1", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143228, "uuid": "ab6139b2-875a-4b7c-a71f-664e73e4da92", "value": "24576:vyXMwUafjyu097rD3Hg24H9p9k79FeBMBLfFPnP:6XLzfuu05D3g24dptS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682143228, "uuid": "5b8261b4-e8fb-4eba-b973-c45e93262c01", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682143228, "uuid": "a7d1b671-53da-4b2c-b7ba-61802afe7265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143228, "uuid": "4604e7ba-c917-4595-b829-3279bc58914d", "value": "f0976aa785f72d90ffa2686609d171ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3318e6-e0ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1682162557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162557, "uuid": "285a9c33-ab24-4a7e-bbe5-97e9e43bd772", "comment": "Malware payload (njrat)", "value": "c706ad4e044de5c9be0a9aaf7c61e5ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162557, "uuid": "f6be0ecd-a003-4cc0-b88e-13caee90fc61", "comment": "Malware payload (njrat)", "value": "5e94a74b1013c6e48790f3ca7129d1b48f819b69cb87db49a2e794e60e38eb03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162557, "uuid": "1c356100-4702-492c-b775-81fd737038f9", "comment": "Malware payload (njrat)", "value": "024af69e21ff292872a0ab51d3ad221a78ebcf95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162557, "uuid": "f4a5dc71-7b43-4b17-9d61-0cd3d0708d0c", "comment": "Malware payload (njrat)", "value": "1221c38864fa065b65b88fbb663f947cdfbe73cc0b39a05b34d0382ab144f52c9907b140100eb113677b635ff2db332b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162557, "uuid": "a650091a-c407-4d3b-8f58-434ff7ca1466", "value": "T1482492951C8EF484D1268732D7E7D163D1F6BE6CEAB5C5062BA31F0CD2ED05628C38A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162557, "uuid": "15f6cd7f-5afb-4a5b-860a-04604cef0247", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162557, "uuid": "ae40bc56-b65b-49cd-986e-089f17ce285d", "value": "3072:xq3J49+GHLfVRaShM/tgu1tE7rGaNT2O5YQEesloexhFalh3ARrNr9N:xuiLfuFaG+j6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682162557, "uuid": "4ad763b6-3c1c-4287-b6ca-401928fab2d7", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682162557, "uuid": "1c0c0109-dfec-4b43-8440-ddc4200f9e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162557, "uuid": "629feacc-4497-4b47-9008-e71839e47e45", "value": "1111_decrypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0203233-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137518, "uuid": "8b89cc24-12cf-4638-8f2d-d8049fc69b0c", "comment": "Malware payload (Mirai)", "value": "b6fb4e8dce8e37d8b26858f5a39b69d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137518, "uuid": "ed48cf3b-0d96-4b36-a50b-a32b46be0388", "comment": "Malware payload (Mirai)", "value": "5fb7f0e6131de7fa842353823a590727ef45d1b3fba0de24eeed5f148ba7bd37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137518, "uuid": "0e718426-7714-4496-b39e-03535b7352a9", "comment": "Malware payload (Mirai)", "value": "e2a8c86209753f1b32d8031602041848d9bc13e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137518, "uuid": "b8e37f0e-5c67-4167-85be-a66a842a9631", "comment": "Malware payload (Mirai)", "value": "406cd4dd9a8e7e0bb781625b8d0570e9042335034b6a0f95214a4a8deab6195cb47cb31dab3ea2a9a57f6bb82ec4113f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137518, "uuid": "b28ea751-8b54-4864-95fd-c172f5556685", "value": "T1E2732ADAB800DEBCF40ADAB68557490BF531A3518E930F36662BFD837D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137518, "uuid": "a3bb633c-5edf-4183-a69c-67ca08c938f7", "value": "1536:awW0PKt9cwxjQ/neXIdZzN3RD8Utia84GLf84Eo5WOK+7c4R6yN:awsg3dZzNRFtijjESWBryN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137518, "uuid": "a120eb8d-404f-4a14-924b-051cb88dd116", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137518, "uuid": "dd05fa14-7a5a-4b27-be39-865ebc177403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137518, "uuid": "de7ac6ad-7a72-4320-84f8-b0e38a38fc4b", "value": "b6fb4e8dce8e37d8b26858f5a39b69d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d131c27c-e114-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682171504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171504, "uuid": "09c721a5-f999-4d0c-bd9f-80aab94f3e69", "comment": "Malware payload", "value": "39d1ff164ecb4c1955bb2abac65d8f59", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171504, "uuid": "58c44381-f43b-4035-a8ba-0c7bce069d6c", "comment": "Malware payload", "value": "62162f6b317efd6e0490bed8ca7e1988990df6dabe7f649ac1351482335c382b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171504, "uuid": "1ff57a52-0b4b-4c8e-8a17-b610c595db18", "comment": "Malware payload", "value": "eb9178da092c98dd8bbc5270c48f138214dd6246", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171504, "uuid": "2033eda1-e364-421d-a1e7-4a1007dd9389", "comment": "Malware payload", "value": "4f724913cd726535bfc09c76597b8447c11fa651541daaa5dd08122e9bb15554d8b2231bbc71884a1c4bd13c37d70117", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171504, "uuid": "46d4f254-5de9-4b64-a36b-3efdd9a49227", "value": "T11965D021FBC76132D96A017C297B76700E39ACE1196CF52BEBC4721E2D712D06335A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171504, "uuid": "4f64e46e-2fda-41ef-a9ca-c798279fa2fb", "value": "24576:pKvOxtwYXuB8CGiuN5x5szaQ4dQbcwOVARfl9VyT0:pKvEt/uB1G1LtQ4dQtVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682171504, "uuid": "f2918e2f-4c6f-4f08-a77f-fa99e9ed853b", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682171504, "uuid": "d0c67c81-cd68-4332-807f-7bb545fc29cb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171504, "uuid": "fe0cd5ca-4479-4f29-b2c0-099e87022041", "value": "Google AI Marketing.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc726749-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137646, "uuid": "6911d5be-e5ef-45dc-ba32-3dece4fc0056", "comment": "Malware payload", "value": "6ba7b9fb57c0d2592b866ddb8bcda6a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137646, "uuid": "27b5b95c-572f-48cf-a392-82afa21b7c3c", "comment": "Malware payload", "value": "6228135a56728c543017d2828e90186970df22898196f5c701a19c3a3d093607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137646, "uuid": "049cc8ed-015d-48b9-be2a-19bbf3cd4320", "comment": "Malware payload", "value": "bf3ef5c2a586c5b33272597ec76f5642d1282903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137646, "uuid": "9cf0a51b-a7f4-46d8-a166-a8d9d3b1b622", "comment": "Malware payload", "value": "4af72db5b4c5ac68c0806f10d1d16ef8683ddc06dbe1d29e528224ae66654d776ec264019e12bd918562e00dca1f0bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137646, "uuid": "3a3b7ad4-1dd6-4e65-913f-97a6048d717d", "value": "T12F823BC60F156513EEC78E71A2DAD356BE71F3D0DA8685AF20AE82C16DC17A0374812E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137646, "uuid": "81312a94-6863-4821-aad0-06189393f378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137646, "uuid": "86ebe02d-2c04-4592-aa65-b9d547515f84", "value": "192:7xnt1xfcDh/YctAzlJlRzqLnYe+PjPaiSsFc4watQSUwiSsFc4wzzm7bjuu3:7xN49DA/MnYPLaiSKTDiSK5iu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137646, "uuid": "7fe17d0f-361c-42f0-811d-107c23598594", "value": 18208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137646, "uuid": "5f45ea92-7cfb-47bc-9a96-fdf335e00216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137646, "uuid": "2dcb7c31-0d2c-4f4f-8e63-4ce9b200369c", "value": "SecuriteInfo.com.Program.Unwanted.4695.9494.15628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f940458-e0de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1682148013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148013, "uuid": "1e0296c0-6388-4b84-bf07-d1459e91eea1", "comment": "Malware payload (Chaos)", "value": "a185344dc520fa3307fb98f301852994", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148013, "uuid": "637be236-cc1e-4fb0-935e-e614a761b15d", "comment": "Malware payload (Chaos)", "value": "62be6c481cb811125099e3d377ef87438786d9506ef02f0d3c18dbcdc7f869f3", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148013, "uuid": "46f89ebe-03af-4b33-8dc6-d744c0d15838", "comment": "Malware payload (Chaos)", "value": "1151c4eb10c6aa24356416bd8f55a766d823c4a4", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148013, "uuid": "d5592604-05d1-44d0-9c97-fe276e3460e7", "comment": "Malware payload (Chaos)", "value": "e453338c3b1feb8f0a8f9b90000f431509e6b8687d1653c061c1c05ea7f4adb424e65b6026d1a61fd4be107f91b80f1a", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148013, "uuid": "691a1c96-1611-407a-85bb-cc59dfc75064", "value": "T1F1A2E708B7FA9A39F6FE1E7C69B251110775B90BEC1ED7492CCE40491C22B8CCE506A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148013, "uuid": "1aaaae58-7851-4528-8e6d-cf8406724107", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148013, "uuid": "b2d9db5f-4523-45f3-95c5-556589864000", "value": "384:Z3MLWHn3kIkfdw6mpOsbW+AfrJDr91CrqweC:Zn3kI6mpzCdDr9S9eC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682148013, "uuid": "8cef2b5c-3a6d-44f1-9d0d-c32853756f9c", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682148013, "uuid": "2bc21ac0-d020-4d6d-ad6d-2df8a13244aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148013, "uuid": "0dbb3cd7-ee66-4326-9794-b3b596133a24", "value": "2023-04-19_a185344dc520fa3307fb98f301852994_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb42a4b0-e0a9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682125618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125618, "uuid": "ebf4063e-e0b0-406d-8c94-49ba53a3785e", "comment": "Malware payload", "value": "5097864cd52044cbdfa58a285584a78e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125618, "uuid": "b5397a80-b148-49c1-bfe1-7506b79fc360", "comment": "Malware payload", "value": "6529401bd18baaa7666ac93568a0f729eb5ac129ad7df7156fc48f3e1d697609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125618, "uuid": "b9bdf67b-035e-4b74-89ad-d6512c22f5f5", "comment": "Malware payload", "value": "605bc1cd0a166ddff86216ac884cd3cb7b1ae007", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125618, "uuid": "7033f44c-5ebc-41a3-a570-ffc20f21d063", "comment": "Malware payload", "value": "a6a355d0bd64fc6cb35b1f55679b22f8758a9609f21bfc4e8af71139c1e864ab1e9970e12a498391e13ddeaf66fc148c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125618, "uuid": "42ae4196-e4be-4075-90e2-8263d2f6c601", "value": "T127F56C0437F85E27E1FBE67796B1041267F1FC1AB363E72B2281AB791D57B4048026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125618, "uuid": "170636ee-2dfb-41b4-bf52-8f9ea8f0ef0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125618, "uuid": "8842f2be-93a6-45cf-be68-288a17e08a56", "value": "49152:4vjlL26AaNeWgPhlmVqvMQ7XSKIgRJ6YbR3LoGdcuTHHB72eh2NT6:4vZL26AaNeWgPhlmVqkQ7XSKIgRJ6yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682125618, "uuid": "7c2ff2f2-4b5f-456b-ba7d-b7074582bc4a", "value": 3380224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682125618, "uuid": "f9777698-61de-4f10-baff-8c6c22b18896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125618, "uuid": "4de07f29-6fa1-4a04-b199-507034585685", "value": "Synapse Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6d4f82-e0cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682141725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141725, "uuid": "a9e96211-02c9-499b-958a-a164e56a4550", "comment": "Malware payload (Amadey)", "value": "70984e31b61fdaf880e8ca091ad20fe8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141725, "uuid": "7e394cb3-b8fb-42cd-9257-1204b9660748", "comment": "Malware payload (Amadey)", "value": "665c026ca796efb427f2b00bc9f7b01db3a41620a0fb56bf5635195218aa10bf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141725, "uuid": "922bd52c-78d8-454d-a47f-6f78cdda3a09", "comment": "Malware payload (Amadey)", "value": "013ee5e70f0d65dcdaf4db10b7ae7aac9d63abf3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141725, "uuid": "b6ed7923-7d91-4f09-99ed-fc66927f19c7", "comment": "Malware payload (Amadey)", "value": "998ca59e4495a150c02e4a403a74542f771c26dec15bcb9cc95de1b98f8a7e545fe2218474c4615366c649d9afcf4458", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141725, "uuid": "0f8a6ea1-57ea-4dc6-9218-d1f0fe17db2f", "value": "T1D1252347A2D91531DCB517B455B212C70A36BDB2AE7883AF2FC6A1091C732D4EA3437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141725, "uuid": "5e2e21fe-7a18-4336-bfaf-0b9dbec3ffe9", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141725, "uuid": "ab42a17c-193a-4724-8863-64e8f5e6ebaa", "value": "12288:Sy90X9TOHUmno/Sf6ICjoeO0QI+CSnh5qjSboTs96tSRjAZJNg0BNjRMpchKRQd:SyiU8LO0QHh5qjBo9eSqZgG9RMpaKR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141725, "uuid": "0ba7d8ae-2fb7-47d9-a429-d1a5ef66a69b", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141725, "uuid": "25d4471a-682f-43cb-9e8f-7fc63a5413c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141725, "uuid": "61b73f29-87a6-4e1f-9457-41d8bf50b607", "value": "70984e31b61fdaf880e8ca091ad20fe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6590cb83-e101-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682163163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163163, "uuid": "835f1ba6-02aa-406e-b136-697f6f237cc0", "comment": "Malware payload (Amadey)", "value": "cfe2ef912f30ac9bc36d8686888ca0d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163163, "uuid": "579f44e7-4e93-42b8-873b-cb7c361f095d", "comment": "Malware payload (Amadey)", "value": "675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163163, "uuid": "2a3ecca8-1c90-4a1c-903b-bcc7f28d5fa5", "comment": "Malware payload (Amadey)", "value": "ddbbb63670b2f5bd903dadcff54ff8270825499b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163163, "uuid": "5a45dbae-ffec-4603-9305-1bd8a2d7fc9c", "comment": "Malware payload (Amadey)", "value": "a0da50b99020ae53d6044db3df0d4337db9cf6d7eb08effd3c89d30ba31d9cff59826c463827f86b50037ad5ba938d69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163163, "uuid": "b4fc346c-62c6-4279-99b4-548eeb5817fb", "value": "T144936B1030D2C071D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163163, "uuid": "1b16e426-63e0-4fc2-826e-d81e6edb56d3", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163163, "uuid": "8f3349b3-7b97-4ebc-b0d6-3f64cb9bff03", "value": "1536:Wo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU1eaB89p:WoUCWbBNpplToUs1uNhj25LJUwaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682163163, "uuid": "6ac17799-684c-46b3-a900-4a6fdc2d06df", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682163163, "uuid": "5b87542e-a5d0-40eb-bfa3-4e9adb15a83f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163163, "uuid": "0e1babb3-590c-4282-bed9-8244c4080f41", "value": "cfe2ef912f30ac9bc36d8686888ca0d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981e1888-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137478, "uuid": "370677dd-9b52-4fee-af2c-8fc6096aabef", "comment": "Malware payload (Mirai)", "value": "99c991b7a0b4a50063b9758dc09517a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137478, "uuid": "a268e7e4-d13d-4e6a-bbdb-e4571e04e0ac", "comment": "Malware payload (Mirai)", "value": "695574511920803020117fbb8dae5d998a73e1a17ac52ecb0fdeea7ce66dec92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137478, "uuid": "2024a218-3570-40fa-be49-798c83365bd0", "comment": "Malware payload (Mirai)", "value": "37761767cd8ec41850f6999cbad5d134cda37c83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137478, "uuid": "2a1636bd-a3f2-4d3b-8a45-9ff7347add79", "comment": "Malware payload (Mirai)", "value": "19462b3f18ca9225820e6161b476ecd9066170e5d8dd60acd3e492fdf07b2b5cc7477cea026e0aa6af8c72d262a928a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137478, "uuid": "e9c381f5-269f-483e-aa76-ca2400db0ce0", "value": "T1C5539E63C4641DA4C1544AB0B9288FB61763E60087637FF5426ACBA99057EFCF60A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137478, "uuid": "22cc20d8-6a7c-4bd2-9394-bf58125531be", "value": "1536:oagv1AOp/umClcqseeYYGsYh4wSijKmR7GrxhCKkdV8:ox11KmqspK4HiGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137478, "uuid": "0a4cc880-d32e-4122-bb00-643aeb7f19a7", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137478, "uuid": "15f668b6-5980-4b2a-9f09-308f013fbc86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137478, "uuid": "f463e1ce-c785-48b7-a4d9-f9828e34322b", "value": "99c991b7a0b4a50063b9758dc09517a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca839d7-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137673, "uuid": "47a8eb50-86a9-4a7a-baf7-c6ec398274f6", "comment": "Malware payload", "value": "42b0e23e23515f98b721ca3a41283deb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137673, "uuid": "8930c0fa-cee1-4f72-86be-30897324c490", "comment": "Malware payload", "value": "6a787eb86dd232eedf39988aeff339336b4441ed09d1eb0c8e0d63a43d4e87e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137673, "uuid": "4eae084f-d7e5-47c1-9a3a-678239db36fa", "comment": "Malware payload", "value": "178ce9c11d1f9291c09263b35ad475685d15c7cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137673, "uuid": "907db8ec-505e-48d9-bea1-6c6402b6c193", "comment": "Malware payload", "value": "75d95fd97cca886470fbaaa23525c28b34492591429766d94b5aa90afceecb651c25de86b19391a7ace23c1228b11624", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137673, "uuid": "3b19eaf8-42ce-4366-96dd-29394f80b9fd", "value": "T11543F7152DED3079FA267BB25FC9E6ADA726F3D48387863F306E81431781652375A038", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137673, "uuid": "f6cd1837-3742-48eb-b558-155fc0edcb1c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137673, "uuid": "71cd28c0-0376-4f8a-be3d-79109f5f833b", "value": "768:fQ+HrmF4lK4r78InYlLqv9FkLkn4SrFM+IloBkf6p1whNsE3WYTpYyIVCLvp9d72:fVDBFoBNIlEe3AL+cwOeIQ1vi1mi18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137673, "uuid": "fed7258d-c328-40ba-9978-55f7d58ad71b", "value": 56608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137673, "uuid": "e5df2798-715f-4afa-947f-e3fa5b08ae14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137673, "uuid": "6b473834-3855-4805-b227-8142a8627be8", "value": "SecuriteInfo.com.Program.Unwanted.4695.1253.2445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31339ef-e12b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682181332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682181332, "uuid": "27905dd3-5714-415a-b7da-7c43e24ee24c", "comment": "Malware payload (RedLineStealer)", "value": "3de54b29a9ffd306e372f23a0a3e1815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682181332, "uuid": "fbb3355e-fc26-468e-982a-3876b090689d", "comment": "Malware payload (RedLineStealer)", "value": "6a8680898bde4f22ee3d924c89cbe7477bf1413bd4d701db695f138929fe3a31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682181332, "uuid": "b9aa9d94-ce9d-4656-ac25-8d5922565dbe", "comment": "Malware payload (RedLineStealer)", "value": "89a6d87d64d844b4ad1d31478b8fc906efcc3f21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682181332, "uuid": "dc450597-41d7-4b0a-81d8-12c083e01f2f", "comment": "Malware payload (RedLineStealer)", "value": "8bdb81f7301a4ddbbfe66300d48d71779a41ebc8f7f7c83c8d3bf4d9d530defb944969fe46e03979ab11bee8a13fd763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682181332, "uuid": "a579af71-ceda-4e2e-a14a-81522c083ca3", "value": "T144C41206B6E89432ECF51BB058FB06C30D367CA15BA8479B13815B9E0C736E4A5357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682181332, "uuid": "e1697f06-0ee0-490a-97b2-090e7b3d5f03", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682181332, "uuid": "40824d8f-c6d0-43ce-94a1-dc157a86fbb3", "value": "12288:Yy901lSER/4qdDmSq3nSS5/SyaN4bkF+9qKMVQbBTKojQIPdYD9x:YyQlSEj9mdXFL4w99zNJdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682181332, "uuid": "1ebe06cd-8d1b-4bd8-aec8-d74517563dab", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682181332, "uuid": "ca8aa347-fd83-462d-afe2-074cc203b38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682181332, "uuid": "9ec259f6-d1b3-4e73-b41e-4e072f11ea7f", "value": "3de54b29a9ffd306e372f23a0a3e1815.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4255d4be-e0a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pony)", "timestamp": 1682124020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124020, "uuid": "2988c2bf-4dee-4015-be8a-febd3f81b88f", "comment": "Malware payload (Pony)", "value": "ae2c125e4cba4bf9149a8cb7835db3c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124020, "uuid": "35510d2d-97bd-4d05-91bd-d0ff9e562498", "comment": "Malware payload (Pony)", "value": "6ab6a7d0c2559dc976b5449703adc63647838808564a5b0eddc64d2673d24465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124020, "uuid": "9ea1040f-b1a3-4a7f-9d2b-17ddc376115d", "comment": "Malware payload (Pony)", "value": "9d0290cc7f03896d4a7faa54173bf4c4acf9cc9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124020, "uuid": "c5be5e11-92f8-410d-907a-7127a5a22fcd", "comment": "Malware payload (Pony)", "value": "1e850f1861c05486d11cb44eadd5cd451651846295876eb6b3fef17a119cc9489339ee57f264ba4d9943e9ed47ededa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124020, "uuid": "1797a31f-acbb-4da9-a724-adcdef7a4ea4", "value": "T12934BF03F3579E65C6781934CCEA51A043B9BF9E37339A7C3D9D331999B23126980E98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124020, "uuid": "9d65dfe0-4188-4836-bf3a-5d9a0ff037b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124020, "uuid": "4bf7b6d4-2946-4c99-b430-d0b85927f7d2", "value": "6144:TSLnlItahCJrxj3vSlnS6H1AnytvTs/NyB36QtdVsbicDDm:OLnm4hcrxbOnX6nyRTslyB368e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124020, "uuid": "16e7e047-d8d7-4109-8718-4b811ed8c3a2", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124020, "uuid": "fc562f71-927a-442d-990e-784b055520d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124020, "uuid": "0a3743a9-0260-4141-b5e1-82112b40cda3", "value": "6AB6A7D0C2559DC976B5449703ADC63647838808564A5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec982c4-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682160521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160521, "uuid": "faea7e51-6ccd-43cc-baaa-2619726b0a59", "comment": "Malware payload (SnakeKeylogger)", "value": "b368226109ad406207ac57a622a2f07e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160521, "uuid": "e33b3f59-8ed0-466c-a7dc-8b016edef35a", "comment": "Malware payload (SnakeKeylogger)", "value": "6af15062df2829c894b449217ba7b5282c5815ddd0f7ed113c247808d1074bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160521, "uuid": "afa4e4db-20d2-4f63-a7fe-df0dc25d9da9", "comment": "Malware payload (SnakeKeylogger)", "value": "ead64bf8903df594f9ef61e0a6a6a7f7a96490e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160521, "uuid": "cea77f79-7f3c-46e7-95d0-636c8ec8a096", "comment": "Malware payload (SnakeKeylogger)", "value": "4c1e3eed746f096c1e8cb6ab81193af786d8cd7d350694d954489abb16ce0303e3ac7651812e00b4b170020908b3d3e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160521, "uuid": "359b4349-cb9c-43c7-9a5f-4e559b7840ae", "value": "T1C125F171912ACF29D01F65B4C8166FF44003CE69DC05B3EBA9217E0B797408ABDBDA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160521, "uuid": "9a5b6a39-4096-405a-87f1-4b98d5794499", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160521, "uuid": "2209f338-6faf-4dd1-8560-989764cbc684", "value": "24576:9ZVbXxdWFpXH7QpO4BM0gb5B5bv0X8mm:9HxY7x4BhYJvE8mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160521, "uuid": "5151b753-911f-455c-8741-6895980e5fd4", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160521, "uuid": "ef8a45d8-75c0-4438-8d5f-9c275cdb2365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160521, "uuid": "184bcf41-c190-43af-940e-6e546188812a", "value": "b368226109ad406207ac57a622a2f07e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6540e9-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137723, "uuid": "c4a9512b-0c54-445d-8f5c-af4c514c4f6a", "comment": "Malware payload", "value": "02dc0c329eeb34ad4c2a88f179b00eac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137723, "uuid": "16be071e-2050-4b9b-ad4d-75313e4e93f0", "comment": "Malware payload", "value": "6b46b78cb214984dc682b8a7155dc4dbafde40f2413de71a5aabd7896c0d5464", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137723, "uuid": "1e9da09a-aa35-4e23-98c6-c1722fa68a9b", "comment": "Malware payload", "value": "cecf69935568d7c7c0dbc576aa9db570d451e2ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137723, "uuid": "75edfb45-1811-45e2-9c3b-ded02e8a38a0", "comment": "Malware payload", "value": "2861d2567fcc61ab697a0ecbd6fd143f26051535cb09a57532ce653f867fb961bf8c5b75632ebc08a312707c2366239f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137723, "uuid": "d30d9582-bb09-41a7-a01c-d9a3f529fd01", "value": "T1D29219AE1BD57132FE426D7255C9E26AAA33FDD0EEE6845B106EC1422FC038C7718439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137723, "uuid": "2e6e9fec-8401-44d7-8ce6-b0522425e7e3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137723, "uuid": "9eee5dbd-c4ae-498a-8090-712d3c35f2bf", "value": "384:Vi04koEAj3v5BFmnYPLaiSKn4EXiSKgiKI:Vi04koEQv5BFmxi14yi1giKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137723, "uuid": "27b621f6-9568-4658-be3b-35b91b8f6b66", "value": 19744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137723, "uuid": "6cdcf5a7-4ab0-4ccf-a9c7-fb7a820ceb51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137723, "uuid": "ea675441-437b-417d-bcad-78e06e672f21", "value": "SecuriteInfo.com.Program.Unwanted.4695.15133.16565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c596a56-e0b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682128385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682128385, "uuid": "a28f7038-ab16-4fd6-832d-69e44560a672", "comment": "Malware payload", "value": "ebec1eabb4b5a57b45230566adc8112f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682128385, "uuid": "0aa81701-c981-4427-ae5b-25f39449782e", "comment": "Malware payload", "value": "6d45f102f456a95eaf31e9a1851c031e6fccbc852c8d56e1fc665aea7945579a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682128385, "uuid": "561db1f4-32b9-4d42-b404-30bd27d86f9e", "comment": "Malware payload", "value": "3696b0abe6c1bc95fe6e0c0c5ded20b072f3ace3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682128385, "uuid": "e55f53b4-b166-4b60-bb85-62c4cbd622ef", "comment": "Malware payload", "value": "a19fc2c216bd065408410a590f204863df26247e3bdbdfbdeb4bca21700d197a9736da7b242d166fe8727ba7f6d1d675", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682128385, "uuid": "969e705c-9625-4f5f-9fdb-537846ac8a66", "value": "T1CB148D3CF74D5E67C67D09BAA0D255508330C1A5B78FC38F9C8658F8998ABCB8D4924B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682128385, "uuid": "fd6d1707-a5c3-4a6a-84ed-d14aa8961331", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682128385, "uuid": "33820cd9-1e81-4cf5-86eb-06c8b603f4ab", "value": "3072:G382MSeuOECznzmX36AClWpeS7sk5P1qnLXT8DPf93RABjOd:G3LKzzK6ACNkR0LALxRAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682128385, "uuid": "43eabd69-f5dc-4865-b900-e9460a584627", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682128385, "uuid": "ada1e978-7378-4279-a64c-f6f211a183ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682128385, "uuid": "ac7816fe-612a-4554-8cdb-45cb7b411eab", "value": "ebec1eabb4b5a57b45230566adc8112f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3da6b8-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137674, "uuid": "ae093146-2dd3-45a2-b32f-a8540c372ad5", "comment": "Malware payload", "value": "7bb7d589fcb11a5c25a7ab4cd0434e35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137674, "uuid": "2ef59463-b444-4a2b-850b-2b7719a32fff", "comment": "Malware payload", "value": "6df447cd38837bcf60a1de2bf1fa46f3ffc56232d6897f89f7c29145ef43c68d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137674, "uuid": "ffd372dc-0824-499c-a68d-31593e5c8761", "comment": "Malware payload", "value": "644771a24bcf1f9e411ad75964461fceb1b32a61", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137674, "uuid": "880c2365-8c83-4438-8388-2fd8e1558883", "comment": "Malware payload", "value": "6db0130230cb66c08aa204c8e6895c0177a182e3dbac2282c9783ce7638990874d586dcab4a18f6f11ac17e997ac380e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137674, "uuid": "0aa79a7b-94b6-4da1-b662-cfd5e1a5ee1c", "value": "T1F5436D453BD88716E3FF49B8F9B1D2550972F682F621D39E1CD4819A2DA33904B027BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137674, "uuid": "a3350532-b9bc-4d6f-af34-fbe81bcfd559", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137674, "uuid": "9b88d6ce-0c2a-4d8a-b579-1b59b839cf08", "value": "1536:f3oxzOQHF/HmmBHIJmQAMyXioh/i1oi1L:offmmBQgXi2/i1oi1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137674, "uuid": "950484f2-e336-4232-838c-5035c83c2c25", "value": 59168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137674, "uuid": "3a0dc348-a111-4a96-9cf7-ebedaf162706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137674, "uuid": "53982ea4-66d0-42ef-ab5e-2f94efec6f16", "value": "SecuriteInfo.com.Program.Unwanted.4695.30715.2031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daba2032-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1682160782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160782, "uuid": "6d1633bd-5de1-4a85-b2d4-5c796e7b62ec", "comment": "Malware payload (Formbook)", "value": "4867f67608834325217c6ba4dfe4ff2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160782, "uuid": "4ea7f8dd-0179-4634-9c0e-ee8e8a6c0b2b", "comment": "Malware payload (Formbook)", "value": "6f36dc3fdd643325de052e582d3d42a4b65b0ed900870b245540c397e31404a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160782, "uuid": "8b06b987-7e6d-4693-a90e-ff2a5e496d4f", "comment": "Malware payload (Formbook)", "value": "24ac76d1fa39eab69f71573cfd7f011bef09b5a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160782, "uuid": "cafafac4-5e6c-434f-927b-0f41aa6aab16", "comment": "Malware payload (Formbook)", "value": "a618a6c35c78c7aff10b0a65569970db5b79c1ecaf7435700e7f89f011ab6f1773da675c1d5186fc14fdeba5befe7b62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160782, "uuid": "05f3c4f4-bef6-4ec7-8a9c-f7e9bfac1ef9", "value": "T14FD4F19DA7A5CAFBC5340F7D001A66893F3441E37A26C23DDF9B48AAFA43B045D54683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160782, "uuid": "b0ed5f7c-ed23-4e8b-b597-c07a0c4956ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160782, "uuid": "305cfa05-84af-435b-b376-88aa6d1e1ed3", "value": "12288:MzWhDBvkzkFE0asCT212YfI4QZoByJTEe60Hl9mQ:ZBvkz0E8IlYfsSByNo0HrmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160782, "uuid": "3ad37c0b-899d-413f-9b6c-41e20bfc38c2", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160782, "uuid": "e949179e-3e38-41f3-afe3-7b1802c49b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160782, "uuid": "25f666dd-8cd8-427a-a870-968e68518643", "value": "PO750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f300bbd4-e0e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682149227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682149227, "uuid": "f78e343b-aed9-49b2-bdfc-168ff60cc5c3", "comment": "Malware payload (Amadey)", "value": "ee893bbbeac475213f691879b437e33e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682149227, "uuid": "d7bd8859-18c4-4422-9ced-5b0d1da94180", "comment": "Malware payload (Amadey)", "value": "707fc73f8e6494959b1b33c9f7c582335cda88397a0e7e3822f56ad0354996c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682149227, "uuid": "a13ed48c-c58c-441b-a5a2-f1bbeb6e337f", "comment": "Malware payload (Amadey)", "value": "a066f5e1a4858c323e2ce31d55c4d3e787e4b583", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682149227, "uuid": "7491d774-8833-4d3c-8dbc-ca82aa79db23", "comment": "Malware payload (Amadey)", "value": "64c8649c3671d0967cf95f7fcda34d506f03a9d05d33a40f4431aa911ac1d723f9ebcd4c906ec530af38ce474ef1eef7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682149227, "uuid": "c72ebfec-a1fd-47f1-b46b-74d8f77ef3cb", "value": "T1CA352362E6D84436EC746F70A4F613430E35BDD58BB891B76321BDAA0CB22D4693077A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682149227, "uuid": "35ac4cee-aeea-4b38-8fa4-6f2e9d86e4f6", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682149227, "uuid": "0e578ce6-b327-498a-8a43-ef1efa148234", "value": "24576:Iyko5C2J6jmTD65UrxOSKTgkVcQbroFAOT9FYzWLCbsxc4O:P5fOmv65YwgE5bEFAOT9FPNc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682149227, "uuid": "2ef38274-2da1-4b35-8181-f098e261507f", "value": 1134080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682149227, "uuid": "d32e0cf0-2e0b-4e52-871a-73a18c86be09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682149227, "uuid": "d9c23e80-0dd6-440a-892e-daa7bebcae14", "value": "ee893bbbeac475213f691879b437e33e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c346b5dc-e0ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682141416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141416, "uuid": "071a97cb-80ea-4831-8ad4-8dd068cc09b8", "comment": "Malware payload (RedLineStealer)", "value": "4ef29caf0c1e8639d07f01b5bf74298d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141416, "uuid": "255d2576-b865-4eef-ad0e-3d7b87cc2205", "comment": "Malware payload (RedLineStealer)", "value": "714d00f3bccd74abdf586ed347a36f61e7eebbf44f994b3fd65b38539931b996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141416, "uuid": "426114b7-2662-4f50-8bb5-5269e1235e91", "comment": "Malware payload (RedLineStealer)", "value": "849fe565987460d18626a5afae34c5814c678226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141416, "uuid": "a4a4a29c-c305-457b-99bb-e9a0837c550c", "comment": "Malware payload (RedLineStealer)", "value": "b4b5ee8a0843c2af1a65f441fbf73d76011d3b4ceac834ab7b0bac77863831d61919f8d340850150979eeeafc75a7687", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141416, "uuid": "8785988a-36e8-4618-abed-1d50d45e9f71", "value": "T1C4252223BED854B6EDF80BB028F903830A3DBCE24A75439B630765895DB35D4D4753AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141416, "uuid": "82b72fcf-07c1-45f6-99bb-1b01e1cba778", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141416, "uuid": "f096d872-1d0e-41a7-ab0e-91f5a903ba15", "value": "24576:zyEj53DjkyEX0kUAZUFGloi+6VabiaymrH2uZ:GE13Djk/0hAZU7AM/rW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141416, "uuid": "ccd42cda-7399-4820-ac52-7cedfc62e7f1", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141416, "uuid": "226e4b4f-e894-48d2-b41b-b08499e2b3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141416, "uuid": "9623253c-0fa4-45f5-947e-30641e23d1fc", "value": "4ef29caf0c1e8639d07f01b5bf74298d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b354495a-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137524, "uuid": "549dd7b5-0a52-4ba8-9552-82708bda3341", "comment": "Malware payload (Mirai)", "value": "aca87dca7b1e665cd2ebc5ee2542c0c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137524, "uuid": "c59a0f0b-9c55-4ba9-83e8-ae19d7449d36", "comment": "Malware payload (Mirai)", "value": "72e77d9f5e3faa3c413e1b885a90d36734c93682b163529efa327e612d13ad02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137524, "uuid": "f99ddc54-799c-4df0-8670-d92a63afe3ed", "comment": "Malware payload (Mirai)", "value": "bdb5577c1f4f25d25d110511f940027e4379868e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137524, "uuid": "ac5f9552-5966-4115-a11f-f66781e71303", "comment": "Malware payload (Mirai)", "value": "59cfc62c27057566ba0abb21e06b8846b6505afaa9a87fc5a1dd5391bd69e0ae0064188af1ec771b048322e5e3ea02d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137524, "uuid": "0096dd25-39cd-40d6-b6ee-3ebb86c8666b", "value": "T1A5636B21B8391E27C0E4957A22F7872AB2F9534E24E4862E3E750F8EFF5558076472F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137524, "uuid": "dd4db008-8509-42d3-b5ec-2b4babad4487", "value": "768:IcowEe26GLAhfg+MhN2K1sv11FN1nD3Id1pvYnh3Ei32aJbyqCDSgPoGO+75ZLo0:IcIMlhfgNhNvRYn5VypX75mUotQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137524, "uuid": "755b8707-3099-49aa-9388-1e925e8ade01", "value": 72660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137524, "uuid": "d112333a-e2da-46e4-8158-f540f98cef85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137524, "uuid": "1c925be5-5f01-4759-bef0-40b0d1d2f644", "value": "aca87dca7b1e665cd2ebc5ee2542c0c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918b8304-e112-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682170538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170538, "uuid": "47536bf8-99d5-46e0-af0e-82077e2601a4", "comment": "Malware payload (RedLineStealer)", "value": "1938ce1aa92d85b67b9daae41900b6e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170538, "uuid": "72dfc370-55b6-4d14-9f08-2b408f3e2c9d", "comment": "Malware payload (RedLineStealer)", "value": "73491ad5fbcdb957db4f25383cb7791df5c0f163cabdeeebafadbd332ce84574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170538, "uuid": "622ad18c-39bf-43b3-8ed1-99d847d19114", "comment": "Malware payload (RedLineStealer)", "value": "64c4b5d7221028c081c1148319573334ac543dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170538, "uuid": "dd22f9b1-a5a9-4dbe-ad9f-6bc5385b20a6", "comment": "Malware payload (RedLineStealer)", "value": "ad4eb8a758f480213817c37b0684cf698e8221c53b26948a3b920749a8b0f726e84fb68084889b316038b6e911c2e0bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682170538, "uuid": "f58125ea-3cff-451d-8f9a-0ccb077449dd", "value": "T1DEC41257A7EC5032DCF42BB045FA13832E35BDE1AEB1D6DB3241986A4C726D0A43176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682170538, "uuid": "20d7d4df-c3d4-4ba1-9049-f3f0d16b15e3", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682170538, "uuid": "05eba6ce-c079-4ce4-9bb8-f2200ee6c442", "value": "12288:Wy9024oNGOQpAQnkHBQfdd0XlNO4gx5Cx7iV4vxcitxKsSmYNA4wET:Wyyo8OkGFXiJGxuV4v22YNLwET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682170538, "uuid": "7205b25e-6f51-44f1-ad91-6cc6162c0d81", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682170538, "uuid": "4b939010-60b4-487d-aa5d-aa5a3b802620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682170538, "uuid": "8888b701-e3e5-46c2-85c9-503e58beedbe", "value": "1938ce1aa92d85b67b9daae41900b6e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79549f13-e0cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682141721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141721, "uuid": "b13a0514-b9ec-47c2-ab55-3a6cb94d369c", "comment": "Malware payload (RedLineStealer)", "value": "6e9dba0568a8fcc710a1c553c5a6cf40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141721, "uuid": "be50c97c-14d4-4529-b7ab-fc7d4c1010b9", "comment": "Malware payload (RedLineStealer)", "value": "73d7513761173d099db23a51d75118842c154f8e62d48ca9addfde4b738a417e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141721, "uuid": "1b1427d7-0db5-4045-aca9-812b6e90fb3c", "comment": "Malware payload (RedLineStealer)", "value": "d7fcbb5164bff386a51a5eec375950ef5668576d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141721, "uuid": "8a2986e7-bd73-4b2e-bd9a-c479b2271f10", "comment": "Malware payload (RedLineStealer)", "value": "de358d9d9ea13d997227e64c9869245e0b01d2cfc81bfb576274bf61785d1ba6e16d810f7a125276625c63dac3688eeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141721, "uuid": "2654714b-d5e9-46a1-b9e5-f97c0129390e", "value": "T117252222A7DC9071ECF817B199FE12D30A36BCD65E74A797560A5D8E2C722D4803873B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141721, "uuid": "9c130195-9d6e-43e0-8f78-5afd884702c5", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141721, "uuid": "1229e163-8dc8-4837-9705-ff03f2540341", "value": "24576:RyXPwQviZt3MNjwgqnBRWFl/I+URJFYBM5luMpos8grYH:EX3+t3MBGnDWF/U1YBM5luM6s8gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141721, "uuid": "6e37132a-d1e2-4df7-9733-b2210a566a40", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141721, "uuid": "3ed81340-c69e-4eef-9088-9106e86e902c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141721, "uuid": "bce68102-e983-40fe-a0a9-0519279a2d5a", "value": "6e9dba0568a8fcc710a1c553c5a6cf40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fe290b-e129-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1682180265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682180265, "uuid": "da5ebb60-12ca-4184-b82a-08a674d74b89", "comment": "Malware payload (AgentTesla)", "value": "114601097cd86a128c2569eceb5532f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682180265, "uuid": "d9a7b192-27b1-4d58-a052-ae306226e045", "comment": "Malware payload (AgentTesla)", "value": "744b1046f552bb9b1588050a409000b1f82d708370d650ebfdcce82ff912996d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682180265, "uuid": "944124cc-f9a5-46f5-a443-7f2f5cde4b1d", "comment": "Malware payload (AgentTesla)", "value": "a525e0372f2f51fb007f162950aea5ae31023ce1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682180265, "uuid": "cd661974-933a-487f-bea6-c8dbee926c25", "comment": "Malware payload (AgentTesla)", "value": "f8512d780d661e8504d654971fc0765f604ac9bbadec4584551da766a98b2ca7ecea1e62384d6c65cac5033425409078", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682180265, "uuid": "2d3fb9be-5873-4e79-bb35-b21eabbfe88e", "value": "T1A3C4F1ADA7A5DAB7C52C0FBD401165893F3491E3752AC638DF9B04ADFA87B080DC4687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682180265, "uuid": "8ca6670f-a531-464e-91b9-ba1ae42d5c9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682180265, "uuid": "9a2ec0d6-6831-4511-88cf-a157592f24e0", "value": "12288:NEJOofo5nEwXeH9gWcufMVZS/mXlSpbO9Bv4j/tjzg:NKNfolJmfM7ckGbO34Zjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682180265, "uuid": "11e1098c-54a4-40c9-8109-2a56b1b91796", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682180265, "uuid": "988e04f8-f751-44c7-8691-5b9f509870d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682180265, "uuid": "f3363ad7-1396-4a8d-a97b-367ca13c2eb1", "value": "Quotation and drawing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9994c261-e0a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682124595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124595, "uuid": "3abec02f-d036-43c3-b3ad-4c0831060090", "comment": "Malware payload (Amadey)", "value": "78e6bcfb014090a21a0d70739a187df1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124595, "uuid": "6c69dc32-37c8-4595-84f2-9d28bf02f3f9", "comment": "Malware payload (Amadey)", "value": "7599202b80d402f7559b5d998f6f7bc8f447fc3094fb6d1a37296eeae43f6fe3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124595, "uuid": "eab78571-e928-4948-9693-bb41db212ee9", "comment": "Malware payload (Amadey)", "value": "43da44d969e6631a42498c146cbbb3b4314d008c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124595, "uuid": "8ed6e988-1dfb-4334-830a-e41b0182a979", "comment": "Malware payload (Amadey)", "value": "6b5293226d1bb5a6e68e1365e3ca9ee89ff6ba5905651893de368733d063600febf87acb17579aae1b637303aa24d64e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124595, "uuid": "baa1521d-14ab-4a8b-a108-b884c2a5e5e1", "value": "T1C234C0107DF2D0B3E97B41B56831D6D06A3BBCA55798C66B321CAB9F2D312C09E63325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124595, "uuid": "889fa091-d2cb-49c0-a019-c8f3e132b733", "value": "83f7b03b4e2f4d598c9968669b5cc91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124595, "uuid": "5f9ae6bb-7373-434e-9550-48a7f4a6f11b", "value": "3072:TIqK0M4TLKYtTHacpKbDyOHra2H3m6nJtl/sxfx5XURtOFhZOrV:LdT3THacpsDP9H3mgJPspStoYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124595, "uuid": "749a3431-8b5d-4e7b-aa7a-2a1e791ce489", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124595, "uuid": "8abdeea1-fe16-49ae-9e4c-5b4af4a328d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124595, "uuid": "651b86b0-0581-484f-bca9-2d02b4dd46bd", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3ef154-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137649, "uuid": "0831c69f-5ab5-44ab-a12f-a11067d2d5f0", "comment": "Malware payload", "value": "0403878719524f1a94728a5e55b6cd56", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137649, "uuid": "b2bc19f3-46c9-4915-a06e-f870ad33a533", "comment": "Malware payload", "value": "76c022f5dfeb96ec8a13824842b77b1f4ebb9d2ac9052673e859758793eff4a3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137649, "uuid": "dd279814-5140-47d0-847a-3763ef110698", "comment": "Malware payload", "value": "fd8f15bee5c0089b1e1307c5bb4360699d90ea98", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137649, "uuid": "d55f74a3-044e-46bd-8da8-42b5e2f2cfd9", "comment": "Malware payload", "value": "6aeca8e8f90f6a211b3194b0c7461f82da938f524160b7533feac0c6c369837c2f444e1031ea2f37cc0a120f735b34f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137649, "uuid": "cc0c9193-4c79-4d4b-a84d-d923cae2579e", "value": "T15A843A0653F86111F4FE2738A5B9AC984B72FE4B2E37D39E124059EA1C72F408D25763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137649, "uuid": "e5d34c5c-0c8c-4c5c-a062-b3ed740a65c7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137649, "uuid": "d1a05f5d-aff2-4b6b-8876-dc6b636407a6", "value": "6144:d8ASBEKZNe2+6QfeFlrd+jkg3yX285iS/377gckFMW1zU72JlHwt8p30HQvP:FqlR/xTim3IcI/FvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137649, "uuid": "f783065c-1881-4c0f-bf9f-e7312932a9e5", "value": 406304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137649, "uuid": "f23b4d3b-595f-4f31-b4d0-83a28fa3ef99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137649, "uuid": "aca9c559-98b2-4cc8-810a-a8039fc3ac4e", "value": "SecuriteInfo.com.Program.Unwanted.4695.7031.18090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e10a6f7-e152-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682197832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682197832, "uuid": "f6ac53c9-13ee-400f-9af3-a4cefdfd0ddf", "comment": "Malware payload (RedLineStealer)", "value": "0113a7a2466709fcac2f7b51e986fa38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682197832, "uuid": "4a61c91e-f4e6-43e4-aa9e-aa0ec27bd658", "comment": "Malware payload (RedLineStealer)", "value": "76eccf4cca6091b7dbeb31883ddb2cd8918ad4c6ab0079586d72e1040db8ed7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682197832, "uuid": "b41eba75-ef7e-4377-8f9f-069917cc6cd4", "comment": "Malware payload (RedLineStealer)", "value": "1a58399b704375b3267b4457542acd5ebc54624f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682197832, "uuid": "b9e2d87a-d435-4bf2-bddc-987754f265ac", "comment": "Malware payload (RedLineStealer)", "value": "2efec0d3bf9be27d41187bce237a0f93ac3a0711877bc4aa5bc011431c1ab20d20a8182cf58030a1d7dfc478d96f7ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682197832, "uuid": "f693e43e-8bdb-4dbc-89d0-aca4b0e8f693", "value": "T1F3C41217BAE840A7DDB817705DFA52930A36BC955E28836B3785E98B0C737D0A630377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682197832, "uuid": "3d577420-4c62-4d0f-a7a7-d04924f4e17e", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682197832, "uuid": "aa27c724-2b6f-4b7e-8f26-119e349ce52e", "value": "12288:wy90EJyv/F1K5PuICU6u6eEcG/Wr0TUTYtFY6:wyDJyvd88Pu6jy0kYtG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682197832, "uuid": "2e60cb7a-c3f6-4154-b0b6-f1aa0a993d14", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682197832, "uuid": "df761bf6-c5e9-40cd-b130-aeff8e8654a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682197832, "uuid": "6b0eda22-a53c-416d-8207-f369d709396e", "value": "0113a7a2466709fcac2f7b51e986fa38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c53599-e116-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682172312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172312, "uuid": "6cec5f7a-b06a-414b-8a9d-2b032ef57cae", "comment": "Malware payload", "value": "d84df3a6599833c3f1f18bb42aeeb734", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172312, "uuid": "e3aed33e-852b-4817-9797-1fd9aaac626e", "comment": "Malware payload", "value": "781791ec1035e522c0d47b69123e922be083fee92fede7eb6f1e51fef43bef08", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172312, "uuid": "40414c8f-8746-466d-ab14-6f2ac3b0c60b", "comment": "Malware payload", "value": "5e9e6daec7af24d9087578bb889625f968c9a2b1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172312, "uuid": "fc512212-fab5-476a-9f5d-4dbf80adf1fa", "comment": "Malware payload", "value": "5772a8ad509724adedcb2de659b0b770f3a6e0f4f38ac4eea336e07a6721c44f1395d87736c8aeb83c0185c6116ddff7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172312, "uuid": "02423a65-22d3-4047-b299-393fc9683b10", "value": "T1C765E021FBC76132D96A017C2D7B76700A39ACE1196CF52BEAC4721E2D712D06335B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172312, "uuid": "ff4bc845-34d5-48a0-bd0e-ffbbc9c821e4", "value": "24576:EKXOxtwYXSBdoGiuN5x5szaQ4FQbcwOVARfl9VyT0:EKXEt/SBmG1LtQ4FQtVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682172312, "uuid": "dab4e014-9a5a-4478-9602-6ce916566065", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682172312, "uuid": "be0a3185-7fef-4680-bb90-28b0212fc92c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172312, "uuid": "f43fc0a7-6ac0-44a6-8036-5db77ed5fef9", "value": "Bard AI setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51a5128-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1682160800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160800, "uuid": "cc8524b1-fcde-42e4-9f51-a0b72145f542", "comment": "Malware payload (Nitol)", "value": "7c417d674869c51ebc5fa970f50d627e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160800, "uuid": "75ac2634-9b40-45aa-b6a5-959ff5d0ed0b", "comment": "Malware payload (Nitol)", "value": "7879810c77051fc129fd4d107c327a9b5e039921975bced09800bffaf55e3bea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160800, "uuid": "66d1df54-6270-4a70-ad34-7d94d274ed69", "comment": "Malware payload (Nitol)", "value": "32a5346da262b5b933d5e0b1c048c610a9895b7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160800, "uuid": "d54ee3aa-4367-4ba4-990a-ead4ecc8abf3", "comment": "Malware payload (Nitol)", "value": "2d269591fb2d65406377956e84d30c325ae4afd213deaeb5bae17c81533a712002a8bccd32c02a7f0e446160ed6c7909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160800, "uuid": "549c27b2-bdb7-4eae-ac5f-8261d3bb1ad0", "value": "T1EFF423A7D7D69AC2E142EBBBA447F01D7710CCCA0DA0454188663BC7FD3E1493EAD4A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160800, "uuid": "5fb7f626-0345-4ee0-93f5-bdd9f0ecfd24", "value": "d841d50e2bc0fe8c16f07f174c3899ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160800, "uuid": "9d85cc06-f886-422c-b1bb-b7e3551f3149", "value": "12288:0H9rADjqyKi6HC6PxrXBGasKuSB9mdxXnHTi6oT4M1LydJIPIh:Yl0+C6ZrXoa+Tib4M1LydJ8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160800, "uuid": "9a353801-4127-44ab-a315-4e2ad53e1360", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160800, "uuid": "eb7999d7-470c-43f9-b841-c1001d63b476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160800, "uuid": "88dcfadf-03e4-41f1-9cc5-53fc4437bd66", "value": "7c417d674869c51ebc5fa970f50d627e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19855d8-e122-11ed-88f6-42010a9c006e", "comment": "Malware payload (TrickBot)", "timestamp": 1682177437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177437, "uuid": "01409b45-70e7-46fd-9507-339b210fc38e", "comment": "Malware payload (TrickBot)", "value": "fa8117afd2dbd20513522f2f8e991262", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177437, "uuid": "bd54534e-8ffa-443c-9b0d-7a34449a104f", "comment": "Malware payload (TrickBot)", "value": "78b592a2710d81fa91235b445f674ee804db39c8cc34f7e894b4e7b7f6eacaff", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177437, "uuid": "6a2a5364-ea00-4713-9e12-8aff4629fa3a", "comment": "Malware payload (TrickBot)", "value": "f7b876edb8fc0c83fd8b665d3c5a1050d4396302", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177437, "uuid": "9b67aa6c-9c3a-4d7c-8971-38d90ee71ce9", "comment": "Malware payload (TrickBot)", "value": "e68c02fac0bd2cddddc975479eefd5dcb1259ca87b6fddeff25840f5dbcc24ec1a2e8ecaa91ae2b9cfb68459ec635c33", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177437, "uuid": "fadc38a3-e775-4fbd-8f4e-e4f4831a34b2", "value": "T17CC32371F02A1FE4F694A0790842A202DD0664C723E6EE1F872F4AB85CDEAF755740F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177437, "uuid": "2a2d9cbc-e9e9-4a0a-8e43-06532a8ef845", "value": "95c9dbd11f21d2c0fa6c3dccccbdebb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177437, "uuid": "3950444c-3dfe-4411-92cd-c145f1a761e2", "value": "3072:KW5yc3Y4SMQwuOekD96R928AN+/uSxo+HHz/bs/k4OS:K83Y5BAxa92KrxTnz/Y/k4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682177437, "uuid": "5e45070a-7ff1-4d3e-9237-e3594ee368b1", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682177437, "uuid": "b78cf6a4-41c7-436a-964f-5f83a6de1fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177437, "uuid": "b89884fd-00c6-4dd2-8ed6-8c9c0c37a842", "value": "Revil.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca122448-e108-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682166338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682166338, "uuid": "ba6102b6-3787-4b4d-be3f-784fd45bb5a3", "comment": "Malware payload (RedLineStealer)", "value": "5d27d98874496be8221e8af859d35e2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682166338, "uuid": "372e8493-ffab-4f9f-a4d2-2666eb0f799a", "comment": "Malware payload (RedLineStealer)", "value": "799003372e104243ef58061fbcc0f12d15552f40e6ce8b88164373f621c012c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682166338, "uuid": "297d8875-5e04-499c-ab2a-385cf4afac62", "comment": "Malware payload (RedLineStealer)", "value": "b6397c729b01ba5b1956ea576c1a95e96ca779dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682166338, "uuid": "641e7dfe-2796-42ff-af0e-a8226b4bfd21", "comment": "Malware payload (RedLineStealer)", "value": "64972852eb2be0ba6ed9e71862e30969bacfaea4972c8c14629f13647e5fba95b7999aea102700d4464fd435eff21075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682166338, "uuid": "6309ba93-48c3-4f15-89a0-369862d0dc99", "value": "T1DE35236277D82477D9A42B7088F712831B357DF16DB0C2AB7286649F4D739D0A930BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682166338, "uuid": "4c2b58aa-bed7-4d0c-b7d4-b34431cc0299", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682166338, "uuid": "aeccbbf4-40b6-44c8-89cb-e9bc6bc755e6", "value": "24576:+yP+b2CnNHA7RgUJ/59lCQh2/A54snFYKgGHusa:NPO3nNgtgUNbwQxJFYKgGHus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682166338, "uuid": "c784683f-bbe1-4377-a1a0-070de6adc686", "value": 1126912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682166338, "uuid": "62259be3-2c75-4466-b743-4b2881cc7da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682166338, "uuid": "84aa8f61-06c7-41de-8810-b0c93f0df625", "value": "5d27d98874496be8221e8af859d35e2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c5ab90-e114-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682171491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171491, "uuid": "4a40f0c7-9e25-4df3-ac7a-0152c5acc881", "comment": "Malware payload", "value": "0b6bd5fc164c629abdf4fbb925e8fac3", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171491, "uuid": "57347cff-f493-4825-93d6-6745e8658bfe", "comment": "Malware payload", "value": "79a23bbc0dce496f7a8e3489dee975b8438c6fa1a24fd32f091d65520d75ddad", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171491, "uuid": "43a67668-db39-4079-bc15-d018e5325079", "comment": "Malware payload", "value": "da04ea7735ca1c56767b64da8b5dff8b92ca3dee", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171491, "uuid": "99185567-50a7-488d-a911-b28e9e9b993c", "comment": "Malware payload", "value": "93ed9d5be8b4eeaeadecf64fe9fa53fdbb3cd95223e592e405a2311845960cc9c10c7ee62e6cec681c0b1d4c9cb20e8a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171491, "uuid": "a4ae795c-dbf8-4669-9572-7419e6463048", "value": "T1D92533B124152FD90DCCA5009BD649F1B5E673898FB943DE62283C08F688F92E59F9CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171491, "uuid": "30c8464f-1442-46ce-b428-2f8224f5c18a", "value": "24576:4ws9HFv+ZigAc90aRwS8Z3OauiEMYv5F/VDOHlrRpQTiz:4wsRFyiS02w7eaA5htmSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682171491, "uuid": "de003b80-da99-48a7-bb17-61655a3cc38f", "value": 999804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682171491, "uuid": "bd91a901-773d-4fb2-bb0c-84faa3eefbf2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171491, "uuid": "d758e59b-d298-4861-930b-b481e4af1eaf", "value": "Bard AI Marketing.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083af71e-e0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1682156564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156564, "uuid": "7e7e1ec1-f4cf-4ef8-ad80-73115d61de48", "comment": "Malware payload (DarkCloud)", "value": "537a52aab972bded43038013142af3d8", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156564, "uuid": "d2c14107-66f1-447c-877a-59ad30229211", "comment": "Malware payload (DarkCloud)", "value": "7bb5644af505f02103e7099678847ca8b8a3e8b6286599c024f84851c05aa2e8", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156564, "uuid": "08100404-44f9-4cca-89d2-cf159d17d097", "comment": "Malware payload (DarkCloud)", "value": "131944af3dac676b6cb605f79fb7cb05bfdb12a1", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156564, "uuid": "336df954-385f-444f-81ee-f00f2ba75c77", "comment": "Malware payload (DarkCloud)", "value": "85f82f89b867e140eb98d37750dd6a4209f47648fb56a6619e78ff52262c407fee75220931bfaa4f5e419d08587d8f84", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156564, "uuid": "d9e7dee7-59e0-4cb4-a8f9-292feb54e95a", "value": "T1D34533640F2EBA27E07F880D5085ED72FD629787FE4D08492E4150E1DA9A742F1F8B39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156564, "uuid": "4dcc909f-a680-46a5-b584-8ed39d48e7ec", "value": "24576:6nZ/fB6pwXrXX7QFXSKL4IDgtAjJySBQZsfY7nzLB8giHEu/W:iZ/fB6y3QElUN9N68nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682156564, "uuid": "05d08cf1-282f-4874-9f76-4c61767f71ae", "value": 1204275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682156564, "uuid": "d93d9852-a945-4859-81d8-b76150ef3ead", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156564, "uuid": "6a01ebb5-0056-4359-90ee-0d6da266e779", "value": "pagos.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e05f4d-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137709, "uuid": "b3057bfa-9a51-44b3-b821-4e9f5fbe0ad0", "comment": "Malware payload", "value": "636104bfadfaee8b6302f503c6ce8362", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137709, "uuid": "17af9b20-07a8-4bc2-b1cb-122d9854a122", "comment": "Malware payload", "value": "7c44e52e24512d0436cd3a66d345a926f6603041f590baadabe9df023112a7b4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137709, "uuid": "2a17c8fa-60b1-42c4-843f-07e0d31786a1", "comment": "Malware payload", "value": "fedbd74943fbfa0415ce07bbd874b0a74c046d25", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137709, "uuid": "f8c4388b-9670-4ca6-a012-1fc7a9c5b39d", "comment": "Malware payload", "value": "cbc21fff338d533fa09236e011abbdc87a391f6c45269e610adef5b2d22ad926b954bd6f03888ad62115669595345430", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137709, "uuid": "c0d8a1ee-9593-4acf-8a8b-ad4202e57047", "value": "T1EF924DDE0F24A27BDD964E79B0D2C3176E32F395DAA6C0FB51AAC1843CC2790365851E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137709, "uuid": "8dcd69a9-2050-41e1-8d8b-8ad426225905", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137709, "uuid": "0d22f431-f4c9-4854-9b87-93591a790e1c", "value": "192:RkSJ9NK67J0gSCVg1xzjdWgwMbYITmYWhZ+GU9zFUnYe+PjPaiSsFc4waNF1IiSH:RkfHoY5GUNqnYPLaiSKT3iiSKB8iW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137709, "uuid": "5c67249b-5a27-44e3-b464-3944c67ff4c5", "value": 20768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137709, "uuid": "e07ec83f-adf1-4a10-90c3-e9220cc87119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137709, "uuid": "191560af-21bc-4396-baf4-6d81733837dd", "value": "SecuriteInfo.com.Program.Unwanted.4695.24296.23019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2323e408-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137711, "uuid": "929917ba-fbb1-44d9-b9ee-0e79566938ba", "comment": "Malware payload", "value": "c9c1f824ad9e1b54669cd0eac9ee1a1f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137711, "uuid": "b49da8a5-abd0-4dc1-9cce-969573bc33ad", "comment": "Malware payload", "value": "7c84f90744bc195c05cbe96cdaafa2bbfab1b696c36a2114d3a1ebe104cebd59", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137711, "uuid": "9ec53c5b-cbe7-4cbe-bb28-d92b693da9fb", "comment": "Malware payload", "value": "bc08975ca2e8621e70da0efa467fbb4b2799ccd4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137711, "uuid": "89d7e288-56a4-4564-a670-b6e5be193e72", "comment": "Malware payload", "value": "5acaf60fc6343c29050b06666ed8720afe5d3ac78f8b8bb1078f94fa0c8b9db6c9ad87767ee1993d8ca2f6d34d3b1a04", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137711, "uuid": "7524c797-ddb9-4fce-9fa1-ed078b3cea2c", "value": "T119824BC70F296253EE838D7296D5D2176E71F3E0DA98C59E24EEC2C52CC1BA0366842D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137711, "uuid": "777ade87-9775-4883-97b9-29ec21120c62", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137711, "uuid": "d99f2175-d7c4-4671-bd51-0d87869b97a7", "value": "192:egf9Asn6FHzMMCVuD40370nYe+PjPaiSsFc4wa76F0FniSsFc4wOp7bjuFd81:b956eMtkEYnYPLaiSKT7TniSK7piFK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137711, "uuid": "ea6b3162-7759-4842-bea8-f69b7b72dcc9", "value": 17696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137711, "uuid": "58b180e9-ec25-420c-afb3-44b6e93fc46e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137711, "uuid": "2ec90e57-4053-41ea-9b76-ba4661a7b394", "value": "SecuriteInfo.com.Program.Unwanted.4695.11120.29714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87984d80-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137450, "uuid": "81ad2578-966d-4175-ab4f-341c8c2e8b34", "comment": "Malware payload (Mirai)", "value": "f6ea078cc1b2128bee1149a498cfb49a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137450, "uuid": "42b0b8de-878a-4414-9269-28c4a0ff6e3b", "comment": "Malware payload (Mirai)", "value": "7d6ce2e8c6d414721ea05ab1d3bf6e98dbe32ad05a1220ed83a58f9538c0ef55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137450, "uuid": "55806bef-43e8-4ea5-bd49-ddd45eab65bf", "comment": "Malware payload (Mirai)", "value": "c7875defb24c257197c546861de9a3c173617144", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137450, "uuid": "919f1fe8-24f2-44d0-814d-fc5c9d629810", "comment": "Malware payload (Mirai)", "value": "c39f2b62ee9e2babafcde2d38cffde2a99e7de0534d5f5da41e6fd9e83be10c84e6514143741c78fa6661ad687aa482e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137450, "uuid": "0e155740-daaf-4953-a25e-a68fa02a3aeb", "value": "T195634A01775C4E43D1A61EF8293F27E093EEEE9021F4F5842A0ED6465272E33994AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137450, "uuid": "452a0469-e081-497e-a44d-9856a6d9dcbb", "value": "1536:ZjVO2KsrO4zb5Bd5mBpTaQnQSe1ECj5ds:CPsTHd5kNQSe1bjrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137450, "uuid": "1e0b2761-b0f9-478e-a6a8-ed49c0ba1518", "value": 67576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137450, "uuid": "995ef3f1-8481-4128-a4f3-c46b6b3a8b8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137450, "uuid": "77bdce93-999b-40ae-b218-b94342912abd", "value": "f6ea078cc1b2128bee1149a498cfb49a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed7afe8-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137650, "uuid": "56f23aba-5340-4624-ae2b-68a3bbacc928", "comment": "Malware payload", "value": "75323ebc0e188b520a25a0dc2e3d33e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137650, "uuid": "9209b3ee-6cee-46f8-b3d3-40981602c9e3", "comment": "Malware payload", "value": "7d6fed21b5f115db507f1759c69988cf1212f75530c1d31033c28575b016c82d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137650, "uuid": "9b51cf65-9b65-4fec-9d2c-bb9c4d4e478f", "comment": "Malware payload", "value": "e86fbf0402ce4dae7c7520f712e7c21362cac898", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137650, "uuid": "33475184-7a10-454a-9c7c-7b15e709d7ec", "comment": "Malware payload", "value": "2b6c761ce440d705ce32b237189c6ac33b845f4710e27042ce43d8750e1a5f0f7a43d4e42a300af5b7862322a521aefa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137650, "uuid": "2c33d283-fae6-4d2b-a410-f6a92dd98ce5", "value": "T14424272467EC4B1BF6AE4B78D0745461C7F0BA92A77EE79E8E8184EE0C477909D10363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137650, "uuid": "3b7ea1b1-7500-4d85-b46b-a406391fa641", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137650, "uuid": "b56a618d-7450-4ec6-8e34-5efcab631f68", "value": "3072:KK1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4y:Xe9OAQsFtJrGPBnmIRZ8z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137650, "uuid": "62c08f1a-2af8-479d-90b8-a84e000cc90f", "value": 212256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137650, "uuid": "fa3bd80d-e7ce-4d12-8969-9bacd10dfce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137650, "uuid": "440c9f06-6e3a-49f2-af33-395d7fb5a42c", "value": "SecuriteInfo.com.Program.Unwanted.4695.4635.5268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823078e3-e102-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1682163640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163640, "uuid": "fff24697-786b-4884-a2a4-84877d6a708a", "comment": "Malware payload (Formbook)", "value": "9312a2fd83dd825003de2272781b7e4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163640, "uuid": "455155fa-23bf-4a13-a6b2-b2c79c823031", "comment": "Malware payload (Formbook)", "value": "7f0a83fb59c743687b2076967768f0cea1a7772390d25bcd25ebee31caeaaa8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163640, "uuid": "b9269577-cec5-4151-ac91-640d7de40259", "comment": "Malware payload (Formbook)", "value": "f247b5a524abd633db60f6d1e332af855518ad29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163640, "uuid": "bee98e46-dad5-477c-a15d-cf73a8c958eb", "comment": "Malware payload (Formbook)", "value": "66574e014378c6ae2dd04daa82b911325e2d5197aae7093ed9c7360d7ef1fbf5b599f0a9f72d863f7ec2fa85d5a08134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163640, "uuid": "f0caa80b-4d43-496e-8743-913bddfb895b", "value": "T116E4E07551AF8590E00FCBB160B8FC72137174E7E9E5C634076AA280CE9BF546D98A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163640, "uuid": "7769a567-07ec-46f9-9f82-b0f04dd22776", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163640, "uuid": "c955857d-c2f2-4f4d-93a7-3b47d98d3e5d", "value": "6144:6ydfWo0aIYW6VQgcitOZ8ywg+8Xmf8igxXAN+BJKJmTqikXmi00FdyfrpruJMRse:NFWFFyOZ8yE7fKAN+U+g0fTprGiMTQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682163640, "uuid": "daba60a6-ad5c-4f07-9240-6c9565269210", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682163640, "uuid": "d9261b30-0663-4ef2-a4df-a0edda4e46cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163640, "uuid": "6c6c6e0e-3736-471d-b5ff-c16a98be0597", "value": "RFQ OREDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957242b6-e0c8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682138762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682138762, "uuid": "5a6290e7-fb2b-4cca-9e72-2fbe452811b7", "comment": "Malware payload", "value": "4c0f2329f09a29d1eaefa872f6f45335", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682138762, "uuid": "03eae52f-1fb5-49be-b330-9495e78c95f3", "comment": "Malware payload", "value": "7f4b2cd23ca66bbe3c0c9850691d0d3f562317c120fe663a3c3f1a493588d717", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682138762, "uuid": "b45a57e1-e43e-4493-9557-8498792b98bd", "comment": "Malware payload", "value": "5a3b5cfd519ab02651a0ba3e526bd5a870a41812", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682138762, "uuid": "11b39891-d89a-4f7d-ac77-08e6a6bdb8bb", "comment": "Malware payload", "value": "56ac4fca710dc36af8fdbd0a734e1cf0ac07209ed7ee0a474a2cc74922b7fec669760b2e0a0d8e8e6799c17d47553640", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682138762, "uuid": "b7ddc96c-b34d-455b-864e-b4fc026ffd6b", "value": "T1B9E53348CD04AC9BCD00D8B857DF95360AB30EF750956A487BEFBD21E6A4349BB6CC54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682138762, "uuid": "2e6ff5cb-63f1-4399-9ecb-e7cb7aa69cb7", "value": "49152:g7TgIPph3SFi1TNpbrvwiUdPDfcrSkfxDkV8DHMcu1L24PvMvc5DR:gmKNpH2c2Z+HMcCL3vTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682138762, "uuid": "dce4c427-46ab-4100-9b97-17aeb656f35e", "value": 3044770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682138762, "uuid": "cb376788-79b3-45ca-8f51-5f5234f25a99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682138762, "uuid": "c52a3069-1b81-472f-baa2-856dd3710a65", "value": "Arc_digital_AdjuntosKEZYDESVKVQFRCDtkakt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f829328-e0ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1682127021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127021, "uuid": "ec5a55d6-d2c3-4bef-997d-5bfbb96d763a", "comment": "Malware payload (QuasarRAT)", "value": "b36d08e7258bd1ce13ac7b32ad34b6fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127021, "uuid": "3c662325-842b-4664-a690-b4cb9c7f5cdf", "comment": "Malware payload (QuasarRAT)", "value": "801e585c7d99f8b20e9d68509c340d1f16f5e5756c1183ed806ec6e671c17ee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127021, "uuid": "20454706-2389-4bc6-986c-7fa9fc06917c", "comment": "Malware payload (QuasarRAT)", "value": "745f25a4ff447be0f7f6eaa31386ddd577353154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127021, "uuid": "01927b0e-e920-4618-8fc1-a6adf1ef90e7", "comment": "Malware payload (QuasarRAT)", "value": "6888d8b53c4610ae5d85ae10433945355d705a7d1a170a011f37039b7e59c420df65d56c71598b2f124f5b630940153c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127021, "uuid": "c8f69ae9-9705-4a4c-8085-bb1b81980793", "value": "T1E6B45B8123FC851BE1AE57BDE4B14821ABF5F407A2A7EB4F4940A1F92C567429E407F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127021, "uuid": "5d12e09f-04fc-4d91-b51f-d42001fa739d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127021, "uuid": "d185a4e7-1a57-4085-a6c4-9b8b571da1b6", "value": "12288:0TEgdfY8l6sVd5Hl49yw5Spc7ajTecdi:5UwMJHQyw5Sp3Wcdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682127021, "uuid": "620ba05b-2ba6-4dba-8251-802db98c6df3", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682127021, "uuid": "85f795f5-7748-4eb4-afd4-818c97851237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127021, "uuid": "184b960b-9885-427f-aff7-c28ffc5d245b", "value": "b36d08e7258bd1ce13ac7b32ad34b6fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78396128-e0cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682141719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141719, "uuid": "3920f08b-4c64-47b7-85e3-083479c6dac8", "comment": "Malware payload (Amadey)", "value": "6b1828449e28b607f2e9a84d38257864", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141719, "uuid": "777c0958-ff60-4105-8aad-064c3e83e8ad", "comment": "Malware payload (Amadey)", "value": "802df1ec521c0d5225169ab10f4dbd6a364092bb14ed189eb951904d32b4f56c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141719, "uuid": "381aa10e-d6c8-4452-bc98-636816b513d4", "comment": "Malware payload (Amadey)", "value": "2629a0ec495e8b06f4353811da7aa781a7bd5d30", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141719, "uuid": "fb78ea0c-9311-4ac0-85a0-96aba81c7acc", "comment": "Malware payload (Amadey)", "value": "144ab654ff295c2649f2a1c5e8e7b86ab718a38e9233bbae395898d5e0efbc234e400e1ac8144a0f491640292a6d8ed6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141719, "uuid": "f01f496a-57a2-4c75-9810-508000437c8d", "value": "T16FC41207BADC5137DDF927B05CF912830A31BCE29B7486EB6695E98E4C722C09631367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141719, "uuid": "dae8dc7f-9375-4f91-afeb-35f9bda375b5", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141719, "uuid": "3ef3a182-a691-4655-8886-2e61ef8b872c", "value": "12288:2y90HLRXBWUR43nyAqtmSbBkdsWJJnSwTwE58TSbUDMe//AQWAvp3UDRb:2yMhB3S3Mtm6ads27TR55DPcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141719, "uuid": "c63b3801-0f4c-4abf-bc10-4d72c8f87a07", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141719, "uuid": "a507cb9d-f2fb-4a51-a221-fab38476028d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141719, "uuid": "9b308bb2-10a0-4ba3-94ba-cd27b2d15f04", "value": "6b1828449e28b607f2e9a84d38257864.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d154d64-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682135339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135339, "uuid": "d97309f2-146c-43e5-876a-6b185ca41229", "comment": "Malware payload (Mirai)", "value": "9ef02cf8202e72c0ab9084342b70daf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135339, "uuid": "64e8ad0f-c978-47e3-bafd-66765076e621", "comment": "Malware payload (Mirai)", "value": "809ba7b33b393b6f60f4800f9cef4f596d1ecfacbbc8182c2729c4b0e75e585b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135339, "uuid": "a2f74b0d-2bc0-4d09-b8ff-57979737065e", "comment": "Malware payload (Mirai)", "value": "e1f55f6f96d42d8a57fad88efa93bd9218b74ec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135339, "uuid": "94789cbd-368f-4a14-bfc9-71afa3e79dc4", "comment": "Malware payload (Mirai)", "value": "3ce79b2b74c3a0a43ead934197383e5f4c8b75626f5d70dc213ec0489cff3a5d7c39ecc8c4d86add311c586af3b82b80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135339, "uuid": "36bb2473-f00d-42d0-9969-7143d014a657", "value": "T10D536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135339, "uuid": "11aa38c4-ab19-4a22-8540-28ecd947e20b", "value": "1536:Z7qARubgzY/bEJyPRcpS80LDHhklv4JQC9DSW:NP+eY/bEJJaXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135339, "uuid": "6c39b272-c755-4767-9e3e-a4bf827f6f85", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135339, "uuid": "b0032498-0b9f-4d9f-998d-73befffb2088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135339, "uuid": "1a923dde-95c5-4d37-b6a6-4aff09987b75", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101c80dc-e0a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682125224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125224, "uuid": "90bc30a8-9d12-4550-9ae1-36b601c23dbf", "comment": "Malware payload (Smoke Loader)", "value": "6002b1439f243e32bf79fc3986a450b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125224, "uuid": "6c15d8b1-146d-42c5-bc47-5937c35d4b4c", "comment": "Malware payload (Smoke Loader)", "value": "811a0a6eec0764340e0fe91f12391b31cd607999f16687de56447c2875ccddf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125224, "uuid": "ac0f22cf-bbbe-4e95-a619-9908bfe87faf", "comment": "Malware payload (Smoke Loader)", "value": "34ab8bcac5596cc9ce994bbfa847a6a8f15b43c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125224, "uuid": "b4c613d0-fe3b-4939-9e2f-5bc4df5efc06", "comment": "Malware payload (Smoke Loader)", "value": "9f9d8e512090eefaad062e2583cd34f7f1146e4190a86c1dc9245a4bd23c6d99304f15e2ee49182723949f8a493edfee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125224, "uuid": "88fc4f6c-7082-4e11-8f37-a4f1c9af6e45", "value": "T13A44BF1177E2E473E9A70AB46430C6E46F7FBC655766819F320C2B5F2D713D08AA6322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125224, "uuid": "b4578e67-fc9b-4a49-8af9-8937beae1f35", "value": "c2613217b278bbf906136c8e0c29af3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125224, "uuid": "ad45fab4-8eec-4d60-b82d-61ff037b18ce", "value": "3072:CSnv4r7N48brhDhjLfDuOi0mXRXVzIDXTVYK5XproMFhZOpV:Dn9gDjg2JPp8qYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682125224, "uuid": "fe201d48-79d6-4e31-bb65-330af5054927", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682125224, "uuid": "d8463660-cb79-4ae7-ab14-4b393513eae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125224, "uuid": "23807776-c8d3-4d54-a771-1d31dd27ae9f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c120a6-e153-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1682198437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682198437, "uuid": "cdc913b3-eabe-49c0-b84d-f791973cc70e", "comment": "Malware payload (njrat)", "value": "cb3b0b29603049aa3bdb6d9b9a2b2cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682198437, "uuid": "61125279-a0ab-4bcb-96e0-3a894c8d2488", "comment": "Malware payload (njrat)", "value": "81707f63a5a759d1ec24ef88500899d43023921001350b885babecb0b82891fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682198437, "uuid": "14d95d1c-2489-448d-8cf3-0a522df3149e", "comment": "Malware payload (njrat)", "value": "09e50c801100bad1ec717b1d3b05a3ba91984c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682198437, "uuid": "9826c657-0775-4802-af2f-1d4e763e8fdb", "comment": "Malware payload (njrat)", "value": "fc2f037f054fe95b8540863d4022af3dacf3b0cd67b7578a393ff4c3791d0b3363831f9ebb26fa34042da422fe3739cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682198437, "uuid": "fa91e53c-974b-4fa5-b9b1-7178cda62c2e", "value": "T1D5033A4D7FE18168C5FE057B46B2D41307BAE00B6E23DD0E9EE564AA37636C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682198437, "uuid": "48050ce2-7983-4d15-bc9a-955a38532660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682198437, "uuid": "837e6712-6bdb-4aea-9161-50dfe2548f96", "value": "384:wyoPVSikmD0NVtv/Vey0bEGfFdIs+yvErAF+rMRTyN/0L+EcoinblneHQM3epzXL:94HO1VV0bEGHIVycrM+rMRa8NuRRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682198437, "uuid": "cb6f4c9d-903b-45b9-b066-6508b5cd08e8", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682198437, "uuid": "3c255b7d-5d8e-4e19-bc56-d3f78608a634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682198437, "uuid": "2a933708-63ad-47ef-ac8d-d274dcd5b1c2", "value": "cb3b0b29603049aa3bdb6d9b9a2b2cb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7dc8b0-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137702, "uuid": "5bb66768-f057-452b-b88f-9cf47e8ba0fb", "comment": "Malware payload", "value": "87a33c9539f71b94bb7ee3f7dc6d4562", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137702, "uuid": "64073a48-0c14-4631-aaaf-55e820f929cf", "comment": "Malware payload", "value": "82629ba464713fbef392170f3bc9bf3214f4efe97164e0241ee5a5f53a2ec68b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137702, "uuid": "ee785d4f-745c-4964-94eb-ddd7d98373f7", "comment": "Malware payload", "value": "7f42cc17bd5fff1629a2c7b9c1bac2c775a4b1d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137702, "uuid": "376c9e16-2c05-4c08-a969-922717516c90", "comment": "Malware payload", "value": "dd14992a7e6b26e26f83656d45a2cbdcd372dd96a27a7bb3936e6de0bf7982eb9a038ca9e97560f1e5f0689a15842c97", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137702, "uuid": "c09affcc-acd0-4e26-a269-2991bba6cfa0", "value": "T1EC630B5D1BFD862FE6FDCAB4B1B085204BB9B949BD73D3A90B8290582C773509D10B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137702, "uuid": "31168feb-4e9a-4179-b494-e7fd0f2435f3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137702, "uuid": "1473ed12-8c48-482b-8ff7-cfc77d9581f4", "value": "1536:E6xmYNpvHhhHdh+N4Zju19ozRdKZai1+i1p:En0v49aAai1+i1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137702, "uuid": "9a3d1dd7-d198-492b-bd3d-9cdc466bc5b2", "value": 68384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137702, "uuid": "9c0304ae-d514-4d69-9766-93c14619d31b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137702, "uuid": "35ecfc46-a248-4f17-943c-316941afd451", "value": "SecuriteInfo.com.Program.Unwanted.4695.13286.31894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ad889f-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137501, "uuid": "47e66e79-38b1-4183-9a31-13028da48620", "comment": "Malware payload (Mirai)", "value": "efc782f5afa412d4fad109e357f409da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137501, "uuid": "b8c67dd2-ed9e-4d39-9cba-82c2ce62fad6", "comment": "Malware payload (Mirai)", "value": "8344d4a7b9302a13a87a22501ac39ac90f19457156beb5d3c0fa9671b75b1b18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137501, "uuid": "d6b9fbe3-ef6a-4899-85ea-19ce890886f5", "comment": "Malware payload (Mirai)", "value": "7ae19036f586777a2ea6ea90e38bdec40150b3aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137501, "uuid": "052d3414-eba1-4d73-a639-541baa0ef2d0", "comment": "Malware payload (Mirai)", "value": "8aab5a7ff08265d94c35a86c2a62ab40f5ffe33c3dc254da99bba425b1c29e1f6575f2db25a52a781c8fbe6132ae7e48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137501, "uuid": "ea9b1cf7-3bae-4ee7-9631-6d9e8b83b0ac", "value": "T11B831A46BC819F01D5C912B6FE2E118E33131768E3DEB2239D149B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137501, "uuid": "1bf3e1dd-36da-4a90-9730-2599bedb38ff", "value": "1536:CxnTsKJgf2wC2ZTCJsET49sk5ba8wkbyMRiOcYc8QRQv5SYG:rKGs2cJQsYaycYc8QRQvMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137501, "uuid": "6095cdca-db14-4e66-b78b-d83789be1b8e", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137501, "uuid": "12b1baf4-f5a4-4d8f-901a-e939265d689e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137501, "uuid": "60ecdb71-2643-41d0-acaf-0261cb59d583", "value": "efc782f5afa412d4fad109e357f409da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a0b77b-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137663, "uuid": "cb383d02-ece8-4a6d-b039-99d2be67104f", "comment": "Malware payload", "value": "0a3189fb47d3586c9489c69d68cab692", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137663, "uuid": "47ca1e8f-8589-4b23-94cd-f765b80cd83e", "comment": "Malware payload", "value": "84d150cd4725c76b0c862114ea872de4b76bfe1e770de22216f80684d415b701", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137663, "uuid": "dd17d81d-9c2d-47ba-80bf-e4920e51b185", "comment": "Malware payload", "value": "4785d9d4ee9473a80f93fc64963d04a3a1a03b68", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137663, "uuid": "2e8c2e61-2acd-4ef4-9bd5-29de31ba51ae", "comment": "Malware payload", "value": "a7081edb65d9b322267fdb778124434bff44679fd29332b65432622869a16f02c476b4bc6f3cfbc9759948e981a9c61a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137663, "uuid": "fcb4f72d-99be-4b44-9e86-d8f988b95997", "value": "T1A86416042BF80A19F1FE5BBEA871850187B8F956AAAFD30E5A9450FD2D33790CC50767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137663, "uuid": "4e141b22-8168-4562-b849-7eabb6555441", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137663, "uuid": "6e0e6f27-4078-4298-9521-6a6f1abbd731", "value": "3072:8qc3k4mtsi40XigRvjAIg8J911rTJZq4+wYxEwKbEAfKQPL5ds6vOn7GGkXnEcmX:I3CX1AIg8JRfJYmYxEwna5dY5nBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137663, "uuid": "49832de5-fcb9-437d-86d3-909e0e4e9ac4", "value": 322848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137663, "uuid": "b3beab2c-6a09-443c-b3a6-c1e1fc676387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137663, "uuid": "58c86cbe-3a21-427f-9c5c-10f99d11dbb0", "value": "SecuriteInfo.com.Program.Unwanted.4695.31943.24626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a40b37-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135435, "uuid": "52736c17-bb33-4267-b8ba-ef032fa91587", "comment": "Malware payload", "value": "364ca5f5c93a88ed1b7adc8d64ff86ac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135435, "uuid": "ca086ef2-81ed-4a0a-9e5d-cab2553655db", "comment": "Malware payload", "value": "84da9753ba5d37dd64e119513b8b698f53174889d2205570b10ceb3eebf37175", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135435, "uuid": "f1ac844c-e05d-4645-991d-45b10eb254b8", "comment": "Malware payload", "value": "a02b6f641d349b263c10ce8723cf4794d352572b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135435, "uuid": "b9cd82e2-ac31-4ba0-a04d-e820f00587cd", "comment": "Malware payload", "value": "a039c135daa36fdf7fb53ca15fac2decfa9516558d41f66e96072109d19f7be127af1a653079b879f8b6a462759da83c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135435, "uuid": "cef14a0c-5ff5-4ffa-ab27-1f40a84ab5f0", "value": "T19F043C11D050C7BAE1A244F9C7E90DBDB8364D50730509CBB2C23E79AB52DE5AB31BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135435, "uuid": "77e814dc-5e4f-40f0-8157-ae0d3a7da051", "value": "3072:6ZvVk27jPiQ4RIb7DrcnftWG2mfRGIR8oL2AA5NWCdxN2UnPF1ELW5550:6gqiVuDrcnV9LfRunAA5NWCdxN2UPF1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135435, "uuid": "2902f17f-67c4-48d6-848e-9b2315ba452b", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135435, "uuid": "9cfe3e1a-a758-4658-b2c5-59d24f59e303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135435, "uuid": "ae4d0d2b-1946-4f39-b1cc-2edd283413d4", "value": "2023-04-20_364ca5f5c93a88ed1b7adc8d64ff86ac_cryptowall", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163c67b8-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137689, "uuid": "eb7f779c-7a1d-420b-868d-012038b1c0a8", "comment": "Malware payload", "value": "41652663204f3b2f987cad8d28273333", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137689, "uuid": "231b759c-aebf-4b90-8c41-3fcaca3f0e42", "comment": "Malware payload", "value": "85d58f0515babfe9217b715ffbffb7c711c56ab4d10a10cc437c9560cbcfea83", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137689, "uuid": "93660cc6-dc6c-4335-b444-257f2f166482", "comment": "Malware payload", "value": "b5510f47afacc0abc593336ccfaf657351871ecd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137689, "uuid": "78efafe3-f3c5-4fae-9ba5-10d834bf312b", "comment": "Malware payload", "value": "2ab68db9b1a46cbf10cad8d833217c47a9f644b587fd48f9fe81d4c2c4ca0064c5dbda9556aa485e5c3aaa0f46ee5ecd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137689, "uuid": "2c0e79b4-cc89-4afe-8634-d8d7ecd31beb", "value": "T12133C56D63C83035FD127AB35ECEE2A9E526ADC5DA93663B103DC1836B8064DF721474", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137689, "uuid": "32b339c7-1249-461f-bc9d-7e42d6036720", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137689, "uuid": "ec361c5f-49d9-42e6-af49-d9e2ade0e985", "value": "768:G34u+ZyqauI647SbFIlBv5v2xAoq7HHj8XnGZqHnamyr1MhuFn6RbFJDw8M9uiqo:GIsWxOGo8MqjN3Wuli1yi1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137689, "uuid": "486ce7d1-6d4c-4895-ba2c-05917bd91076", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137689, "uuid": "8b72471e-837d-4bc9-8718-3efff7349df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137689, "uuid": "d2ded5be-0f61-4970-922d-10a626cf81b9", "value": "SecuriteInfo.com.Program.Unwanted.4695.25780.4058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e053bd-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1682160536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160536, "uuid": "48f37925-f354-46b3-98fa-fe4b1998b284", "comment": "Malware payload (GCleaner)", "value": "07c4a5dacf7a147cdce6013b730cdb5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160536, "uuid": "98d96e52-72e7-4e64-b23a-19561fc11cd4", "comment": "Malware payload (GCleaner)", "value": "86406b69f1e60a400b898fe78cc77757671b4daa7288e4bb455280e2455ffac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160536, "uuid": "2d59d10e-7475-4f38-ab0f-b8e3f0c2f272", "comment": "Malware payload (GCleaner)", "value": "3b564cf01a1c58d139722d7da440effa336078b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160536, "uuid": "452919eb-81de-4dbb-a30b-23bfc0c45962", "comment": "Malware payload (GCleaner)", "value": "f536c3fd39f4c32d029be56bfd2ad0dbe540a5692ba8f5e1657551165f63e883af539d7fd59fc1ca5bc8edea08516167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160536, "uuid": "ba8fae76-cd86-47f6-af08-cb31bdc4ea64", "value": "T1E6E533057AA9C530F466CB392D9BA68561343E409E1DA60C33FD67CCDB63AD2EE02717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160536, "uuid": "6e119972-b96e-4422-a608-c115c86847de", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160536, "uuid": "368130b4-3706-46ba-be2e-e483de03582f", "value": "49152:zGlJfso6lXLe0ITji5Zk7U1kymVTrWUSLzn/RGzaHlDSyoHMxL2CKNrCdcyeEWHw:qUl+W5Zl1fmV3JiVYc1SyoHMxLuNudc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160536, "uuid": "6819f3d8-c194-44f7-a64c-a062fdbf3777", "value": 3085548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160536, "uuid": "41bf28f8-b012-4993-8e16-c2ed15e91213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160536, "uuid": "619f6eaa-45ad-4e1a-a13c-089b37a8a155", "value": "07c4a5dacf7a147cdce6013b730cdb5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0baeda85-e0ac-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682126505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126505, "uuid": "cc14de27-72e6-4a05-8ba3-72cfbeba3d2d", "comment": "Malware payload", "value": "cf0317eb2f3828913433ea00085bfad1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126505, "uuid": "0a65c856-baa9-4fb6-88a9-c9737150a70a", "comment": "Malware payload", "value": "86e141f8e4c978f1a95493b07c0ee43691e049d0310723cfcf645a158ca5b5c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126505, "uuid": "5f315f9b-0183-4edd-811e-8ce5e4660220", "comment": "Malware payload", "value": "a9123cce90b987dd0ffb3753ba9bf069b8ede151", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126505, "uuid": "2ed32abc-a21d-416c-af12-722845ecdeed", "comment": "Malware payload", "value": "87b919a4783336e717f5dfd6feb6ddbce7b83013f6e985045427977df786cde8c4df94775f276105c1b7d08fdcee0fb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126505, "uuid": "945f32e6-5d1e-4ae8-85f6-4878a5e6f65d", "value": "T10D2512B8F78C5F63D5AE8179C0E609600370C56B528EC78FECCA55F82E897DAC98505B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126505, "uuid": "94e21dbc-7ba2-4d9d-85b1-7638b773004d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126505, "uuid": "a675435a-fc21-416f-b481-711e9be63cae", "value": "24576:Nky1hn/N8bJF63XZ4D6VXn4FexQE9qoXVpYLBvzg283JzQ+LMlzUG8DzmXmrV:Nky1hn/N8bJF63XZ4D6VXn4Z2qWsbqZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682126505, "uuid": "d574374b-4305-4a51-bdfd-ed07bf166696", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682126505, "uuid": "f48c26ae-b08d-4d59-9f33-88bbd2aa4aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126505, "uuid": "c2063f7c-087c-458f-8155-3d6480a61543", "value": "cf0317eb2f3828913433ea00085bfad1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d52324-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137492, "uuid": "bb4e06c6-6755-4440-8f51-28d036562f48", "comment": "Malware payload (Mirai)", "value": "1f5d26b3357284b6a724766aeb60660e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137492, "uuid": "ea5de657-7d56-4603-950f-e41aa556b437", "comment": "Malware payload (Mirai)", "value": "8751b22ee1fe91f908003aab4943803caae7abaca60a762bda125d0c37afa332", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137492, "uuid": "ca4d624e-9fe9-4fc6-bc9e-d89bac32cb4d", "comment": "Malware payload (Mirai)", "value": "6657c94e08d6244f9d7a9dc5739f8efcef7fb9a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137492, "uuid": "d8d3aa90-8d61-44d0-8bcb-bc6ae07c2e3c", "comment": "Malware payload (Mirai)", "value": "b1687b7ca47c910f3e146dbdecfa765aab321b348de613469a426e40f4d10229a3f4e7f533c06798bf108aa27a3eaeb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137492, "uuid": "e2815a0a-1337-4d6b-84b6-ea95a35ba804", "value": "T199E34C46EA808E03C4D61776BAAF424A33239754D3DB73068D28AFB43F87B5E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137492, "uuid": "2059f6bf-eb5e-4f87-97e8-3abb9fb81db3", "value": "3072:NRR6W/6ynOKwaVDV2uiGUD/vzdMvEi3cxgM/9WD+Sf:/Mm6inwaVDV2uZUDhQEi3ceM/9WSSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137492, "uuid": "6561190f-0f9f-40c9-b028-5d9307d1ff9c", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137492, "uuid": "ebc8a093-511e-4210-96ae-3e38d6bd1466", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137492, "uuid": "acbc0d48-86fe-45b5-b5a7-6ffc414f56c9", "value": "1f5d26b3357284b6a724766aeb60660e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e13bb61-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137703, "uuid": "73ddc603-9dc5-4dc8-ad03-779316bd15fe", "comment": "Malware payload", "value": "6a1f02974eacee78533f2744a40131d6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137703, "uuid": "470a3b9c-9bb3-4f95-b72d-dd8bc24b7dc8", "comment": "Malware payload", "value": "88c3552cdcc4f2db54562e5966a7db12ebb00a5945a90093198945526f315cd7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137703, "uuid": "031a83b3-8218-4b09-a15c-8f6f42867eef", "comment": "Malware payload", "value": "fc8a26f45176176564a5a86504b78e75a8a7f0f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137703, "uuid": "b693b73e-aba5-4bae-bb4f-6c956a03586c", "comment": "Malware payload", "value": "422300fff3c9951419c97044d228fef48f0811f6c271ee19b9ef0a499a62ca6533a55417fd30d8dffc2a2af5e67a758e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137703, "uuid": "46500a10-8bd3-48ab-92c0-bbb193d07586", "value": "T10E030909177FD21BCBBA4A3474ECC6A05FBDB2C9BD52E7B90760E0893E177C1A508426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137703, "uuid": "fcf1a590-8ae5-4e53-abda-d663a1fb08fe", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137703, "uuid": "02cb2728-0910-4b60-b9c1-8d4c4768c8b8", "value": "768:ohJWxWrnFT06StUREICDS/lH/RRAxxi1Ti1xis:ohJjzR0ZpICDS/lH/R+Di1Ti11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137703, "uuid": "0d7b9092-0869-474f-9eb2-e0466f1af785", "value": 40224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137703, "uuid": "03d62f3e-4bc5-4d22-9cc8-37463714c628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137703, "uuid": "3accbbdd-df2f-4036-8edd-61ad81085f83", "value": "SecuriteInfo.com.Program.Unwanted.4695.2305.23119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec0f908-e0a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1682124819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124819, "uuid": "fff33aac-cd81-4092-ad4f-ee66f7da7230", "comment": "Malware payload (Stop)", "value": "18c0d195d8ddf13688288eb3cf3e9d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124819, "uuid": "f0a563b2-4d5a-461d-93c7-5a02b10bab1d", "comment": "Malware payload (Stop)", "value": "89777277cf476587efda12e9def270e12b639e04aab35b17ffa0312ea46da418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124819, "uuid": "86ced4c5-5cf6-42a4-ad5c-515e99ec2425", "comment": "Malware payload (Stop)", "value": "15294ab12dbc43ec3e57f0be9d1a85a28c2cd77a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124819, "uuid": "2ffe07cb-6b32-4486-9966-9aace960ad53", "comment": "Malware payload (Stop)", "value": "5e550f67a2f1e7b594ad700f81aff52110d945aabf93ebcaa85f8fd8a58510e0eb0e63805084d3352c3d87b312bf7bfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124819, "uuid": "71aaa2f0-6b9b-4320-b179-83d9b91226a1", "value": "T182F422127A92FC33F09B55B18831D2E42E7FFCB58A8C429F67586A4A48711C17F67362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124819, "uuid": "3160d7fc-e3bd-4dd4-9faa-5251cbc7cacc", "value": "8cb869f42d9744fa3286b04b1d083ca7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124819, "uuid": "03943723-ca79-4df7-9e88-5b0b8c5b9647", "value": "12288:yBnojNA8yX54c94KrA65GWS3S6uS6dH1xQBUD9+h3jOBaiaBJTCgWrTtBd7Ur:yBn3X54C4KrDTO76tDn9u3jOBablCgW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124819, "uuid": "d576249d-3570-4c92-ab85-1eb8b69b7d65", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124819, "uuid": "f944318f-4530-430f-b00c-7f5a520ea724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124819, "uuid": "c67303b9-7586-42ff-aa85-4528553e4e72", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97445f8-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135440, "uuid": "1b78cdcb-d394-489a-a74e-bb5ef9ecb945", "comment": "Malware payload", "value": "1714055b2bbb1ff117147ee22a3dba9c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135440, "uuid": "9e83ad19-71ec-41f9-b91b-eebc048876c7", "comment": "Malware payload", "value": "8c7b7dce11847b0ffaa66b5078bbad4864553b06863d0d25eb8731446f5a5e3c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135440, "uuid": "9ca51663-67c6-41d8-8d79-b152c098e2f6", "comment": "Malware payload", "value": "53db7000c1190ec21aae6cf9ec45b637bda221b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135440, "uuid": "905e7df1-7153-4199-a50b-12a011b25cce", "comment": "Malware payload", "value": "a3b538038889694167f0abfe794551a71e97f38c1ccddacec74532a43c749b92e6515c587919abd27794bbc469bb4809", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135440, "uuid": "84219ec3-5fcb-4ad2-ab8c-e2f10a8392b1", "value": "T16EC49E026612D477D4A308726B6CEB66A4B95D344B6D81C7BF80EEB50A39FD2327C347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135440, "uuid": "338d408a-689a-4316-b31d-5122182ec6eb", "value": "3072:IP36YQgDABWbDFp7yz5RwXZwnt+XOCGNjYQohYmUZi+ZhJMLx8Me3xy+TRpAO:sZqTntxVYQ5mUXhJMLx8P3xyoXAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135440, "uuid": "11090041-bb7a-4cc8-918e-ef78c23badb8", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135440, "uuid": "eb927bcf-c3a3-41e4-9464-869fd0165f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135440, "uuid": "220c5f94-fb1a-47e6-93dc-8e3fc901f66d", "value": "2023-04-21_1714055b2bbb1ff117147ee22a3dba9c_teslacrypt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1e94dd-e0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1682156572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156572, "uuid": "48bd8326-8f27-4ab5-98a0-7d31113c0ad4", "comment": "Malware payload (DarkCloud)", "value": "977f2ac7c4ccb4b8b4a5f961ff2aa6fe", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156572, "uuid": "295a42aa-c2ad-4dc9-be78-c3abd27bfd3e", "comment": "Malware payload (DarkCloud)", "value": "8e16304b756988b8fedf67c9c0eee38873fa743a2e9beae9bfc7bc44206e6a5d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156572, "uuid": "3879e472-cac9-477b-9557-98aa97357bc9", "comment": "Malware payload (DarkCloud)", "value": "04039b7f69cc9264ad41029b916110bbef44a896", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156572, "uuid": "e0092905-a7e1-4ab5-a75a-1d50d8d6aab1", "comment": "Malware payload (DarkCloud)", "value": "47768cb36e9cc905d225f3185ba6ddbcc228f88df70f1c0ceec794a91dfb20e081ab03e7371ebc307969bfce2a89e601", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156572, "uuid": "c5f8a0e2-9961-4351-8c65-828107a2d078", "value": "T17B5512027EC198B3D47308365976AB31A93E7D205F748ECF2790661EDE326C1E2357A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156572, "uuid": "bc6cfbee-6b13-435f-941d-c1678a862fe4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156572, "uuid": "e342555e-bc51-481d-806f-e2670336bac2", "value": "24576:aTbBv5rUDoZ++AdLAXjXXRQFX8KZ4IXIJJpUUBQjqfYTfz7V2EggiVEoWc:sBpZ+HdUtQSVLzUUZ8V2Egf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682156572, "uuid": "fa46cd4f-16cf-44a0-b3d8-56ca16cb986f", "value": 1351543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682156572, "uuid": "9bcc9746-f177-4682-985f-75d9d2c70515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156572, "uuid": "523e3512-9305-4f8f-9dcc-912d4cb23a48", "value": "pagos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1442c9-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137647, "uuid": "7bb4e772-fae2-4f7a-b7a0-0447a21f338a", "comment": "Malware payload", "value": "3b957781c5a189a89adfcc8adde251cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137647, "uuid": "363e652e-40ba-4b9f-a951-391b044c04c6", "comment": "Malware payload", "value": "8e4bc179b16c3fc8000cf4dc96cf42f177d58a957504570be8e596adf68ded25", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137647, "uuid": "2c0cb8a6-24e4-4df8-ac67-3f528fdd5c1a", "comment": "Malware payload", "value": "1e346baa42c31d19308eeb08fdf30f08c00404b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137647, "uuid": "e3c8124a-5a8f-49c2-be59-dcd0b5881502", "comment": "Malware payload", "value": "270d2a48feccebbc7afb63b0195465ac084a487353ddc6776c2a995090ae3bf344edaf668357a4f40071ec392f9d0d2f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137647, "uuid": "e92414e8-7c81-4108-87e1-ab2c16310de2", "value": "T183F47C217741C179E59E02B1AA28AB3D90BCBE61872A5AD3F7CC1F1D1E346C25B32753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137647, "uuid": "80e641ae-6f8b-466c-bf1a-003e59f56599", "value": "1109f785f7471a1b672f338243998cb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137647, "uuid": "f83d79b6-81f5-4119-93cf-2e0ed6c1b793", "value": "12288:UOtZcbZXzrsk548VyK8SbMAfQBM6LDkzOZYv3JSGeizoyDfdZ:UOrcbZT8AYBpLMO8SGHoy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137647, "uuid": "fb23a461-8bd4-4381-b3a8-3cfcbe7cf8ba", "value": 726304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137647, "uuid": "e49cbd07-b9c8-4961-97a8-81985c6b9660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137647, "uuid": "b2ce7ec7-e7a2-4a52-b58c-2334bc401892", "value": "SecuriteInfo.com.Program.Unwanted.4695.31890.17277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff404661-e0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682160414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160414, "uuid": "89859b06-dc05-4901-a9ee-b541f401a407", "comment": "Malware payload (SnakeKeylogger)", "value": "87a5e1c6ba434b70623cebc721401d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160414, "uuid": "499f2c35-652f-42af-aad6-7f6e0768349e", "comment": "Malware payload (SnakeKeylogger)", "value": "8ecfe073dffd0f788e9d22b4d25854b0b9f2407725988a19d0bd54ac1990ab1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160414, "uuid": "fc904715-449a-4aa5-b43d-21b9ba07ec4c", "comment": "Malware payload (SnakeKeylogger)", "value": "e2e40c34dffb6bb78ede6cd39d7d5d10c33e866b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160414, "uuid": "d252e319-1fc8-4a2d-a8c0-94c8e683bae4", "comment": "Malware payload (SnakeKeylogger)", "value": "3197ec9eb36cdab364dbc0f441a0002cd8f6d73eddfefef484b75810515c2837029f17c9a0e9af24caa9a5d33b4dcf6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160414, "uuid": "b3ed5434-860d-4967-b191-3c6b7a47ace7", "value": "T15AD4E0B57127AFA3D7BEC9F0124862451BE63BA7767CF1ACAF0E30C516B67800858593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160414, "uuid": "6178176a-7d83-4405-b870-967829fcb8ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160414, "uuid": "5fb6808d-622d-46c5-aec6-201c842c0386", "value": "12288:y+72iNBTysnyF5YRp/J2TlgJccysu1My3410tFIhVd+CPLr2/fFSt:z1egygRp6JJrx3XG+QWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160414, "uuid": "f1c8b465-2a01-4474-9ee6-7e348eb4bb34", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160414, "uuid": "70fc3143-80ca-489c-a1a3-e78308f4aa8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160414, "uuid": "7e1d0dc9-8713-4e4b-bf12-7427bea6106e", "value": "205903714-003843-sanlccjavap0003-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304e929a-e0a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682125278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125278, "uuid": "52f55755-5e64-438b-8bfd-bcc49d5088c6", "comment": "Malware payload (Smoke Loader)", "value": "95629aa739adbdfd41cdac13fc78dfe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125278, "uuid": "0c3a4247-c21a-4586-97d4-15baf4fcb289", "comment": "Malware payload (Smoke Loader)", "value": "8f5940ae9007543b61390c7f1e24d7fffe518ddf7c55d839a259845eaa6a5f8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125278, "uuid": "3df0ef5f-a085-4b94-92e4-60eda8c859f6", "comment": "Malware payload (Smoke Loader)", "value": "a619b967200e5fe841385a7b73e434a24237fc46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125278, "uuid": "fac0d708-aa2f-4710-a099-af9f6bc5c25f", "comment": "Malware payload (Smoke Loader)", "value": "2a55d4af118cf2504d5224d6d3b38e99e7c672d676a9a8d49322b70cf90bd62c31bf80a2c1a21a070e17ac47a8887008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125278, "uuid": "d19c1597-c654-45a0-85b1-1a30d3648070", "value": "T1EA34E100BAE2D476E96781B42875C5D9BA7F7CE6AB46829F320C2B5F1C712C18E77311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125278, "uuid": "2efefe22-cd21-4d30-9bb4-c68c34ed8f84", "value": "83f7b03b4e2f4d598c9968669b5cc91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125278, "uuid": "c40b9636-bfa1-4cae-a54a-238b120c2b54", "value": "3072:IykeX0I1Cu1Pw4Au1SbrLy+x8hYRTJoEWdVx5XGN+0WFhZOrV:IHeXvcSPwE1SPiaRTJF6RGN+0wYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682125278, "uuid": "4f97d116-b205-4cda-b97b-4bef6d0a76ea", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682125278, "uuid": "25461292-9f8f-4f48-a7d5-8b2f0dbf55ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125278, "uuid": "3cf18623-76f3-4a42-ab4c-5365d95f1590", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ba8b2d-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137717, "uuid": "8e914f0d-c7df-47d2-8292-6663218d39df", "comment": "Malware payload", "value": "874691ab1c309c7782b2ffa005ba68d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137717, "uuid": "b78f5621-947d-400a-9509-529e7f2d7f95", "comment": "Malware payload", "value": "8f5b0ad20ec07608cd2787d783b724ec890530d3c3acdb5224107af2b0d3fcee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137717, "uuid": "f9680398-71e7-42a9-b70e-461091c80287", "comment": "Malware payload", "value": "5ac8293e7cdfc146f6eafdad5bf04ebf7b75b8a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137717, "uuid": "599029ae-fa85-478c-9e35-46717c45d453", "comment": "Malware payload", "value": "a05e39797053c531aa6a225068e725970a6925e00a896808e8bf6932e03f64cc1d753fbcd82e48c8af15cee0c3387aa1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137717, "uuid": "a58207f0-95e9-4138-b974-21d18a05573e", "value": "T144C3184033F88728F5FF0FB0BA7089518936FE8ABD25D56D0A6250CE1972B908D60B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137717, "uuid": "a5cf8dba-fcd1-4269-83e4-21b02c78a501", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137717, "uuid": "7cf4d57f-7f8f-4988-933f-9e3eedd58793", "value": "3072:A7dPUuMx0pvRRFi7T2T9UhlFj5qgHtHpdXZri1di1+:cpJRFi7KT90zvC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137717, "uuid": "e2302a26-b343-47e1-90c4-090d6fe65a99", "value": 121120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137717, "uuid": "afcaf0a2-5216-4464-88d4-c05369eef576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137717, "uuid": "ce111824-417d-4bcd-af46-099f375d0872", "value": "SecuriteInfo.com.Program.Unwanted.4695.16185.17709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01beee13-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682160418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160418, "uuid": "334761de-7459-4156-93f4-a733b88d5a82", "comment": "Malware payload (SnakeKeylogger)", "value": "7396f86cb0779358bb89ab2c7419a7df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160418, "uuid": "4e7185de-8990-4353-aacc-c31fd8c850ac", "comment": "Malware payload (SnakeKeylogger)", "value": "8f90611a7d29f7e832d55fe1587107d30c53c2f580c45ea09c4f0cf45fe7cc7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160418, "uuid": "b24fc501-8078-4ed3-b8a1-d8922fade405", "comment": "Malware payload (SnakeKeylogger)", "value": "abe566718fa1126828d29260f37b6ad408c954ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160418, "uuid": "33562f90-ce83-4c68-b8eb-fde6e7d6b80f", "comment": "Malware payload (SnakeKeylogger)", "value": "8fb6dc26a5c3f04755c10b55a5f54bf5d7136f42e29a8a5235d06f8127a53c7a6983472e96db9313bc6cc81dc26a0d65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160418, "uuid": "a091afa2-91df-4236-b8e0-cfd54eb23b5d", "value": "T1EFD4F1B9B267EFA3D7AEC8F0124867961BE233B37A7D705CAF0E44D01687394485D492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160418, "uuid": "de8de73b-3eef-4ac5-b3c4-ee50e2c250c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160418, "uuid": "24e55f65-45e4-4b2b-ac46-87d095244a05", "value": "12288:qEsjs8mStDsWzN/TA+QyXv8EgMiSnbbWT0ilqIfZIoOrsSW:vOhsWRrAW/unxT0qqIRUrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160418, "uuid": "5b84629b-2151-43bd-b39b-d136a8cc0ad5", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160418, "uuid": "ed069991-1365-4ba4-b3ac-cdd7bae559aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160418, "uuid": "feddfd6e-24a1-4728-824a-5b7abf00302a", "value": "MV Nicos Tomasos Vessel Parts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2de0e7-e15d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682202934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682202934, "uuid": "57ae9b55-0ca4-47cb-a281-cd2cd75f4747", "comment": "Malware payload (RedLineStealer)", "value": "eb74d0d4d8b69b2fa1b803c8b1c8bc08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682202934, "uuid": "fc40a416-c68d-4209-99d2-bd72c692e056", "comment": "Malware payload (RedLineStealer)", "value": "8fb098a2a55b53cf998145f53784f77ce02234ca1be0e3c204cc4d1f63fade37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682202934, "uuid": "facec42a-e766-47f4-972c-82f2c7c2cb93", "comment": "Malware payload (RedLineStealer)", "value": "29706f8de8f4860498393d4b6e337d079c43b23e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682202934, "uuid": "0b6a75da-c464-4df8-89f9-166c045dd0aa", "comment": "Malware payload (RedLineStealer)", "value": "5754ec9a0257a0dc65a13843a2d044b7a5e41626765cd5514faaa85b17443276c5c6015f364a426f01047e02553f57d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682202934, "uuid": "9cbc81b3-ab4f-4e22-871d-a3ddbd65f20c", "value": "T117C41213B6E495B7DAB9677099FA17C30A357C828735879B2785F90A0C339C0A831777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682202934, "uuid": "0434aac5-a7ec-414a-99ea-8f1634f71961", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682202934, "uuid": "47cd1c56-38f8-40b5-9db0-ebb566faec9f", "value": "12288:Cy90ai+QAdMkezA236V6yCc+6uWeEc7/6thfyv7GFJJ:Cy/ivALB23xMuWjTbF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682202934, "uuid": "0dcad053-b9fa-4aa1-8bd0-c5b11b7af232", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682202934, "uuid": "2d24133e-7a1f-4a39-b84e-b23e8fe21923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682202934, "uuid": "c42a7592-0060-4581-9f67-6e15d36b03fc", "value": "eb74d0d4d8b69b2fa1b803c8b1c8bc08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762d749c-e0cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682141716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141716, "uuid": "43f995bb-d7d9-4ecb-8093-732b08874a3a", "comment": "Malware payload (RedLineStealer)", "value": "5e691ffb9be82b2eaa7da6e791d7fc41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141716, "uuid": "e74e4d5c-22a3-413a-9761-dc20fb89d81f", "comment": "Malware payload (RedLineStealer)", "value": "915ede019831160328c2e4fbca911d31e8782f9c83be43c8704ec06d5cd926fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141716, "uuid": "ec9dd8b9-000e-4c75-b2af-5efe628b87a8", "comment": "Malware payload (RedLineStealer)", "value": "373fccb11876172f25ea5c3088154d05d60ba9a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141716, "uuid": "51149155-2f4d-4b58-b65f-5ef07695d4c7", "comment": "Malware payload (RedLineStealer)", "value": "8520318c8dbf2e2e40d91fd64724d916ac004b19f5399b2a486fd390897a2d5c54b27f5e3f67246d57e52b3f045d5c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141716, "uuid": "1d9177f8-073f-46bd-839c-a8a6409154a9", "value": "T1E9352323A7E840B6DCF527F01DFE33930639BC911B6483AF299656DB19B35C1953132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141716, "uuid": "345a9fbd-8cdd-4b5d-910b-b82c553f93c2", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141716, "uuid": "8b5952cf-a5ba-45b4-979e-9d28da853796", "value": "24576:vyad+1XL9+F9OoFzDNBE/kajUdENEEDGgoC2R2ZyvQCl:6ge+PnnfE/kaqJg32Rgyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141716, "uuid": "f1148a49-ab9e-4874-8b15-874f18f23b6a", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141716, "uuid": "edf05466-1734-4a56-b08c-1eea815d0917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141716, "uuid": "b7959d6e-dcf1-423c-8a65-2364c7be870e", "value": "5e691ffb9be82b2eaa7da6e791d7fc41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77263a45-e0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682147730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682147730, "uuid": "f55db8cf-e0cc-4bfd-b869-521bcec0626c", "comment": "Malware payload", "value": "492af928bf7209037aab62c05b82a75a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682147730, "uuid": "b2dfaccc-c870-41ad-b3bc-8afe3d0493a2", "comment": "Malware payload", "value": "91caa1fe289cdd8500399b3dcb07a5417223126a8cfd6833ece052acaaeb27f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682147730, "uuid": "678f0f32-d9c7-4bb6-a54e-4da4cef16f66", "comment": "Malware payload", "value": "c24a6f7736e125620abed012b4545ddeeac0675e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682147730, "uuid": "c1b01f8e-a41b-4ebb-b53c-a5baa8516504", "comment": "Malware payload", "value": "7f1eb82ba532f0607fa662d54edf05a99af739106107e35af912ef24849f255bf89d35322534aaa1c2e774b4d85ad042", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682147730, "uuid": "67f71e42-0218-4653-9be1-58c41d080209", "value": "T1F836AD915BE84960E6BA4A3424F987407B71FDD2540FEB0B1264B27CDD72B887A2173F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682147730, "uuid": "5785b2f2-42a8-4743-9429-9a986e25db48", "value": "49152:3Gbf5gfKJu0zf4R+oUN+edPTPR5Y0Pf/deh/1XwshSLGI/trdxblHK:cFlRm01+j0BA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682147730, "uuid": "08a08a02-c42e-4c5e-8b4a-b7a575590520", "value": 5243360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682147730, "uuid": "21e986d1-2815-469c-a379-096e8aac9209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682147730, "uuid": "8bc53f43-4aa7-4f08-8a1d-346ab5dae10d", "value": "2023-04-19_492af928bf7209037aab62c05b82a75a_alina_aspxspy_cerber_darkcomet_derusbi_dridex_inception_jrat_lazagne_lockbit_mirage_nautilus_neuron_plugx_redleaves_rurktar_sliver_th3bug_utkonos_wannacry_webshell-shell_winnti_yayih", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28892bfe-e118-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682172939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172939, "uuid": "65abfc33-07c9-49ba-baf6-54f16660ee30", "comment": "Malware payload (RedLineStealer)", "value": "6f9e62d0b6c4578041bb7e5f260a3af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172939, "uuid": "830595dd-2cc9-4e53-8c70-1e71f114eaeb", "comment": "Malware payload (RedLineStealer)", "value": "924bb64c850bee5e85982d3acda1e43ea0f5757d1147b0b4a4424f771a312414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172939, "uuid": "ccc64010-952d-4295-a285-5be3b879c22c", "comment": "Malware payload (RedLineStealer)", "value": "99a757be872960e28dda4cb2fe97a4b606065158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172939, "uuid": "858bbd82-2ec7-4345-afd2-4b27bde60acd", "comment": "Malware payload (RedLineStealer)", "value": "34ea8294d19553687a5da215bb8452f8f7b692ff1bbea5e9cfc25a423b08add4b3d59941e7f3f29189288d51c3de80f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172939, "uuid": "0b2205fd-2208-4364-9188-ae9d22a18774", "value": "T127F41225AAD81533C9B817B00CFA03531A32BCB29FB5A2EB12565D9F58F32C4653537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172939, "uuid": "33575b40-9561-4fbe-815c-2c8394f5b590", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172939, "uuid": "fa44f5c7-e4ba-48de-9874-a88c6c9f4c30", "value": "12288:cy90EHGH019kpTfCWI9r/tgg12QwRvXZtRhvTNc+CPPmr9:cyTTAdaW8rXWFhyPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682172939, "uuid": "4927e2e2-ed59-4536-aea4-97eba14a6639", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682172939, "uuid": "bdb23909-618c-49f6-9750-0ff84a76aaea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172939, "uuid": "bd205b70-ba0a-4fd7-9d5c-9f2ccfd61434", "value": "6f9e62d0b6c4578041bb7e5f260a3af2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b195086f-e0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682147829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682147829, "uuid": "5ce80a17-fa4c-4187-8949-38ab4167162c", "comment": "Malware payload", "value": "9bc09193c5ad569ea860bef8ef467541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682147829, "uuid": "0705a707-0120-4943-98bd-4ff46347235a", "comment": "Malware payload", "value": "9542097b42aca8a4af7b2d1851bb19e0eb27aa638b3fb82a6c506869799dfde3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682147829, "uuid": "df4678cf-e115-48b1-93a6-103565f7910b", "comment": "Malware payload", "value": "cb565a80967316992f49be37377737b70e7d715d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682147829, "uuid": "7e24d74e-68f5-49a0-9fce-c5195c500a82", "comment": "Malware payload", "value": "c656787ae6c878a36193413f4daa6dff4be1691ac240e7b52e36859c26f975dd18594e2e93191f1ba8e279ae56ba3555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682147829, "uuid": "7dd5d582-f6ab-4adb-bf40-f42414594aed", "value": "T11B65B68DFAA0759FC81BC572CAB91C68EB6074BA931BA607955311ECAD0DB57CF040B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682147829, "uuid": "e9237911-3068-406b-a65a-520d4eac6015", "value": "12288:g3wCTiSYTesq08diBsZR3jjyEiPM6iM8tHPiXnLTEXFEUtzlDipEgYdtQNFF5nt8:g37ZYZq05LTPVAX/qAL8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682147829, "uuid": "abcdd860-a0e3-4f9e-b70e-dd89acaa3ee7", "value": 1413632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682147829, "uuid": "ede95f78-bc7f-41d3-a1cd-d7aa2df3fa05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682147829, "uuid": "85271fd2-0a62-403f-9c03-226188d42a49", "value": "sync.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17af75e5-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137692, "uuid": "07d4eb86-c1a7-4381-90c3-f99235536c84", "comment": "Malware payload", "value": "c55d949fa9d7fd3ee38f7893206d8a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137692, "uuid": "ddbd4aed-5ced-455d-ba56-7926009d9499", "comment": "Malware payload", "value": "95c60e9c5c0e0ebe7335380bc7fbe34569f599196c930a47453dc034105e415f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137692, "uuid": "be515a9e-d1b5-46a1-bd9e-53903778f560", "comment": "Malware payload", "value": "644cd2d3f3876312adc7a9754d3dd2d8ca67122a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137692, "uuid": "6844da1f-28b0-4fa5-bbb3-f79099cbe793", "comment": "Malware payload", "value": "d03506c1301765847cf0461835a1edae6ca84be12246e0497362077b98cfaff7394bfc40b9ab3e58664342f989ee892d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137692, "uuid": "8411d082-7537-4f68-b49e-a65f0b34216a", "value": "T1836523D6D13200B2D0D1A9348F2AD66C98A67D671477A9073BCC89CF1F37752AA4C3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137692, "uuid": "462e4cd2-e295-4f81-ba30-e27068c39241", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137692, "uuid": "a0542629-e951-4895-a19e-052d08b489b6", "value": "24576:/20PMisdUO7fAEGOh9G1lGrnD1kH6SfuVJPVFRswKbL3CBZzYUkvYu:/2P5UO7fFGOhEarnD1PrPDRLKbLyrXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137692, "uuid": "445924e7-02c7-4de6-971c-901ae28ed4ea", "value": 1438683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137692, "uuid": "60e8f436-9bf1-40b4-aa94-ce3b8d8d9963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137692, "uuid": "b291ecd2-098b-456c-aac0-a299e341c150", "value": "SecuriteInfo.com.Trojan.SuspectCRC.10939.27311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01d107e-e0e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (MoneyMessage)", "timestamp": 1682152631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152631, "uuid": "7735f0c8-4fc8-4784-a9d0-a33acfc2804e", "comment": "Malware payload (MoneyMessage)", "value": "e70eb7f6acf733b30aaadd02d9feac21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152631, "uuid": "8d9e9abb-e7ab-4b94-81be-6854a7e1d0ad", "comment": "Malware payload (MoneyMessage)", "value": "97abcf01deea74eb3771ddcef8bfc0906b46a55172588de8e2ad20f8d92b2de7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152631, "uuid": "c403adbf-529b-4313-bd65-16e64d149131", "comment": "Malware payload (MoneyMessage)", "value": "849d1bf04a7a7acd20ce74300c626a13cdc35780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152631, "uuid": "61bf220a-653b-4011-9c5d-46f68a5ca2d5", "comment": "Malware payload (MoneyMessage)", "value": "ebd049ebf1d55d1ca73a656f6f322995505bdb4457763b1c6000373d07f04e8e2ef097d8b988d732cde48f2d916e0503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152631, "uuid": "d80f4355-0cdb-403b-bbc8-36512021896f", "value": "T1B5F49E313585C037D5A201B24938EFB5A6ACF9300F7519DB73D41B3E9A289C26F36A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152631, "uuid": "5ec5abd8-5c8e-47b4-ae7b-7491ab4df975", "value": "1fce1172b1846e03a9af5ff84d37390e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152631, "uuid": "94ef1789-f366-4a24-bdea-6794cf1869ff", "value": "12288:aH3fcbXX/qkpwGarA0iKKjk/1RobRWGDmEd7nLTzGnabKJiW:aH3fcbXX9pwGarA0iKj/1RCWGDmIHQpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682152631, "uuid": "8ee0ddb5-02c5-41c8-86bf-f442bf36b8bb", "value": 784970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682152631, "uuid": "e1f85159-2b1b-4a13-9c3d-e1dbb8a8f3f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152631, "uuid": "1d186a55-3235-4304-94ec-938bc3d540ac", "value": "97abcf01deea74eb3771ddcef8bfc0906b46a55172588de8e2ad20f8d92b2de7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c77ab5-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137658, "uuid": "bf0c0c8e-30f2-4c49-bde4-19b351c50c37", "comment": "Malware payload", "value": "d0350919752e8801250f8c72ec8ef4e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137658, "uuid": "57d692b3-8704-405e-b32f-b8b04d27c67a", "comment": "Malware payload", "value": "97e3c5f57428a2a90ae206ae0e1aa6b1f97331988583519f895a3e61903f8b85", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137658, "uuid": "076ec17b-c51c-48d4-b402-3ea916d7586b", "comment": "Malware payload", "value": "18fd8c9956f7bf9af3d4bd0ecb6bca507cf65a54", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137658, "uuid": "a127b55f-6990-4927-9a42-bc21ced042a9", "comment": "Malware payload", "value": "f6501d3a32f3fa1b966f42db52e30dc9b7e03dbca9dcbec85a8b33e002a3e49b2fd0def30fac422a4c32402a33f81be1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137658, "uuid": "b9d3eb66-735b-479b-8749-e795cd301920", "value": "T134535D442B9CC6FAD7EF857E99B0C114E937E4ED6FB64AEB724182860C413C26536347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137658, "uuid": "dc22f76e-0144-4159-9389-f8e67ae3aa54", "value": "cc24e7e38f44351beaa44b77d5dad00f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137658, "uuid": "0f15958a-48f9-4d9d-b845-dc551b9b024c", "value": "768:1rBX7I72YM1scqDAntonP1ZlojsSQobxMzxi1S8i1vix:1rd7IkYd3onQi1Ri1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137658, "uuid": "9d93b2a9-fcc5-474f-8aae-bfb7b572ce90", "value": 65824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137658, "uuid": "8460793e-39e6-4590-9b8e-078cb14689d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137658, "uuid": "fd0e8695-ec4c-4fda-8f2d-94d7d2d5422f", "value": "SecuriteInfo.com.Program.Unwanted.4695.29225.24673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8fe098-e0cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682141728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141728, "uuid": "3543beba-c7b1-414f-96d1-e9f8ca450ad8", "comment": "Malware payload (Amadey)", "value": "7718766758fd244878c9b54c008b7c52", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141728, "uuid": "28cf4065-45c6-4a8a-83e1-289e3139bb05", "comment": "Malware payload (Amadey)", "value": "97ebebcbda6782efaf1fb23bbd15238dcb3fbacfdc3526383756a6bad371db97", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141728, "uuid": "865bb81e-d68e-40a9-bf4e-13135cf84b07", "comment": "Malware payload (Amadey)", "value": "194277f734170ede79eb88df1c9092f547e870de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141728, "uuid": "d888d960-7283-4694-80f9-818d407375f9", "comment": "Malware payload (Amadey)", "value": "3729aa424bd076b4760e096ce5b839550c1f0a31bb4b9af37bd0337577ce5a934212975bff0667cea4d0147b105a8056", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141728, "uuid": "b9fda16a-18a8-4086-86da-09d6df8e72b4", "value": "T14B15230277D99673EDB917B048F502C30A36BC509B64535B228D9C9A9CB3AD0B63277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141728, "uuid": "c5e5d81e-d59a-459a-9bc2-85fe98535075", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141728, "uuid": "535423b6-59df-4d56-b1f2-1e8bf77f3a29", "value": "12288:zy90PYdHwFYHjaHzfL//GpShvnWzIW31uoS6xs3bBCT7DbhazxIBkv:zydH5HjuLGMlnwb1uoS6xEbw/OiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141728, "uuid": "a8ea4b40-cd89-4427-82c7-f7c804d33951", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141728, "uuid": "cb4b922d-48ed-42a8-8d0e-f8438448598b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141728, "uuid": "506d9886-da1a-47fa-bc9c-f12255c798f7", "value": "7718766758fd244878c9b54c008b7c52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073672b9-e150-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682196935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196935, "uuid": "5e2109c1-a6f8-44c3-8285-c5ed3d0d879e", "comment": "Malware payload (RedLineStealer)", "value": "5717e4280b88845b3ec8c942ff1aec95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196935, "uuid": "d2e6a2db-a325-4a7a-b150-f81d5a9b7416", "comment": "Malware payload (RedLineStealer)", "value": "98413db091f874ba435f93d08efbcce543ba017eaff92b26fc834284cf3c5465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196935, "uuid": "49115cc3-70d5-483c-803e-2884af0dc227", "comment": "Malware payload (RedLineStealer)", "value": "fa44e8c8d886b96166b39fc689cf35e30de7b6a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196935, "uuid": "1466aca5-1aea-4ea7-8fba-4f46f18b793c", "comment": "Malware payload (RedLineStealer)", "value": "d09b060d7b05a49ad939f3ce188730d2722b1cda2eb31334c9e05c98a63e5a4f9fd4f39651754c596773bce3873c71e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196935, "uuid": "7ce46a49-f7a3-4848-adab-ff0f65393553", "value": "T1FAE41263A6D88132CDBA23F05DFA13871E35FD9256754BEB3358AD4A0C728C5A531363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196935, "uuid": "36841246-30fc-4545-81c0-233c7f7dfbd0", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196935, "uuid": "920524d4-e2dc-4fd5-8939-58c6810e1add", "value": "12288:wy90jnZsEBSmhDEGK8vZtQpqaxWuntZuYyEcY0MW5mBoYW:wymZsEoyEH8v8pNxfDuYvi0iYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682196935, "uuid": "5d351a3c-5f08-4cd5-b3db-741f196ac07f", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682196935, "uuid": "7379bd7e-3431-4963-99c3-2bf7641ea7dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196935, "uuid": "2704f5b0-2c11-4f1b-9ff8-147f3a5fc926", "value": "5717e4280b88845b3ec8c942ff1aec95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0204da94-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1682137656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137656, "uuid": "067d0276-eaf4-46db-a039-aeb3d0a5a581", "comment": "Malware payload (Adware.InstallCore)", "value": "a69ce192f9035e4b8d84c7949b7fabd7", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137656, "uuid": "8a857c2b-64aa-410c-85f5-496bb2a25c3a", "comment": "Malware payload (Adware.InstallCore)", "value": "99b0100da4ed2fce00c050f27478096e6c7ef856f9ff8e4302205449ee3d331f", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137656, "uuid": "2d64c5c7-a5e3-4cd9-924c-2ea47dd54541", "comment": "Malware payload (Adware.InstallCore)", "value": "b800cb5cc6e4192740ee39278e68137891549112", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137656, "uuid": "205bff68-8e74-405e-adb2-44a702325b50", "comment": "Malware payload (Adware.InstallCore)", "value": "8167664f715d57b39ba3e23c07143fd58137e3e88a97e69056c215cba63014bff6f7d8144c15cef5e43e32935f5dff32", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137656, "uuid": "67592d3c-f839-46e7-9f6c-cabc955b10d4", "value": "T17226331BEBD0B9F4D61296B4802909C65F2A7E53F0E0A49F35C8131E5F8EE4F8836746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137656, "uuid": "ff97c7eb-40fa-4ea5-a1f6-94b4a82bd0e9", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137656, "uuid": "0afad1dd-9a66-41fb-9ccd-b813ac1b7cf2", "value": "98304:c53RblzfDLAUGNuJ6fcH4JaIxICKehN07oh/NvVt4YUGcZKD:CR30UGXvh/NBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137656, "uuid": "0a2fa3cd-98b9-48f5-ad49-7e61aefa6e9d", "value": 4599345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137656, "uuid": "171ed16f-4062-41f7-bbf4-9d7598a4f955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137656, "uuid": "b830ce81-1b7c-4d62-916a-d2ed8418e8b1", "value": "SecuriteInfo.com.FileRepMalware.21407.3166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe36c4f3-e15d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682202933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682202933, "uuid": "11499d57-4903-4e72-a582-a2f10829d76d", "comment": "Malware payload (Amadey)", "value": "74abb9dd0d657916ee501c9958a862c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682202933, "uuid": "93f3d4d1-2dec-462b-b589-6bdc91e7e2d5", "comment": "Malware payload (Amadey)", "value": "9ac2d8c4467f18f037a73a9048feda19a6a53885eda58e59ec5d941f9f5c1d8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682202933, "uuid": "20017ebc-e5e3-4def-aa89-b0118bd909c2", "comment": "Malware payload (Amadey)", "value": "65f9b6164ae5fe5be987ddeb2b6d80db41f63adb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682202933, "uuid": "af44e8ba-3b3d-4456-9f19-faef15d8b3c4", "comment": "Malware payload (Amadey)", "value": "225639772b6622b66e3081ac60a898fd42fb021f23c6c989f880626f33c2ab3068f0edf1693f7cdf2852045cce180460", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682202933, "uuid": "0746e660-4e0a-4a34-9a49-e8ef21ad62d9", "value": "T10B352316BAC08163D5FE17F09AF956830E31BCA22EAA47D727D8E55B0C23AD16530377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682202933, "uuid": "491b4414-4a63-4245-8c9d-371c316e917d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682202933, "uuid": "53307be4-fbca-4719-ad24-b7b1ecdfc7b4", "value": "24576:wyrXvZ37dRXL1sxkgSgm6dWlu2O8TSzY8D6Dk3jeG301:3rB3BR71sxwEjH8TSpR3H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682202933, "uuid": "717a878c-e75f-44e6-ac31-7f225a4d700a", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682202933, "uuid": "5f8e23d6-5f6c-4894-8e58-5afec86e1961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682202933, "uuid": "ee59e096-445e-439e-a9ba-2e46bd35cf55", "value": "74abb9dd0d657916ee501c9958a862c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a3af00-e0a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1682124995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124995, "uuid": "da153d47-24eb-48f7-9ddb-97b460d24fe7", "comment": "Malware payload (Stop)", "value": "a6d373430a8ca2e93109f8791508f2bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124995, "uuid": "882148a3-5143-4b7c-b431-b4d99ad0dd8a", "comment": "Malware payload (Stop)", "value": "9ae628709cda9d39568cb07e8e90529eeb7b9ba165dfe844980d12ec46661c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124995, "uuid": "e5de1eaf-1bfc-4a15-b3b2-41208dca66d9", "comment": "Malware payload (Stop)", "value": "e9a58acd2626dd03d484fa23ed8a83410ff96672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124995, "uuid": "b062cad4-7c44-43cd-958f-4eea55eb4822", "comment": "Malware payload (Stop)", "value": "1f944edadc51bfb7e9c10fa657452b0aa0fb5e661d1dd309cb3caa74f2efdc175605ace82a0a30cddfb07692c045cbfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124995, "uuid": "e5d33834-df88-4bc6-9e97-e7e5729ca797", "value": "T125F412C0B2A3942BD12A01B095718BB56D6DFC915D64C66F1308779EAD723C32BAB373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124995, "uuid": "0ef782ab-f9c3-4762-90b4-72e3122a1c37", "value": "58caad1cf35d335d38402407410cf4b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124995, "uuid": "5a7359b1-6257-4093-8094-c1155580092f", "value": "12288:w234nkWVoLwvk0IW48GeD6U5D4Xs1Gvu4MwqxiM3:wdkEoZNsF44Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124995, "uuid": "dbe7c707-4a81-4771-bb07-6a422514a722", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124995, "uuid": "559fe496-b26c-48db-9eab-687bcd7f02a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124995, "uuid": "c6fa46f7-cac0-40e3-b3c6-ccbe1d77dd64", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945c8ddb-e0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682160235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160235, "uuid": "a2e71cfb-64d3-4f44-83b2-f2d9e0f816c3", "comment": "Malware payload", "value": "03936e1d5952729c0c6bac3c200739cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160235, "uuid": "3ac50243-0dd2-4d08-9a2c-cd8b7ebc03b8", "comment": "Malware payload", "value": "9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160235, "uuid": "9092a3e1-853c-4c60-a825-3bb923869398", "comment": "Malware payload", "value": "d9eb8ad31e1d74f1b2bad2b664e8c632b1a246d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160235, "uuid": "81ef7705-b096-4b1d-ac08-6d39e42108ac", "comment": "Malware payload", "value": "88e1e918e4a95b76c4f2098a69e4d59f7b40b42f89c11dbe8aa1b0ecec4c7b93bb1b4ab7a8c33476166bf8e9b723b4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160235, "uuid": "7de009af-28ee-41a2-b8fb-6305f8258bb0", "value": "T1E6F6233FF258A53ED45E173245B3C6608A3BBA60641A8C1B1BFC784DCF765700E3A65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160235, "uuid": "fd3ccfaa-9728-4c9c-a06f-6a8f5a2972d4", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160235, "uuid": "fa8f2d92-d0bf-4ed1-bb63-e5f8db3800b6", "value": "393216:3i5ceG7XLCPa18feHZSr7EdKTjxjj2hU0OcA:3veoLU3ryQhj90Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160235, "uuid": "4da5c3b9-5249-43e0-b1de-544c832b5b54", "value": 15725573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160235, "uuid": "5eb5054f-0451-45a8-b610-90623263523e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160235, "uuid": "a0b4bba8-9a62-43bc-9214-c27ad19ad336", "value": "03936e1d5952729c0c6bac3c200739cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da92d7d6-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135442, "uuid": "bcaea68c-a8ae-4c26-9ce0-e5190ac9fd6a", "comment": "Malware payload", "value": "44f3a9311b23d84f336cc5b856f16682", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135442, "uuid": "4555a5ac-878e-453f-b69c-2e56dc228586", "comment": "Malware payload", "value": "9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135442, "uuid": "055e1a81-7153-4f60-aaab-cb72a4a539a8", "comment": "Malware payload", "value": "45e9f3c9836926822d4164848dad0dc6d5fd22d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135442, "uuid": "9443ee44-c301-45a7-ba6a-49318fcfbc88", "comment": "Malware payload", "value": "99072fecc0944eff7694b67763e310b9cd94a785a04413604ccecd3ee978b05a7f2d873390eddf78702faecc5d6ef154", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135442, "uuid": "e114260e-49ab-4530-b33a-7fd25fa9ab85", "value": "T15BF34E383EEA9029F2B3EF765FE4759ADA9FB7633B06944D1081034A0623A41DDD193D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135442, "uuid": "3836e078-5d79-4e41-9a89-eb8cf97d20cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135442, "uuid": "210a0a6b-374c-4bb6-a13f-c9049ea7be16", "value": "3072:k3kw4Rlr9i0uIYGSKrG8yaJYCZWKuzfo5dXuZRodZXJvPbtH:64Pr9i00GrtUwJj1hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135442, "uuid": "c212c11a-0d3f-4dd6-859a-d614d63eb148", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135442, "uuid": "5de8cd77-bc2b-4f42-8ee2-0226162ef82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135442, "uuid": "9628623d-d2f6-40c6-9ff6-a6b2254cfd48", "value": "2023-04-21_44f3a9311b23d84f336cc5b856f16682_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dc1a98-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137714, "uuid": "4f051db6-e50d-4e28-85f7-5fc3ad890eb3", "comment": "Malware payload", "value": "8fab253a71b00727b53c5cc0903d6a0f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137714, "uuid": "a9b1149c-e304-4afa-8ad1-c6b4e2ecd67c", "comment": "Malware payload", "value": "9dc3a1a3825f49f80265c202dc24f4415a5425e90fcb73b3a7ad80aac1b06bed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137714, "uuid": "6b95bfc1-42d4-4026-86a1-78a324cf32ae", "comment": "Malware payload", "value": "897b71dd6b751b66fc93709024c2678e1bddd26a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137714, "uuid": "1d8da2e4-da2b-4c76-bb8f-b18815a646bd", "comment": "Malware payload", "value": "29f03ce7d482ff398d7a0b933a9dcefcfec8db34c0ce2171155775cddd9e770d5251499042cdb27c1834f068498da9b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137714, "uuid": "4405ea74-3aea-419e-8fe8-7e0017ac69dd", "value": "T1958229DA0B943133FE436DB1A7CAD71A9A76F3E0DA91C49F10AA82825EC0390376543D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137714, "uuid": "dc9dafc3-4b79-4c6f-8589-fe69a842059f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137714, "uuid": "e189e43f-851a-48db-83c5-faeff66e7c70", "value": "384:IipnOdlYTCUAXcnYPLaiSKTGiSKsi7bLv:IipnOdlKCUAXcxi1Ki1si7bLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137714, "uuid": "64593c05-619f-4e44-9753-191f32b478ea", "value": 19232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137714, "uuid": "eced35d0-b754-4cef-a311-1c27f458a0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137714, "uuid": "070367c0-525e-4ada-ad66-68039091527d", "value": "SecuriteInfo.com.Program.Unwanted.4695.2715.17355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f4523f-e0f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1682156107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156107, "uuid": "5252140e-a924-4147-9e85-fe351d39aa07", "comment": "Malware payload (AgentTesla)", "value": "3ecd1a9eddd94cb8761519f43c294da5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156107, "uuid": "c408c314-4328-4ef1-a8af-9d3ccbdcf9fc", "comment": "Malware payload (AgentTesla)", "value": "9e1788c269afe73af312508280bf1f8ca7f9049d47e4f0b125c7a75c98610e4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156107, "uuid": "8d0ed54d-b23c-46aa-bb81-2530be7299e1", "comment": "Malware payload (AgentTesla)", "value": "31e912294a59db045ef4b5e19ba1fc9ac4e71dfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156107, "uuid": "3ab673c0-d6f1-4b16-ba54-97cb3981aa05", "comment": "Malware payload (AgentTesla)", "value": "227890f038891dafa7ed2d1c7a9f1a4a315d51a1e795d339280503a82037b008c4348e561c409b5fddf1fe688fd950aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156107, "uuid": "d92c5207-2670-437f-8448-e91c99f285d8", "value": "T173E46B3959AE4BE7E038F7B5CE355814B3E0D406B359FC7AACEB01840652D826AD127F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156107, "uuid": "ccb0d12a-88e4-4c16-be8a-e23790880f97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156107, "uuid": "ea0e51ae-1b39-4a79-bad8-96ff56042442", "value": "12288:kuiA+QSF+Yd2iNrn9xGoFPsggnOAH1OzAGGdIEO63cPaM3:n+QSFpd1rxGyPjgOAHK0si0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682156107, "uuid": "c76efa23-db7f-4912-894d-0ce2d62c84d3", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682156107, "uuid": "74949f9c-e861-41e8-aab0-c14768d4740e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156107, "uuid": "c55cda1b-a0e1-49d7-94b5-dcb639c2a81c", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabdee4d-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137643, "uuid": "8a5b0157-0ec4-4b86-9d4f-ef984eb48974", "comment": "Malware payload", "value": "92754259eef13c0228c4ad41a0dab4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137643, "uuid": "e95e037a-7bb7-4313-bfcc-d35e7f99219d", "comment": "Malware payload", "value": "9eae518b0c636156f092a716403979adc1330b9b5c3eed99d10b0b39d7bb342a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137643, "uuid": "f4b96f1f-161e-4c8b-a47e-74a5e5e5aa63", "comment": "Malware payload", "value": "03c7f81529da61b24d67f033db1bd36e12622f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137643, "uuid": "76142787-4abf-449e-b708-4e9832d9bc1e", "comment": "Malware payload", "value": "c709824235e34dc06f6a5bb83af847cedc9a39e2dbbb9a1cefbdf81367a6a7266f2c4029f717b11e152931055f3f7365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137643, "uuid": "d95fe2f7-150c-43b2-bdf5-1752d77b78ea", "value": "T145B53379A3C31431DF4789786A2AB0260E667F15982CA456315EBF096F2DC837B3B742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137643, "uuid": "4c196266-8533-4b69-b0cd-70e668c42230", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137643, "uuid": "a682797b-e3e7-4403-992e-603f21a47843", "value": "49152:475rp43dh0oY87U2BBqz6DZF+GtIA4Lva1pWAmxci/qumvMq:o5rpi/0pgbm9ifWJT/quit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137643, "uuid": "b3d732a4-cfa7-44f9-b445-875e9387e39d", "value": 2459256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137643, "uuid": "d30c89c4-35d8-4d03-b906-19d650c2e8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137643, "uuid": "e4f2957a-e267-49fb-b182-d5c31772d7ce", "value": "SecuriteInfo.com.Trojan.DownLoader28.24104.7416.19114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0220a0-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1682160681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160681, "uuid": "bac1500c-3ead-4ea1-9aa2-fa144da5a4f8", "comment": "Malware payload (AgentTesla)", "value": "3e1971f92e91c18d9ed9ea066a8f262c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160681, "uuid": "01e3f85f-c6d0-4a2c-af19-83d1ed80c0cf", "comment": "Malware payload (AgentTesla)", "value": "9f8d1746940a80c8b1b40018e342eb668e60742c30381422c05a0247cb57694e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160681, "uuid": "8322bb4e-1274-48dd-ac99-4c06d14b927f", "comment": "Malware payload (AgentTesla)", "value": "aeec8f52fc7caed15054d04ff78573c2e2fa6a2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160681, "uuid": "d5678bfd-b94e-4049-ac90-4b216114b444", "comment": "Malware payload (AgentTesla)", "value": "7702031bd89c2badd6f411b8770592c58a8a0aec6a07778161f3c6d813eed9086b5145f35172b22fa62cfaf133afa1a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160681, "uuid": "b296f478-fc69-4cf9-a90b-dfe33832c537", "value": "T114D49C23F4DCA5E5E09D0478AC69F36EB9116C2188318E963EA1F84CA935B4714F3D7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160681, "uuid": "c9b07648-3599-4cd9-86c9-31147b1ed9d0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160681, "uuid": "e6912863-68be-4ad6-a979-b4b472d34c42", "value": "6144:UYa6nQMXJdPpRj8y8jSGMtCowsrIH+OH/M29RI9ndUNknOoji:UY+M/PpB8y4SOH+92Sksk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160681, "uuid": "03740a5e-4230-4d6c-aa05-08ac366afc2c", "value": 637809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160681, "uuid": "5e5c817a-4110-42aa-8631-327ed63f9295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160681, "uuid": "306966a6-6b67-4058-b704-0a8eafd2c70d", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344e8f8f-e128-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682179831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682179831, "uuid": "2c31d639-1e22-4233-b08c-711ab7602787", "comment": "Malware payload (RedLineStealer)", "value": "a7f0ded69e3c0da37087b82945786d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682179831, "uuid": "7d8e855b-46e8-457b-a770-a06430ef9de3", "comment": "Malware payload (RedLineStealer)", "value": "9fb7c1285a5e3bdf3aeb2f9c29a608ed8bd30f8c6321969b531194fd06cb5014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682179831, "uuid": "9e8dad62-032c-4876-b01d-bea381deeb0b", "comment": "Malware payload (RedLineStealer)", "value": "cd369858e882828f65ec5eb3a199e3d17f895643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682179831, "uuid": "ecec47a4-f1c7-4cdd-85b1-205253a8382a", "comment": "Malware payload (RedLineStealer)", "value": "861a23e2692bcf544881706bc41498b26f8d26a928c9e4a9f3923036aceaffa5d1f04326c29b81f8fda6e82bd7c29b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682179831, "uuid": "9067732e-dba9-43b6-ac04-2a8abbd1abb2", "value": "T122F4129EA6E84137D9B90BB044FA12931A76BCA19F7842D7130859CF4CF36C4A4367B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682179831, "uuid": "669192ba-177e-4038-8969-09f39d373334", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682179831, "uuid": "97d5269b-a5f4-4465-943c-8bd021127296", "value": "12288:3y90stXiNd12AQlXU+6BtprKk7f6Y4snVG49ECwyDmznOatxk+7huj/:3yJtyNd1FOE+6drKkb6IVG67DiDRlC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682179831, "uuid": "f79c6198-94e0-48ac-becf-56c0f3ac86db", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682179831, "uuid": "3e3ccb97-1a8e-486a-84fd-d988078f1564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682179831, "uuid": "efe9177c-3f9b-439f-a3f2-51deac32a1c5", "value": "a7f0ded69e3c0da37087b82945786d3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aefca2c-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137697, "uuid": "3e65c6ae-910c-4d7a-9c2e-691127d4f7af", "comment": "Malware payload", "value": "e471c5abe684db5c154698c7c06a1e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137697, "uuid": "4c3b916e-2518-4cff-bf5d-43d52991a308", "comment": "Malware payload", "value": "9fd99f5afdbc192218dd72721b16b1b2ea6a9feb9a51c407cc32c7d6f4be9144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137697, "uuid": "c2a46e47-3c41-4343-9649-84e905895731", "comment": "Malware payload", "value": "e9c18db939386fede2ef023db83e62a53bb2d6de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137697, "uuid": "f0fafb16-08c8-466d-bbc9-1823a13da1a4", "comment": "Malware payload", "value": "76db29fae5e5626723a5faa4deba0e0968a7611464db394646cabe8fa8ca00f008f03c9b0d4b4e658a50a47517324422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137697, "uuid": "f14999f8-b9dd-496c-bda2-de4e79b20757", "value": "T1E5825C87E6E29871C101EFFD4C59D228EF3777302E195495F9EE5CCDAE4A221250C24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137697, "uuid": "417c4531-f1a2-4fa8-ac6a-67b62caa7a31", "value": "b29fbb62e11a35308bb935fdc55c0f37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137697, "uuid": "9c926811-3779-426b-8a53-c309811582ed", "value": "384:ssRdCyFMqlW1mQe0OsC8haP+NLPSJZcPFdmXBahcARl5:/Cyyql0mQ3O2e+Baz8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137697, "uuid": "bae1010f-844b-411d-9573-4b5b09a86831", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137697, "uuid": "d8edfb58-d201-432a-941f-35f7dc89bb9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137697, "uuid": "57118879-4a56-40cd-8f45-3b8fe75e5d46", "value": "SecuriteInfo.com.W32.Malware_fam.NB.9427.3225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1162dbdd-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137681, "uuid": "a914c9af-367d-403b-9d7d-bf1a8a06a905", "comment": "Malware payload", "value": "2ad40f93d31411dbf6fbb13a2bb60b6a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137681, "uuid": "bf99c8fd-c972-4e66-9d9d-8a8bb738378a", "comment": "Malware payload", "value": "9feecb06ad6914301888134bfc3c02c0efa90085048e61236d30cb3658666c2f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137681, "uuid": "f0d76829-785f-48df-8036-9b87c9ff29f9", "comment": "Malware payload", "value": "612b8f9590f8f53f1f4c1f99ac297db287813878", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137681, "uuid": "b3da000f-ef4e-4e1c-a64f-c1afa5263b4f", "comment": "Malware payload", "value": "dadea27d9c62e26451d93675e623f3e8b9264c95be3c5db1d78fa20081f458cc8dddc46f4d438969fea48231eb7702d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137681, "uuid": "6f7d11c4-ed65-4e29-98bb-a8eb28ca70da", "value": "T1F5130A551AED747DF94279B26FDAF2ACD626B3C4D2838ABF206652C31BC0E513712039", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137681, "uuid": "99e2adda-3771-4a07-b664-467aac745272", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137681, "uuid": "68f6ae35-b60c-4d43-aa21-b6740a64ecb8", "value": "768:K34u+22ObKL140MIlNZYdodClPGK4VNFKnW9mGc0YW281gsveCfzzjZQ0AMcQjr9:KI2jlwJf1L3n+8Fi10i1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137681, "uuid": "598e8098-1f79-4804-a257-e8f8fb5a6cd3", "value": 44320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137681, "uuid": "374856aa-1624-4f5c-b588-af07765f2e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137681, "uuid": "26af83fd-8c72-41b5-9264-0c4ad958597a", "value": "SecuriteInfo.com.Program.Unwanted.4695.32459.18664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06012b09-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137662, "uuid": "24b073a6-c3ca-48a1-bd23-fc054070f9b8", "comment": "Malware payload", "value": "ebdddd83b2ae88fdf3b2d73543235c8f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137662, "uuid": "4438ae99-7191-4a4b-9227-28773f0a4083", "comment": "Malware payload", "value": "a2248bf2d321448b85414cbc6970ed338558dfe7f28225efbbaa4d638162475d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137662, "uuid": "2e7d8b89-ba27-4c80-a62a-d4fb04e16be6", "comment": "Malware payload", "value": "71bc8866d1ef9966228522f889b26d6391876f33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137662, "uuid": "c8bb214a-31ae-4f8f-933b-4f66985c5f08", "comment": "Malware payload", "value": "0dd7930a118ee72a7e346472e96727a69645669dc4f7ca79e33b6c61b93785859e5715b28eaa7eea862103cd30efe9c2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137662, "uuid": "1409d6f1-bfdc-480b-ab28-e1e6d2d5e1fe", "value": "T1EA830A2E17BC972BCEBE4BFCA4B18110677DF6516803E7AA4F9DA0CA2D23710C944567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137662, "uuid": "7fc579d6-5d55-475a-9a3d-398f37e63ff6", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137662, "uuid": "3f103670-e21b-4d18-91da-3d910b81275d", "value": "1536:O0Od8MEo3d9KHJ8CIbBsx1tST5WaS6i2lRsnTC4kki1fvi14:O0O7d9CuCINKtg/SpNTuki1Hi14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137662, "uuid": "04933d9f-50d8-4498-8423-ef77712faf4d", "value": 84256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137662, "uuid": "90010a04-7691-4d96-a1f0-0b25e7e13a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137662, "uuid": "a67974eb-2b01-4634-b60f-b53ee98026ee", "value": "SecuriteInfo.com.Program.Unwanted.4695.16664.20080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bd24fe-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137640, "uuid": "39b947df-582a-4cf0-bae2-571798ba75c2", "comment": "Malware payload", "value": "1a1c5a634b4d33b11259f0b0c1a74c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137640, "uuid": "faedfb6e-dadd-4160-9a1f-b1366633f8b5", "comment": "Malware payload", "value": "a39904f6af79eec13ea9d38776f1a72b12d58d892f0d267846608aaf17f24ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137640, "uuid": "f08df39a-fb8a-4bad-81b0-07f60e593402", "comment": "Malware payload", "value": "d4758fc0aedf9fbfe0a47c9457150529c478fe7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137640, "uuid": "2b1fa1de-41c6-4ad8-91e6-e67103398e11", "comment": "Malware payload", "value": "a5c50613463782d617401e6d2bd3eea8c830d2c79530295f16f5d06252ed8650484654ecce38e8e9ef7054cc3ca21a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137640, "uuid": "244497be-d55a-4f21-879b-63a49e52e736", "value": "T1F93633B37B9240B5D24016B6894AE659D1ED71506BCFCC1533C5AFCA33686C2CE22BDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137640, "uuid": "0a24e2a2-9153-48b5-9223-e48fefd61051", "value": "0623f5db00daeb7e7d209f48f21ec2ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137640, "uuid": "06c90906-b9eb-4ae2-997e-889f7596b83e", "value": "98304:pDJIIpet/KKv5oxg8ZFAURkGG2+Dx3ds9oWJXWjoPflMYa4vyBLLgRsaHjV5dH+:pV3vKv5oxyerAVdsxJX1HlMYzaBLE1H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137640, "uuid": "a7a88759-5d18-4cee-82f6-4a12142b4863", "value": 5104212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137640, "uuid": "dd88cb93-3991-4dd6-a974-1948b39aaba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137640, "uuid": "4daed104-f95e-4feb-aa1a-4a0c17cd74bf", "value": "SecuriteInfo.com.FileRepMalware.11522.25149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e57e3cc-e0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682157030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157030, "uuid": "a4e07de5-b01d-44c7-9881-82a99937c82d", "comment": "Malware payload (RedLineStealer)", "value": "f88eee472f486e37658b53e8cb1d0ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157030, "uuid": "a0ea0060-9511-4708-9034-71c112b008ef", "comment": "Malware payload (RedLineStealer)", "value": "a5013db80c38a4b896dfb4543150480463fb2eaa723e1ffe4fcdb486b1319c00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157030, "uuid": "70267c85-2612-474b-84c0-89cf147c2b47", "comment": "Malware payload (RedLineStealer)", "value": "28ef87185574ba0b0f06a78b9e2ac1abb4f103b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157030, "uuid": "312b906e-cd60-4c43-9e63-4a9446d09b72", "comment": "Malware payload (RedLineStealer)", "value": "43f624b85c3313815a89ae87f5ae61762d999909f1fdace97164933611b7643e93e96798a7164e19893be46c6321c83d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157030, "uuid": "1332f59a-05c8-4dcc-8c70-6df4ac326351", "value": "T12AC41213B6E88176CEB907B058F917830F377CA18F7486AB574459AE1CB26C0A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157030, "uuid": "48b7ffd5-f5b6-4f15-b136-2b965a3f4ba3", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157030, "uuid": "589bd1db-9632-4adf-9e91-31418ff78195", "value": "12288:ty90tWBKkITK7E8ReUNPcmuO1zd/fbcp8aic8y+4GFwr:tyJfIT8F0UNZuO1dDM8aic8yAwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682157030, "uuid": "9ae20ba5-eeb1-4247-8713-b1c96022cc20", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682157030, "uuid": "47affa6b-91bf-4ebb-b502-1c62b19d17fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157030, "uuid": "e26d12d4-73d5-4ee5-aae2-36ddd0ce0a2a", "value": "f88eee472f486e37658b53e8cb1d0ef9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d947e73b-e0de-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682148325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148325, "uuid": "31f99792-3af0-4c03-a299-51c3c2cd92e8", "comment": "Malware payload (RedLineStealer)", "value": "131eddc774df4231b3df5507ffd3b6a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148325, "uuid": "4f040f00-915d-412b-9982-5120c59a4a68", "comment": "Malware payload (RedLineStealer)", "value": "a52b534d8aa523f4e8f5fcd7616c811a55bd593c4e20ca006b2cb6309dd264a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148325, "uuid": "2672860a-2e05-4429-b5b1-b60169d70b2d", "comment": "Malware payload (RedLineStealer)", "value": "d62c68fccb2a88691c801d4e735422558cea9033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148325, "uuid": "21f1ac27-bd64-405c-b54e-0a92ee5a75a7", "comment": "Malware payload (RedLineStealer)", "value": "b8514001e52a8b279a022e947535b6e77f3732602bddcd7e6a4c5b81ff7c9d634f5d321d819c2d45fe23dfa2c37ff826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148325, "uuid": "219a3869-27f0-4c3b-9479-8477bddd23cc", "value": "T139252312E6F49172DCB46BF05DF71293123AFDD11B7442E72389289A4C736C0627AB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148325, "uuid": "1db03325-c817-4c8f-b77d-67223f83b934", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148325, "uuid": "fdd62783-f9ef-4196-9d20-70e5ff999198", "value": "24576:cyxUepPNoBzHGU0aMdaRedipBKDoAmnuc6r:Lnp6ZGUYl0pBkT86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682148325, "uuid": "14284592-ec5f-4474-aab0-1779df391523", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682148325, "uuid": "330fda09-ca97-4bda-90e5-645454f5462d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148325, "uuid": "0e8b6a30-c5ca-4e98-82a7-5e13b207e4b8", "value": "131eddc774df4231b3df5507ffd3b6a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6d13c0-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137651, "uuid": "e230ce41-4a85-4553-92af-134a1837d570", "comment": "Malware payload", "value": "e9124df2dcd6a853ad08674f3a598da0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137651, "uuid": "ea7e06f0-1bce-4af2-a703-b4500986a8f0", "comment": "Malware payload", "value": "a6c76063b374b0e81d2d0652a8a041fc7151ddfa056c3270dfba865573548fb6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137651, "uuid": "e20f9297-3af7-422d-acc4-279a2c626bf9", "comment": "Malware payload", "value": "dfc84a53a0ac03fdbeaf49af7d1919271382ba33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137651, "uuid": "94c106e0-39f6-4603-8f8e-5b308a9b2b1f", "comment": "Malware payload", "value": "ebd17da734647cf39ff12c440069b26c038591d76886597ddaa8b10f300ab6ba2f997da29a2fa0dfdbe74986ef81625d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137651, "uuid": "1184c08c-0893-45a7-930c-28ca0ef069be", "value": "T1A6436C4857E8D712C9AE0FBA94E041115731E381EE93F35F09FDE0F05EA7780CA9926A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137651, "uuid": "4cbcf4b4-4d08-4e24-afd3-fa06a4357656", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137651, "uuid": "ff251785-f326-429a-a6e4-b9f09df53f60", "value": "768:7lAyZZ0z5nCbG4IeosrwdNEqu65how7ZGV/GxS27J/kLcR+xQ4+wmxi1Ri1WiP:BAyZatnUAEwhomsclpfR+Nyi1Ri1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137651, "uuid": "f01aba77-eed4-4cd3-963c-26fd7e6cbc72", "value": 57632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137651, "uuid": "6fa0f2a0-5f7a-4364-92fe-47f903aab9a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137651, "uuid": "a9cbe32c-5a94-4010-a139-0347ad15d558", "value": "SecuriteInfo.com.Program.Unwanted.4695.2196.5186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f36b167-e0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682161112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161112, "uuid": "c8a4a956-6bc4-403b-b0ae-51a2d53c4627", "comment": "Malware payload", "value": "e29905020d3fd6a7f3360255ef3f4e0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161112, "uuid": "522c460f-08df-490d-abf9-602e6b536dbf", "comment": "Malware payload", "value": "a77a520bc74131328d2beb5eca6aa597c53c0ce7ba688f53cb12b6f3374344f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161112, "uuid": "173cd016-3123-4d67-8bc3-7256ae5d557c", "comment": "Malware payload", "value": "c1f54aeaf7a07dbacc8e2c6c7ef3b3a534cee739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161112, "uuid": "06e3745e-7475-4c14-8b08-adbf9f4ee6b8", "comment": "Malware payload", "value": "8068aab0d9c49660a5788caef63c95fb47111943e05ded76c52611e16c0ba5bb1be26d5a746633d852756d23609aa1b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161112, "uuid": "c4447752-bd29-407b-9686-ef25fe6fcafe", "value": "T118658D32F5915076CA2303719E4E732AB7BD97B1023A559766D85E343AF0483A73CAB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161112, "uuid": "dbc18ea1-371b-4b03-bf87-1ffc0cab309c", "value": "24576:iBofV1YbjZKLyPhWpyUB7OjDHLYDwvqipulfNWX9jO5i3l0hH1bRWydmdn:NVqbjZKLyw3B8HLuiAf4XpO5i3l0hH1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682161112, "uuid": "8d83eb32-1ea3-41a7-9870-f4930620adf0", "value": 1528807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682161112, "uuid": "e17a4b03-ca3a-48a5-9d40-ef082edcd568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161112, "uuid": "bbc376b7-1dcd-472e-85ef-8856b47997ce", "value": "e29905020d3fd6a7f3360255ef3f4e0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df156b22-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135449, "uuid": "4859cce4-c17e-4b10-8ce8-a3ce9448ec5c", "comment": "Malware payload", "value": "e6fa4fb7988af75ff999702c175cd599", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135449, "uuid": "774a7c23-df34-4653-8b4f-caf8f1f98430", "comment": "Malware payload", "value": "a78132b56fefefe34ad9d5a007588f55b85b54c0bcd17898d310cae06afafa8e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135449, "uuid": "d75f817d-676c-4bfe-bdf0-8efc3204370e", "comment": "Malware payload", "value": "349fe8724cc82f41b1dae88c40ace77610a890b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135449, "uuid": "ba37d040-e9c0-4b57-8ee5-2bbe48c1d333", "comment": "Malware payload", "value": "0caded2899f131921b814d71b720b0cd90c94ad0dcceab165bfc991f531d917b44a7604ca2d7ef31d5c2f8baa0ed0352", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135449, "uuid": "75dba3bb-cc66-4df1-a6f3-22b0a89643aa", "value": "T19D042C14D050C7BAE0A244F9C7E90DBDB8364D50234519C7B3C23E79AB91DE5AB31BEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135449, "uuid": "19d519be-b3fe-43c5-aa9d-8c9f5099181f", "value": "3072:D6il7jPiQ4nId7Dr4wnEch1mfcGIR8oL2AA5NWCdxN2UnPF1ELW5550:DhiVKDr4wE4MfcunAA5NWCdxN2UPF1E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135449, "uuid": "88c87ae1-96ef-43ab-9034-2a3e081819c9", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135449, "uuid": "a3100926-1a6b-4607-92ea-90e3033db01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135449, "uuid": "90a06bd5-81b6-4fcd-964d-c877cc3d7f5c", "value": "2023-04-21_e6fa4fb7988af75ff999702c175cd599_cryptowall", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615059ed-e0e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1682152848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152848, "uuid": "f87e0c52-06bd-46f8-9c43-c4889e5add9e", "comment": "Malware payload (RecordBreaker)", "value": "0cf7995ad70ac245a69b1eb2274a318b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152848, "uuid": "265ace28-2eda-4556-92ec-2bf0bb0678b5", "comment": "Malware payload (RecordBreaker)", "value": "a7b38f04814cf745ecd9245cedb04e7499ce09cfa7b03a2c2b9c5ca2b79f708a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152848, "uuid": "5004b083-4c8a-4bb4-a862-53224014fd55", "comment": "Malware payload (RecordBreaker)", "value": "99c3ad933a5e411e369f1be49fc9e6ee053014d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152848, "uuid": "47b15eea-b48b-4e12-a195-cb85d3da32ee", "comment": "Malware payload (RecordBreaker)", "value": "03c95f2f47990a572317e6abcfa1d388cf72e3eb7e7a837d9537321c6046eecae7aafcd77cf0665eb7243e1072ff6c6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152848, "uuid": "50afafc4-500e-40f0-8ae6-88e1868bbe78", "value": "T1BFB3C90D96D2B80AC354A8759243E8736B164D7CBCE95DDEADCB8E3221F64502CACFC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152848, "uuid": "b2ab6808-d429-455d-a7c0-aa9352c82c73", "value": "97d41417e1c898a9dc85fb4d98655fda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152848, "uuid": "298d78da-7dfc-41a6-be5d-23d1e328b20e", "value": "1536:/ja4qX8uFJQvccqJ4QFn8XwcWwH7Yq8BG8TcdayFtvhV732+oOl8s4PBqZ1zObEg:/jYPQRQmr8YLNL6dzjPAvZjy5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682152848, "uuid": "8122717a-3080-47f1-8b7e-1268b1f1d876", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682152848, "uuid": "06ef1fe9-407e-45e8-bf3d-e3ab6b03c058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152848, "uuid": "bdcf144f-b0ce-437b-92ca-44270855cd31", "value": "0cf7995ad70ac245a69b1eb2274a318b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dea4839-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137461, "uuid": "72dc1ecb-2fc6-42cd-a372-311571406ad4", "comment": "Malware payload (Mirai)", "value": "d21e7712f928eec92d344b5cc3f0d439", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137461, "uuid": "ee71aa22-ee88-44ec-9b84-2ac5a5db1747", "comment": "Malware payload (Mirai)", "value": "a7ec03a9c84d5a9dbb4bbb239bf5463ed1b90127a8ffa2e438fa2f0cec8c0e4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137461, "uuid": "ee0ac339-fbfc-4804-b644-d4198ff26489", "comment": "Malware payload (Mirai)", "value": "1af87a44e4cbabcd5177472cecae1aed9152f327", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137461, "uuid": "e94932a3-80ed-4656-93b4-34c1d37140e4", "comment": "Malware payload (Mirai)", "value": "e185930b880dc6d1e590ea91a1ef79bc096b428de2fd9a4dd44847d7f1e1ae45dfd8bb03c19c45677408b9ed9903da21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137461, "uuid": "8c9c2b45-1624-46a3-a852-3a7ca6ddf808", "value": "T1E9232A96BC91DA0AC6D023B6BD6F64EE330163DAC2DE3247DC145F247ACA90F4E67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137461, "uuid": "bd9eb0e3-c121-4ca3-9e81-f9bd054c11c4", "value": "768:hnS1kVNpgQQ4/al9SSDRzQub5ffM0U4lq2Np/Iu//fqwpYZ3+KCv9hbde2/13yJf:tXgj+al9SSrdfkLaNp/53qwqV+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137461, "uuid": "2409379d-72e8-4690-9a2e-c83ffd152db9", "value": 48272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137461, "uuid": "9ef9b7c7-f880-4d2e-b464-69823b7d256b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137461, "uuid": "4f11609f-8124-45e7-b23b-a2384ab5f921", "value": "d21e7712f928eec92d344b5cc3f0d439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8ea1ae-e0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682161509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161509, "uuid": "d37d1e5b-180e-4229-95b6-be23abf0e86d", "comment": "Malware payload", "value": "3d695f1b4db5a0635d43e1cd1b9d48ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161509, "uuid": "d33dce68-60d5-4309-8664-54246bef25a0", "comment": "Malware payload", "value": "a83688213da481b066908e16d7a2206180627bcef8c69e4fe756dc06c5c35ec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161509, "uuid": "a75d83cc-164c-4ae1-b49a-b2039dcc4b8d", "comment": "Malware payload", "value": "377936812ab222b69380049be6ad28208e135603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161509, "uuid": "d6c4f0e9-972b-4769-8922-b3950fa0aca8", "comment": "Malware payload", "value": "d352f1c9408455ceade4470b19808e8cb6d0c24054828ac69485bde579c05b586ff2b655d8ec0c83e06dcb3750605ed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161509, "uuid": "714709c6-2ebf-4656-b2f9-7a371491b9bb", "value": "T1900512ACB7A5C6A7C2680F7D4017A5997F3450F3B52AC279DB4B088DFB47B041E88687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161509, "uuid": "ebe4c9c9-7fd2-48fd-b3f8-0f8cdbac588e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161509, "uuid": "bda5b3b8-9ee7-4364-aa97-ab2ab0ed44a7", "value": "12288:Y+vTN8RVtfK8cyo7qyy8SpCrqLKL2MhkHEmY4FrHSzn7rwR8mGyqF7qbnZ4Xb:Y6TNUVU8cmJ4rM3akk14JH+n78Z4Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682161509, "uuid": "364caae6-fbdf-48cc-9eef-5718b6fc9405", "value": 871424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682161509, "uuid": "9b7fcfa8-1857-453d-bcbf-7dc4d14cb108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161509, "uuid": "b13a7f42-1189-4b76-800e-10ee4049d455", "value": "QUOTATION _RFQ# 1043999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b36c7b8-e0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1682161105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161105, "uuid": "72cb49c4-0774-469f-adf3-efea38817e73", "comment": "Malware payload (Formbook)", "value": "3340686730dd1fa9f3fa44c38ac8d224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161105, "uuid": "a5b78a29-6c46-4a66-ae26-1d8b61c17659", "comment": "Malware payload (Formbook)", "value": "a83adc88feb896f4fa1b09b3d5043fd506f9de5f6d695f7e18bb3d84019abb85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161105, "uuid": "a4811f05-bd1a-49b3-8224-43a5f5afa2c4", "comment": "Malware payload (Formbook)", "value": "e48f00d2e435d9741d340f76a2d95d159cc74f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682161105, "uuid": "f3428264-4313-4ce2-b296-3cada54610b9", "comment": "Malware payload (Formbook)", "value": "de58a223734b256dd591e982a0b74a96c2e801ec76e33506cbe1328ada6905a3bb444b9fc87a96e54a58f10be553fc8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161105, "uuid": "997ed03a-cfec-4768-bfe2-32c0c0a3672b", "value": "T13DD4E074619A8B41E02EDBF12478BC71137134F3E9E9C6380FA666D4CE6BF545884E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161105, "uuid": "4672d125-2949-4fad-8daa-60c10e863f50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161105, "uuid": "1ef3e1b5-8c10-4984-b8ee-18c311e0f735", "value": "12288:j6CiBXlRKHCXZ8IcxFICx8lYAIL9wix8KjT0Jq2PX05:j6plRKHAnUj3ZsyoJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682161105, "uuid": "480524c2-4575-4d5d-bf81-776b461d77c0", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682161105, "uuid": "4c09808b-b77f-47fe-b8ff-ff267c632d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682161105, "uuid": "43545a1f-92ae-48fa-8129-9f55e0aee675", "value": "3340686730dd1fa9f3fa44c38ac8d224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa374eb1-e0d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682143226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143226, "uuid": "6335e67c-8e1d-4ea9-b0f0-c147626ddf72", "comment": "Malware payload (RedLineStealer)", "value": "7d27aa4b58cffb9aaa28ec8c20f22b56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143226, "uuid": "29023551-a612-4eca-b366-c1f27ec09462", "comment": "Malware payload (RedLineStealer)", "value": "a89973e6c8c4334faf1e59b0fa6d5bbaa69b28d255fbedc0b9bb58ab2e30dc6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143226, "uuid": "91d395ec-8161-4aa8-adcc-300aa03d8939", "comment": "Malware payload (RedLineStealer)", "value": "74c127bc407a314223a710eb5228dfd8904eb81c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143226, "uuid": "982ff20f-b460-4a3d-b22c-a43314726bda", "comment": "Malware payload (RedLineStealer)", "value": "aa68df9a75d2d87eeb48e8259fd632e973aa92a16272824f03d9179de4bece4435b9e98ae8d9c7d2493dca718ae6c281", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143226, "uuid": "a87e8680-09f7-4beb-b4af-9246d1f1f23c", "value": "T11CE41213EAE88177D9F917F009FD13C7073ABCE29B75A29B2249658E48736C49931363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143226, "uuid": "cd0e7c73-a095-429f-88d0-862b9a0a03fc", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143226, "uuid": "e81b8359-896c-4a9d-a9fc-523ac011deac", "value": "12288:/y90YtwQEt7gVfBKNvWtJs7QAhn6qyYhhOa1HBAYvgrsiUbODBJrlJ:/yp4c5KNvsu7p3yIhRrAxUbUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682143226, "uuid": "647608fa-f128-414f-aadb-2724249e3444", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682143226, "uuid": "f862ec8f-b476-48a3-86e0-bedd327bf56a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143226, "uuid": "dabb8135-628d-4c9c-bc40-99f2581812f0", "value": "a89973e6c8c4334faf1e59b0fa6d5bbaa69b28d255fbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef2e051-e0df-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682148629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148629, "uuid": "300c798b-0538-4160-b3b1-ee76badb9f3c", "comment": "Malware payload (RedLineStealer)", "value": "964b6d81363f5721b53a78eea1a4cefa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148629, "uuid": "783aa235-a82f-42d0-a1f1-cc7824b8273b", "comment": "Malware payload (RedLineStealer)", "value": "a9e3cf07913fdf31bb97d1e2064f325e35b19a031085ae6ee4aaa7975cceb6ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148629, "uuid": "2bbb6907-ee5f-4965-8a8a-ddbb50e79138", "comment": "Malware payload (RedLineStealer)", "value": "510e383cd3180cacadc2bac9f6079dd7f54ae65f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148629, "uuid": "e517c45a-5e73-4edd-bf64-cb29599021ad", "comment": "Malware payload (RedLineStealer)", "value": "f03d27dedf3d3e10cd63165218eb4f6e7c4ad20cfbc88ee40cd766f2a5fdddbb8ecd3134b2f55b294b11613b2e14d6b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148629, "uuid": "b95f77f9-3e4c-4773-a45c-137c46e3f6d2", "value": "T124252202BAD54037EDB5177158FA26830A38FDD6AF7483A76341BD866C723C0963673A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148629, "uuid": "499a94ab-21d4-4c22-aabf-23b05c59a4f3", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148629, "uuid": "feb7f4bd-7895-4e11-8377-36832e4f299e", "value": "24576:iyEDuH8mRjLhmIpdxmLRLVkIztx3sCq1mnuce7YIs:JEuH5VUIpdgPDsd8e7YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682148629, "uuid": "d9892034-b509-4e32-b23a-095102da5dec", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682148629, "uuid": "1bd49438-c76e-412a-bf22-f9204f2eddd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148629, "uuid": "0c00bdd7-4923-4dca-a358-b22d4be28d6f", "value": "964b6d81363f5721b53a78eea1a4cefa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f493fad-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137705, "uuid": "0f65dc73-1f3b-4378-9921-33061927b14f", "comment": "Malware payload", "value": "92cb41b1d1703888f5d0bf0ba9f2e5e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137705, "uuid": "6fd38411-0be9-43a5-b77a-a94ae990c674", "comment": "Malware payload", "value": "aa7c530fbabdc4db5153fef5d10beef65a44448796131cac54703a4619bad220", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137705, "uuid": "c8d40481-0da3-44be-824f-d23ab9182b69", "comment": "Malware payload", "value": "76c5289ba403c76db3969a2edacf970072e17481", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137705, "uuid": "3fac1037-23fe-40dd-8f39-e702d20b4bf0", "comment": "Malware payload", "value": "2b8ce5946137def5571cd48f2ea36913168821f018f23678d305c25fde083fae74b836e8d4c0afdb0561bc0a0a47d35c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137705, "uuid": "4b837cd3-b13d-480b-9507-c99b177ca2bb", "value": "T16E84077522F09635E27F493AD47096115F76BD07C819D23D7AA838883FB2B04E81A77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137705, "uuid": "7bb339d6-e53b-4436-a415-b9990c0833b7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137705, "uuid": "9fbad500-f397-44a6-96a0-486b68d602a3", "value": "3072:cWb2ewMDLU/93mohTI1lF1WP1W32hFgZbLQW4/BOnwXfBtQVxtx9hf9j1FQLOYxM:XbNLJZbLQWG4nS5gL19sTLti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137705, "uuid": "0dd074b9-28ef-4e37-9788-811b88c337ee", "value": 384800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137705, "uuid": "cc032b53-223a-4035-b0ca-50607b871ae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137705, "uuid": "b5c80671-eabe-4a90-9939-574e1f575814", "value": "SecuriteInfo.com.Program.Unwanted.4695.17983.24857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033388a0-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137658, "uuid": "807c2271-3a8c-46cb-ae0f-90a8b2267877", "comment": "Malware payload", "value": "ca90e926709680997897c8453dc7df3d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137658, "uuid": "62c2e9a7-5d93-450a-bfa9-c47574d93ad0", "comment": "Malware payload", "value": "aa88fffd0b9ad381f7af01ac5987f5c6d9b696d54e3624e4c18205c343f0884c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137658, "uuid": "4aba30fc-f476-4c89-b6a6-2a79a89b299e", "comment": "Malware payload", "value": "dee9b70e727b1368872c9c3cacfdb9bb3e5417aa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137658, "uuid": "770f5b6d-e1c1-416e-bba6-4c2e8795c8a8", "comment": "Malware payload", "value": "f6eef3b34f8668624dc0964bc84e0366796d4a782d6ae9e0813098bc5cbeca0157afa79b192096fc84a7f05a4127c943", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137658, "uuid": "c1e52113-f129-43dc-85bf-2b5cf2bd79c5", "value": "T184A3394127F84614E6FE4F75A9B042204B76FB42AD33D79E1AE4809E1D33791CC287AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137658, "uuid": "c3cfaf4c-1d52-4bd6-9ba8-42ef3e26d16a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137658, "uuid": "57016c8b-49d1-4b7d-a1aa-82ae56508cd1", "value": "1536:JVi+tavbEehx6r5mKv0AhXrmY99+x1jYlc8kRaS7di1qi16:K5h0F7Z99+xVYycadi1qi16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137658, "uuid": "7a56ad4f-aa93-4968-88c1-2ef04c456300", "value": 105760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137658, "uuid": "51641019-fee1-49da-af02-6c9b20b43e8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137658, "uuid": "a52b1367-d0e3-422d-b2c0-ce05ad898875", "value": "SecuriteInfo.com.Program.Unwanted.4695.970.27864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0631aa45-e150-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682196933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196933, "uuid": "9c4b4bc6-9011-4a87-b8fd-3d304f784090", "comment": "Malware payload (RedLineStealer)", "value": "cca0a3cf478390927fca3d3f96c4c4f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196933, "uuid": "258bb3f1-768f-470a-b8f8-0c0a4e68acfe", "comment": "Malware payload (RedLineStealer)", "value": "ac1f8cadff78a0040afad6ddd10f23e001c2b8a4dab4f6d0a3537d3ce1198240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196933, "uuid": "4a5e518a-2dd1-45fb-9382-41f49a4533ff", "comment": "Malware payload (RedLineStealer)", "value": "e407300634fbfe1924ce50ad3b70f91f642381f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682196933, "uuid": "2d33df0c-f4d6-4bf3-98b3-98bfe7567194", "comment": "Malware payload (RedLineStealer)", "value": "b8f7f263fe6fdcac209f61eedbf6c77d0a649d38e16bcb564216662189bb16f36b7c932cd1b54765749fd27d85807cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196933, "uuid": "2167e6ba-af75-41d6-a393-6b224e7d536d", "value": "T1D4C40213AAE09172DDBA1BB058F703C30F36BCA25B3546E72746A94A4C726C4E57137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196933, "uuid": "0f9bb503-7645-4e84-9a68-3059d734312b", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196933, "uuid": "585e6688-8596-43d6-bfd2-beb435af91ad", "value": "12288:sy901D7Z1XlRulcN78k16uSeEcb/EafMc3X:syoR1yly72uSjxKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682196933, "uuid": "21e182db-1d7a-4805-ab90-6372fbe39385", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682196933, "uuid": "b2f6a786-f6cc-4da8-8f7d-c97cfcaddf15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682196933, "uuid": "48ba6931-38ab-4fd7-9dc9-323c1aef593f", "value": "cca0a3cf478390927fca3d3f96c4c4f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60057738-e0a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682124499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124499, "uuid": "4ff94fb9-8812-4565-bacd-830a45ce4ba5", "comment": "Malware payload (Amadey)", "value": "c4401de2c4da49d29d12f48570296fab", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124499, "uuid": "8ce37e56-19dc-4e9d-a42b-8d926cf8a5ee", "comment": "Malware payload (Amadey)", "value": "ad6d0a667c500c060b9d7be0036068f43c860329f066e055b28dfd7a4ab4551e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124499, "uuid": "4cab9e84-2ff0-46b7-aa67-c1f30f4d0d08", "comment": "Malware payload (Amadey)", "value": "cbe0bef2c02c161fe74187765ac8747b34b1529e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124499, "uuid": "c5efc508-b2a8-493a-9822-d4edc0a49c99", "comment": "Malware payload (Amadey)", "value": "4440510cbc3992015d94e76117ce1fec03915935f84fddad645187756f9043d627714a7b3176964f2cadfcf2393ddd14", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124499, "uuid": "2de2a175-c13d-458d-a888-099f7236fe6c", "value": "T1DD34D0C07AA1E473E8BB05B91830D5E5697B7CA2DB95C69B32182B5F2C312C18F73355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124499, "uuid": "e6bbfd79-f06e-4399-9e3b-c49faf6000ec", "value": "83f7b03b4e2f4d598c9968669b5cc91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124499, "uuid": "5c3d6427-e0e9-4c38-bd7d-ea006da6d45d", "value": "3072:Ez604ykWC9cI+77dqKVcKqE9+eR+3dQVOx53epFiPFhZOpV:67O9o5qiqfNXM4vYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124499, "uuid": "eef281f2-4e83-48cc-884e-0603a749ac0b", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124499, "uuid": "c2572be1-2f73-4db4-97e3-02e1e09072de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124499, "uuid": "91e600a4-aaea-4b54-a8d5-3c0c7cbea374", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3ebdf3-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137700, "uuid": "7a58754a-7435-44c5-bbb8-101f484c6659", "comment": "Malware payload", "value": "8670093b4065f289b72c0fae8686339c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137700, "uuid": "71a9cda2-385f-406f-ae18-8c62555e0649", "comment": "Malware payload", "value": "ae16c6ca49bf352b1b8d3ebbb8eff024c6d100111b7fbec67a055a321244a628", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137700, "uuid": "dacc5da2-a90a-4300-acd4-88c66bc91e21", "comment": "Malware payload", "value": "d0d5fc899b4e4303031312b6c282ddc2ec40d2eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137700, "uuid": "c0d78447-c559-49d5-9732-2b032c80a3ca", "comment": "Malware payload", "value": "6ea6a33194a3980575d665e6bf71b382bce62636f3975bde567defe60a877ece43040fc299fa83d452f2b8d40c406241", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137700, "uuid": "19daaa01-28ce-499a-8125-8ac91a38b5e8", "value": "T14203084617E84629EAFA4F7069B1C6101F73B9419E32E66E1EDD40C82FB3B50BA14737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137700, "uuid": "27095e45-134e-4549-b858-d919d4c3ac4f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137700, "uuid": "dcfa9d4c-c34c-409b-9d68-85f472c63eec", "value": "768:80xki32R0N5mFZUtYYQLTeeJ3xi1SRai1tit:8eNGRH8LQLTeGhi1Swi1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137700, "uuid": "8808656c-5b9a-4a25-80dd-02453517294f", "value": 37664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137700, "uuid": "bfbc09cb-c923-436f-aad1-ced15ff647ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137700, "uuid": "89c3736d-eba5-404e-806b-5e4b1baabe4e", "value": "SecuriteInfo.com.Program.Unwanted.4695.6490.11407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f0590b-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137665, "uuid": "632bb4be-b497-4623-b237-857d944ab6b5", "comment": "Malware payload", "value": "7b7dca8ccfb9d4aaa1f482c4a82fbb0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137665, "uuid": "39b927f4-9c00-4115-b9b7-877b41a8094b", "comment": "Malware payload", "value": "af6da297a28d23c4d9837e63904c7ed8b28672e0a82da0e6aa14374fcade7873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137665, "uuid": "b4205605-1981-4b85-9940-aa74960ed527", "comment": "Malware payload", "value": "a69fd63d011a5fb264e581e1901da63862c6dfaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137665, "uuid": "7c9eadbf-d74d-40e5-90e9-0c3d6290f4ea", "comment": "Malware payload", "value": "51a0d16d0865d28225dd3ff736f4921ace6f0816274f90b98ae429dd9f714dd2d7d4b785d9bc330b08da377fe8750376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137665, "uuid": "2303ce12-b79e-4a52-94ef-54e30543122f", "value": "T1BDE49E21B5C68036C2B327B19E7EF76A963D6D360326D19737C83E315EB04816B29723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137665, "uuid": "ba8f70dd-49ab-42a7-b4d4-498d89ec6a92", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137665, "uuid": "285cef77-090b-4cc7-a508-2b0322c95d5f", "value": "12288:ChkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4af88S:iRmJkcoQricOIQxiZY1iafdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137665, "uuid": "d80f38f2-d3bd-425f-ab9a-d94ee4e101e7", "value": 667631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137665, "uuid": "58cfa50a-c06a-4e31-9113-5d0b524394c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137665, "uuid": "fc593dd5-9ac2-444f-83c8-d339b55f3bb9", "value": "SecuriteInfo.com.W32.AutoIt.AQ2.gen.Eldorado.22525.27039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b35c05d-e0b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1682130047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682130047, "uuid": "de80c408-aaaf-4045-9f53-96eb103a53c9", "comment": "Malware payload (AgentTesla)", "value": "22d8f711d2bff0322c89cc06604e4f07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682130047, "uuid": "d81db905-403b-49e2-8924-a80fdb05a2db", "comment": "Malware payload (AgentTesla)", "value": "b056411adcff1f851fbc546d40ccb20c45c5d4dc07ffde472514e10b2e632bad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682130047, "uuid": "a763c66d-32ca-48e8-829b-a40db26e7b03", "comment": "Malware payload (AgentTesla)", "value": "1e23ccb823da709e0c5d14d3d0c8bda3cd4c10f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682130047, "uuid": "37f0ac99-3f9a-4b29-954e-4ca9d90dbea3", "comment": "Malware payload (AgentTesla)", "value": "0cc4e56caea3605ac860fa98808145c62727a7f1030befef1c134ee6d9a787d2ecfaea47c0826bfd639f0ed478585d0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682130047, "uuid": "d91e866a-f139-47c4-93fb-5ad6a97f157b", "value": "T12AE4F1ACABE5D6A7C5580FBD5016668A2F3041E33677C53CDF8B808DFE53B181E84686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682130047, "uuid": "7555517c-c724-4ce8-bb21-25d1f4b12bd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682130047, "uuid": "82a47f23-34ca-415e-978b-1f91ac777bfb", "value": "12288:uIxAcBO5ZZC/W2n9/Hi04wmmu+0QX3yCX/EIoILbBy7fRa0Bwh:OcqTC/fhHCf+/c0Nbew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682130047, "uuid": "ddc59026-8d53-4620-84df-6a02f4aa9e87", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682130047, "uuid": "9bcd1b64-0576-4a94-8a14-3125bb2e16d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682130047, "uuid": "7b531a04-e678-462d-8061-b4cc93991ccb", "value": "PURCHASE ORDER (PO# 2611).DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092095c1-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137667, "uuid": "08bf5543-412c-4bfd-93ae-644ecba417e9", "comment": "Malware payload", "value": "93653e6b26ad7e2d407918091982baec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137667, "uuid": "6be2a5a2-701a-456e-bfcf-51326f4ccb01", "comment": "Malware payload", "value": "b1d45ed4822ffd0196522523eb846925394fa9d05a70dd4b96dc26eae8d9a1a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137667, "uuid": "f9746d87-990a-4bc6-8bad-3b4b1b48349a", "comment": "Malware payload", "value": "eaad7794b9bceeca66419d5c6dfdaa7e56a3a466", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137667, "uuid": "d1ace55c-6565-4887-976e-13208be69e5d", "comment": "Malware payload", "value": "3d54af975e8a500c67ae147652db9a9faddb7fffb78aa54264a2788fdc4268b63648d0ea5f8207ce08884e626890efda", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137667, "uuid": "70e7c7f5-2837-443a-9a2b-eac5d3421ce8", "value": "T1E1922C950F9930A7FA42BD72DBC8E50E6E77B2F8BFD6855B10A455663EC0360372802D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137667, "uuid": "a135f772-3cf3-4383-9ee0-b621e95f1f34", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137667, "uuid": "2451c795-0590-4ea3-9af8-6d5111695175", "value": "384:5iBbosDaPRVipRl4kKznYPLaiSKnbviSK2iza:5iBbosDQRViPl5Kzxi1bvi12im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137667, "uuid": "c0433b30-9000-46b4-bef5-5fde135c2071", "value": 20256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137667, "uuid": "4c6f7176-bb08-4561-91b5-4f4b7dbe9eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137667, "uuid": "d83bef3e-02a2-4bd8-a3ba-12e412e8bba7", "value": "SecuriteInfo.com.Program.Unwanted.4695.32390.25658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47530b36-e0d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682142926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142926, "uuid": "c79b2c70-e388-4891-85d8-9df0264b2642", "comment": "Malware payload (Amadey)", "value": "f2a71354d424e13abb6895173d6afb1d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142926, "uuid": "e29a5b97-aa04-4ca6-a05d-f8c04f2c93f7", "comment": "Malware payload (Amadey)", "value": "b274eaba1591fa4029906aa310f235ccc456b1f59be5e11c35dafd3cb4fd07eb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142926, "uuid": "8c2568d9-a405-4ccb-8118-229493fbf5b3", "comment": "Malware payload (Amadey)", "value": "fa6c176940152074ad7f902c344050b2b2c3ad8c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142926, "uuid": "1fefbebf-3bd2-43c6-a225-89480c8c68cd", "comment": "Malware payload (Amadey)", "value": "aba84a72cf4d47c4988fdf486cde1454e219dec7da12453bf982e9841cff2bc13151289c76aed50ae21dd4dd0a7f44c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142926, "uuid": "cf6e9e50-8596-4fc7-9761-a567d5f4e4ce", "value": "T10425235692E9D072EDF4177009FA12870736BDE18FB683EF2B56B18A5C73284953036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142926, "uuid": "2028c0d5-c431-47ec-9f9c-1f5483e9f374", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142926, "uuid": "50a62b93-6129-4bc5-9af4-926df8ed363b", "value": "24576:rybV4ooCGOJjIgzbv7aBwklValGCv5gJGSepaxVDK:ebV1oCGOJB7DCG5gJGdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142926, "uuid": "87b22e11-f084-40f2-9eb2-c6dfa6b44ad5", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142926, "uuid": "984eac65-b992-40d1-9c7f-0a26b216ca20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142926, "uuid": "79533431-7f34-406e-a77e-5d20d3ea7b7b", "value": "f2a71354d424e13abb6895173d6afb1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9dcaca-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137698, "uuid": "56733701-dcb7-4d4c-8ff8-5088f6d17804", "comment": "Malware payload", "value": "e0419693b150c68e88cd5eba849b6670", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137698, "uuid": "c0b871c5-221a-4f8d-aee9-3395734fc04c", "comment": "Malware payload", "value": "b31fe3b456c12758af10ecd4880fb36fff95d0d34cdb032518814922bf913730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137698, "uuid": "12586d9c-d57f-4559-87f9-dd3ecbd3270b", "comment": "Malware payload", "value": "4321178002551890b3f951890816cfb62435ded1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137698, "uuid": "fd45adc2-56ea-4ed6-9896-0156092bfaaa", "comment": "Malware payload", "value": "22364e57a1fbbd19e1abc8f59cf2acaf29a340822668bf2d26cc1a8112075a3ca4027ed9bd55b520ea0a08e57eec4660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137698, "uuid": "8fa52b4f-8376-4eb6-8cea-bc83ebbf02b0", "value": "T130647D001BE80524F2AF0B3AF5B1C9214B76BD4765A2D71F29C97C9F3963302966277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137698, "uuid": "f84ff0c9-5774-417d-a7b6-0f2323fbb23c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137698, "uuid": "1c331171-581c-43d2-ac3f-e1ebfa9c28c5", "value": "6144:4lBkewxaksnkdLSv19W4iDBpsq9Zwx4S/JLY:4lhxkEv19W7DBpsuw5JLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137698, "uuid": "65c1fc53-8698-402b-a72b-0a44789178c3", "value": 326944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137698, "uuid": "f7a4eefb-762d-4e43-92ca-f044ec18dfa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137698, "uuid": "ae0be5e4-fce3-4979-8617-84cb09246519", "value": "SecuriteInfo.com.Program.Unwanted.4695.7177.1010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae5a205-e0a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1682124544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124544, "uuid": "5202781b-891a-4f5d-9c02-0ca7c022c5fc", "comment": "Malware payload (Stop)", "value": "89ee2492a9f157a501984df2a4fc46f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124544, "uuid": "475f4969-2bdd-424c-adb7-c87a29026b51", "comment": "Malware payload (Stop)", "value": "b582fa12bae88efd86f9a3d53e804ba74f5532c5aa215cf81fca11c3a073d348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124544, "uuid": "22fe6a8e-0118-46be-8063-51f33d089685", "comment": "Malware payload (Stop)", "value": "1786a5e76762e96428493fc856b9e4864c7892dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124544, "uuid": "4d24273b-7ec9-4637-ba97-aca8553ae761", "comment": "Malware payload (Stop)", "value": "db296536099a81f603f409cc33e6d4d6f6f6b2ebc7c3a637d5797b3e34692fb85f8d36c9a76ec6dee12584a354b66e3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124544, "uuid": "d153e8f8-a8e4-4544-ba4a-30af14c9c956", "value": "T1EFF422217A91C9B6E423C9B62471C3B15F3EB8E59F45C28732056ABFED212C19F1B742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124544, "uuid": "971d9bc1-50b7-42cf-9cd1-0578408e3ef6", "value": "83f7b03b4e2f4d598c9968669b5cc91e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124544, "uuid": "7317259d-8cc4-49d3-bd86-da0154894b2b", "value": "12288:7//N+dZuid5inhY4JftbHs1t/t/uwRsPGlllTXp8Jvh0YPSp:7HN+dZuM5uhL0/sIsel7TEh08S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124544, "uuid": "344554ec-66f4-448a-8f46-07d78f7faec8", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124544, "uuid": "8f548b3a-b174-4e4a-a882-0a256499da7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124544, "uuid": "0bc33856-b807-4c84-8ebd-5f219c567bc8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc44691d-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135445, "uuid": "eb90de66-9020-4f9c-901a-198a603f464c", "comment": "Malware payload", "value": "882b0c719668b1c13e0228ffa076172a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135445, "uuid": "21506c61-3db6-4525-9402-ffec59a614a9", "comment": "Malware payload", "value": "b650ddb4f56641a4b74cda6865e37eee7022062bd12d34e1523bf61ae3e2c338", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135445, "uuid": "f2e8fec7-c477-49c1-a24f-5f0fd38e6fc9", "comment": "Malware payload", "value": "d142242d789b036c32bf0bcfe5f6ee9b3862ab63", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135445, "uuid": "42e284e3-02e6-4635-9b37-35a7cc92fc5f", "comment": "Malware payload", "value": "b4b71ef2582ec563b8071c77a92fc7535976e9efefbda57f734adf6347380d144d0a895eca1c56b45daa24e7adf0a7c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135445, "uuid": "372b077f-074d-4aae-9ad7-17017a641f66", "value": "T191947C0271F08572E9A219386CB16AB6436EFC741F60C6C77788F5AFAD712C19632397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135445, "uuid": "be68d8be-32fe-444a-a24b-b81fdf6ea2f3", "value": "12288:iKPmrLZovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135445, "uuid": "4eb099e8-10ce-41b7-9af2-b7a83e3eab64", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135445, "uuid": "eb44f970-4cd0-4dbc-b5fc-30373c3e668e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135445, "uuid": "88c9845d-e17b-4d40-8349-cdb752ac42d7", "value": "2023-04-21_882b0c719668b1c13e0228ffa076172a_locky", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f91a89-e0f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1682156099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156099, "uuid": "fd60ebb4-5a33-4195-ab31-3391a5346588", "comment": "Malware payload (AgentTesla)", "value": "5dbaa84ca2b84f693e9122285fa2de6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156099, "uuid": "48e636dd-c1ef-41fd-89b8-04d653700373", "comment": "Malware payload (AgentTesla)", "value": "b6e43bc6db8a1c08e57ed374eeb81886a0153a835dcf6ac6b87ee3a26a7401ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156099, "uuid": "0299804e-2b5d-4f28-a9bc-f72356ebb9f8", "comment": "Malware payload (AgentTesla)", "value": "ce914af526c30982c41b5b14c217828ed1b0ca91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682156099, "uuid": "61cef443-510a-49e1-866d-436a7edd0a64", "comment": "Malware payload (AgentTesla)", "value": "2b09bbefd18619b8feb61b69125b129eee16cc6ccf8f488d76215f3d6a8db9574e36851bf8662bfe0824a87f2147aea9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156099, "uuid": "87146ce1-2691-4d26-b9a5-85556c0eb5b3", "value": "T166B423F5769E66F2D36A182AC240454CFC58F82BBFD029C6B47657705AA3287D87C383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156099, "uuid": "2aa8fcf6-7709-4536-b6d0-dedd6b3e6742", "value": "12288:AKsYtCEfn3y1a9P+WFPsGgnO4HjOzAmGdIEO63cB:8aCEa1al+cPrgO4HkesB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682156099, "uuid": "36cc19c0-2b17-4985-8319-39ae017ffd97", "value": 511096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682156099, "uuid": "4fa18022-618b-4e3c-a109-bd3a0b32399d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682156099, "uuid": "b8a42142-2979-4752-95c1-b03b4e32b910", "value": "TT copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209ae4e0-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137707, "uuid": "a7181ece-5344-4e71-8abb-2630dee575ba", "comment": "Malware payload", "value": "919ef49dbacdc26cfd952e96a21fb554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137707, "uuid": "ddd635c0-f163-4446-a41d-0bc891c3e2d4", "comment": "Malware payload", "value": "b7c98becccdf60936ad46dd969cae02505297b14d398a7b60f343b60d50218b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137707, "uuid": "6fed9797-2f08-4689-85bb-b2221a0a545a", "comment": "Malware payload", "value": "cdc2692e8d3db216e4c8e8da1b5ab2dfab8518cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137707, "uuid": "4533d327-2037-4c07-83c7-4d14ada74394", "comment": "Malware payload", "value": "3e0ba86e7ed32ed30de8eb75d97bbbf26fce6e6f107e11cd577e1595ab027b0884ec1bb2a9158c1615df3f469cc25187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137707, "uuid": "941d1bd7-5487-40ed-830a-53dd0c0c1f25", "value": "T136358D87F2AA01ECD5AB8178CA568607E7B1744803309BDF56E0DBA52B13FE5667F310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137707, "uuid": "fe4c7f25-9c0f-4f40-9d58-24f788bccdaf", "value": "c241ac7d4a3e714b09522e3b0b211bb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137707, "uuid": "f94b9a54-691a-4d80-8582-9d7683d57779", "value": "24576:/1smp+W5MPcaLeaO0PWRgBidFqXlNFwf/T:dsiaBO0PWOOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137707, "uuid": "5f742cc1-dfdd-43ee-9557-0c3eac5bf845", "value": 1136416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137707, "uuid": "c516cb30-a6f1-4e14-9b21-8c6ca5d1acd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137707, "uuid": "8d15517f-d4d5-4847-beb3-47ab8a82f0ee", "value": "SecuriteInfo.com.Program.Unwanted.4695.17920.6252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29edf272-e0a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1682124408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124408, "uuid": "6cc388a7-8d6c-4f6f-863f-aa69d71ed096", "comment": "Malware payload (TeamBot)", "value": "dcde4e61d2c5e9e5876bf89fc1e352cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124408, "uuid": "1471e7e8-82c8-4a1c-b1de-146161b5955c", "comment": "Malware payload (TeamBot)", "value": "b882d5a318d9aae00e828bcc9ecf41dfae99c58faa9004dad72695be6c85ebe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124408, "uuid": "da279f4a-2b3b-4a0a-9242-1cc7a746b4da", "comment": "Malware payload (TeamBot)", "value": "0f715766622d41e3a2fec4cce70a30f6679503d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682124408, "uuid": "0a8c5812-c003-486b-abb4-ab68fd7c37c3", "comment": "Malware payload (TeamBot)", "value": "c3558bccd7a33cdd74060f01eb999ce126847f2ff21a38a7137150196ec134c128c710db1dd5bef975594b9dbfdbe77e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124408, "uuid": "48215ed9-3325-40f7-83a9-7297996fbaef", "value": "T13944D0117EE1C4B1D4A7C9B86470C5E4EA7BBC628795C19B771C2B6B2C703909AFE312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124408, "uuid": "7cf8e1dd-fcf2-4d51-a037-bb250ceeac45", "value": "c2613217b278bbf906136c8e0c29af3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124408, "uuid": "10e7629f-2edb-4f56-be9d-0f9d75f56912", "value": "3072:PSiEQ4M7J0QwP5mNI1zwS+buQJH3Hd7NhreIdieK5XpvGFhZOpV:aiE3Qy500PouQJXHdDvd+pvgYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682124408, "uuid": "52e95346-5a98-42ad-a3ae-6d1c25380d15", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682124408, "uuid": "812f6f4f-325f-43fe-8613-010ecd26617c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682124408, "uuid": "c32b3d85-2bf9-41c8-884d-4b6d910fbee0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7c568e-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137671, "uuid": "0ca0edb1-8eb2-4eaa-b6f2-5c6ae93793bd", "comment": "Malware payload", "value": "f75b4ed219f7f42d517bb1ccdf0903b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137671, "uuid": "65ac720b-db9d-415d-b6c8-96d446bc424f", "comment": "Malware payload", "value": "b9201b25bc30ad189c110318fd21d0efb2170b59a9d872550c7d711aab9e9e8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137671, "uuid": "a5038f47-74db-414d-817e-fdcab508e388", "comment": "Malware payload", "value": "ed5d0de5166690f1f1f24bdcc60d2086be132a98", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137671, "uuid": "e3c42ea5-fade-41e9-8e4c-dc4db3984638", "comment": "Malware payload", "value": "2436f1258721c6b6e5e871899ef4fc64a78e5f57a897dab5fad5f2073c8d37fa835f533f31f8b70978317e595bc0c902", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137671, "uuid": "fc73447e-c12f-4781-a473-973117cc3af0", "value": "T1BE134C891BAC5227ECEF4F7CA4F182158631F5E1A903E35F29A452E5ACA73A0574133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137671, "uuid": "da9d908d-faba-45c6-84c5-cf3a78e8590f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137671, "uuid": "0cc5e6ec-266f-4b19-b743-110c70f2ce4e", "value": "768:SyQ2zMDR4SpdC/LNJIvv5KSvtvRU3TIMd5Zwwahqxi16i1Ukis:SyQ2zMDRZRU3MMd5Zxqmi16i1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137671, "uuid": "91c9525a-ea3a-4972-943e-d8ed8802e4c1", "value": 42784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137671, "uuid": "10523a2d-c65a-442f-82c7-ac69b72f6e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137671, "uuid": "df00369c-0422-42ce-966a-26162caa1431", "value": "SecuriteInfo.com.Program.Unwanted.4695.21051.18647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159e1fd1-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (YoungLotus)", "timestamp": 1682137688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137688, "uuid": "2f1645f9-b21b-4809-adc9-f8ff63851e3f", "comment": "Malware payload (YoungLotus)", "value": "f43ab10a6a9570e4bdc2fd04aa3aa7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137688, "uuid": "320b3d22-c4b7-437f-bce1-91e3c44de87c", "comment": "Malware payload (YoungLotus)", "value": "b970c327c2e8914749e73713d4dd743ae3907f0a66bd5c34806c6e5f23cf9aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137688, "uuid": "f0dbf46f-1c64-4bd3-886a-808222c610e7", "comment": "Malware payload (YoungLotus)", "value": "487c24712a3e6774dbcadebc952d3c53471b84bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137688, "uuid": "31c5eba8-faef-4e34-8469-0419daa31a9e", "comment": "Malware payload (YoungLotus)", "value": "a6a24ab92be31af56d8d1712c2789218e807b6b2230e8a7c4beaf97d4c26e49dfbb0dcf17a7cf0c0fcda328a5a1fd37a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137688, "uuid": "7ec2508c-d86f-43fe-af53-3d1daf037425", "value": "T12506330E7F33784FDC9657FEDCA3AB84BA352A3A4895884173B3A897E451C4F4382654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137688, "uuid": "9f196934-24c3-40b0-9e98-3ab380a52cdb", "value": "9bf5e17e8dfb1f9f2b1de532bded4f36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137688, "uuid": "ddb9b613-0d56-48ab-9d54-d1da791ced08", "value": "98304:iYPGZ6Gqx5CyuqoEsgy6SDVpqyEAYOV+pyIXlmgCE660v2Pu0n:iKGqx5Cxq+gNSDzqFacpPM7Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137688, "uuid": "f0afbe04-cb42-4032-99ab-8401753b7a53", "value": 4018176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137688, "uuid": "8b6c8bd8-5ec3-4ec2-988e-47884c88b61e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137688, "uuid": "80fb42e6-15da-4f02-9af9-874a4bccffd1", "value": "SecuriteInfo.com.Trojan.Heur.PT.1FW@ayWS7Rl.4627.14576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf29ee5-e0df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682148626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148626, "uuid": "9c74963a-0339-4b38-b24a-43ba5d2d4052", "comment": "Malware payload (Amadey)", "value": "8df6565fafbb93386aaacc0edc4aaaba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148626, "uuid": "da4ae9cd-13d7-4c3c-ab45-ee1d21c7ba97", "comment": "Malware payload (Amadey)", "value": "bab5e3bf98211d2d290a8c912fa2699b8968fabc85b461e16b241bc7fba7c812", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148626, "uuid": "238e371c-b5d7-430e-abe6-865beb431129", "comment": "Malware payload (Amadey)", "value": "8a4272edef8fc00cf83a34f1bf5e8a1162b44c9d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148626, "uuid": "58d278aa-43d1-4eda-a437-7c555f70cca7", "comment": "Malware payload (Amadey)", "value": "f8b8638d997d747a16c55cab85bf87fe24c90a73b60888120024c1f94c980e9c10972f24417308574a3f05a84c6eabcd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148626, "uuid": "74042109-d740-4bf8-a2f9-617964636816", "value": "T158052313B6D4D136ECB857701CFA169B0735FCE189BA82D313913C9E8872AD0A276767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148626, "uuid": "7c36ed34-04ef-4312-ac87-687b662f8f80", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148626, "uuid": "78f3eaac-8373-42f2-8fab-c0592dee3669", "value": "24576:hy740qYysAxgZPh/Xp8QBk6XGnVM+GMyBDBp9Y:UGY4gZPhp8QXGnVM+yBBp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682148626, "uuid": "3f5a402c-e218-4837-8701-6667ac0e0590", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682148626, "uuid": "c4e81dcc-1d2f-4353-829b-d98ce912a7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148626, "uuid": "a7a9c3e7-29d6-477d-9995-2426086eee4b", "value": "8df6565fafbb93386aaacc0edc4aaaba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9269fb3a-e0d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682142622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142622, "uuid": "3f7b156d-28b9-4f9b-8724-73fac1724857", "comment": "Malware payload (RedLineStealer)", "value": "7c3abd1a0e106ea3fbc1b455fe72ac13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142622, "uuid": "295ba023-7ebe-45e2-9fed-82fe0bedb018", "comment": "Malware payload (RedLineStealer)", "value": "bcc5953f8b97cf018152a8e59c9d2dbd4d49a820e4271e599e7732b4e692c72e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142622, "uuid": "dcfe0c0f-df91-4a48-ae53-458566a78e83", "comment": "Malware payload (RedLineStealer)", "value": "7e8e9a5745d257c5d44d2a1e68895f7c61347ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142622, "uuid": "b948f887-ec00-4249-a34a-a585ceb13306", "comment": "Malware payload (RedLineStealer)", "value": "8a810098604f708b03a3cd024f6ef7531e1420ac1a1c6039d7a41a48a39af6c124c2cbde3790b13b48a48909b113986e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142622, "uuid": "7e041bec-7d77-4512-b91d-693b5b4dfc89", "value": "T18235230367E49032E8F623B058BA06C70E36FCA16B34469B7389D5595CB29D87D7273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142622, "uuid": "40e0155b-e5a5-4d09-a39a-b788a8156bd7", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142622, "uuid": "4232d263-cd88-423a-b686-4468b287ce21", "value": "24576:YyZFIgKjjZtVqpVawlFBzi1dm5/ryzCv:f3IgcMfawnBzmd+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142622, "uuid": "888a6feb-b59d-4333-b225-ce59ae1b6529", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142622, "uuid": "ab4e3acd-02ad-4761-b1cd-404eba221806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142622, "uuid": "32bffef6-1bdf-4733-b250-55fdcb967d7d", "value": "7c3abd1a0e106ea3fbc1b455fe72ac13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27efab9a-e0ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1682126123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126123, "uuid": "7769b468-0e9b-4881-a8d2-4950cd5aac29", "comment": "Malware payload (njrat)", "value": "b1c477fb5ab07872ae375897118b45df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126123, "uuid": "b34f1a84-5816-4527-9a80-7261e64c66f0", "comment": "Malware payload (njrat)", "value": "bcf282e12bdc721be6145e1830482f69644ba016fa9945cba79216319ca9644c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126123, "uuid": "7a42268c-696a-44a3-b382-474c550c3337", "comment": "Malware payload (njrat)", "value": "5fc63efcfdad9415e7d4edb9c74498a180579b7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126123, "uuid": "50221674-36b6-47c6-b99b-f01732f55113", "comment": "Malware payload (njrat)", "value": "608407633dd778f612f66f660344917dc9b44c88eb31eb166ed58777b82eb02d0a55c5438dfcd20dad2052abf22ecb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126123, "uuid": "33d0869e-342c-49c0-bf40-710a2b5591e5", "value": "T1A5033A4D7BE1816CC5FE157B06B2D41207BAE14B6E23D90E8EE564AA37636C08B50EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126123, "uuid": "e1de6fe9-dbb8-43b7-a9c9-fe00d7f2fef2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126123, "uuid": "1ce60d31-cf0a-42af-8e70-63a817615c6e", "value": "384:yxdMiLtBndznNCyMGm5savhjcGmrWprAF+rMRTyN/0L+EcoinblneHQM3epzXrNN:EzRNRMGm5tJ1mgrM+rMRa8NuJtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682126123, "uuid": "f66b8d0a-6f6a-4bba-b408-499f709d2dd2", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682126123, "uuid": "e2e6c7aa-8168-4003-8fe8-2259c712ca95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126123, "uuid": "5247757e-a4d0-49ab-9ce8-c326b00cd405", "value": "b1c477fb5ab07872ae375897118b45df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056d9891-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137661, "uuid": "541cbd0c-60f9-42a5-ae25-5a9be7acf81d", "comment": "Malware payload", "value": "04a71b81186b472170a4ff2b5dcd7baf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137661, "uuid": "1b5b40d8-dc3b-430f-a9e0-289aa3b24beb", "comment": "Malware payload", "value": "be90b231068bac218604e2683069819b2f4c8749323471a72028190936749b46", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137661, "uuid": "9afe6a02-0d8e-495c-96c1-fc43f20c0613", "comment": "Malware payload", "value": "a538b9480a5c3040f80822012c9332c85e6dfa7c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137661, "uuid": "eddc9d8d-2c3c-42ec-92ab-6b54fe308dd1", "comment": "Malware payload", "value": "c2e62f0b9025848505205fa7e973ac6fdbc1f97f180c3864bd23721dbd8f2f3c4a7fe7d236c0150aeeabd26fa78f8efe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137661, "uuid": "0193a35f-7970-4358-84d4-2f75be3129d3", "value": "T1F4869210B7106460DEDED33BFA9B0E546FBD92120735EF52298CB6B2D25B3825D82376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137661, "uuid": "85a40e86-f598-4ae2-bba4-5519e9596886", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137661, "uuid": "a76f85c7-cc5a-4823-8309-c4c7f04f7840", "value": "98304:rpkg8hn8KiyAB84gPjKVuH62NhND7BMe8Al1:rpkg8hn8hStD7BMe8Al1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137661, "uuid": "f3a0c4ec-8b9c-4502-8d52-01058853aadf", "value": 8019232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137661, "uuid": "3ecf0d3a-fe6f-4268-8096-ca4f976eb6b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137661, "uuid": "af921bcd-b51e-4f1d-9899-f9e2d6c545a4", "value": "SecuriteInfo.com.Program.Unwanted.4695.14211.7307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f1a3b9-e110-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682169638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682169638, "uuid": "3a00b863-196f-4e21-a316-68afe6ad5825", "comment": "Malware payload (RedLineStealer)", "value": "c8bcb82662046aeafe9232da6d1a4535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682169638, "uuid": "6a847a31-9ee1-4237-a521-6f1271be6be1", "comment": "Malware payload (RedLineStealer)", "value": "c04fa80fdf4575459d5cb81c0fa3753541e9bdc73c33bfab7d957740fdf7dee9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682169638, "uuid": "497e8ec7-1563-4197-9d01-e8f4d3f4c844", "comment": "Malware payload (RedLineStealer)", "value": "f8ed4ef15f690e370cc5e79a4a59942720a57456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682169638, "uuid": "22462b3a-def9-4a4d-a7f9-afad4df543a8", "comment": "Malware payload (RedLineStealer)", "value": "fd3792fa9fc92eaaff33cb3abcc57584873d5fca442f752a66650c80bf6472e0540b09a6694ee792936d5a140150a8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682169638, "uuid": "19c4c655-8f3c-469a-ade7-a73be62f6702", "value": "T17FE41257EBD44672D8F513F049FA13431B3ABCE10F7546AB228258EA4CB26D0B5317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682169638, "uuid": "2342ebe1-d10d-4ad4-a02b-48ac64734d26", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682169638, "uuid": "b143c6ca-7db3-439a-af69-45210ac57c4f", "value": "12288:By901zVGEF6AcolTscgkYyX0lH/PJ4Tnh4t7axxvA9Stq2Y+LvTtR:Byi4EFbcolQcgkD0lfPuT+tW3AYtq2Yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682169638, "uuid": "bece19b2-c3d8-4f26-b46c-2a8f97dc6da9", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682169638, "uuid": "2ca0c39f-c196-4627-a569-ab6b57423802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682169638, "uuid": "db41bff3-d3df-4430-9083-9693e23ca248", "value": "c8bcb82662046aeafe9232da6d1a4535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53779064-e0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1682160556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160556, "uuid": "741694ac-8818-4de5-8b1e-af124f2a107a", "comment": "Malware payload (GCleaner)", "value": "1a2dad4bf1e34046c74cae7c72b2de2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160556, "uuid": "41396256-5a80-42f9-896a-8f80e3a06ed5", "comment": "Malware payload (GCleaner)", "value": "c156221103a1e7bfafbbf56ea1dd65ce7f1cf7726b6864aa10289a99beb08b17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160556, "uuid": "6ccd77fc-c61d-4821-af64-670478a59510", "comment": "Malware payload (GCleaner)", "value": "bcfcb50505d9ec15b5c5fc6615c5fe8863ed3f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160556, "uuid": "8b3518c1-8aa3-4e25-a4fb-c77d9d5bc18b", "comment": "Malware payload (GCleaner)", "value": "3a15b3849fd307c112e7d36f321cde09027e877a34133f66472b1530c10d9752190ee6cc6dec5160de89473ebfb5f23e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160556, "uuid": "ee034d39-7917-4ec2-bf19-f15f271aeaa9", "value": "T15164F1907E90CD32DC2225B59970DB955ABFF80689249787B5B83B5AAD333C11E353C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160556, "uuid": "5f023ce7-87e3-448e-b9d5-cce59a6737c0", "value": "61d85d277266f17cfef1e7003ed47fb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160556, "uuid": "f78d9e7f-6a1e-4cec-ad43-67a6b93ce7b4", "value": "6144:tMapA5lWddOD9pcMvr7AfYcVgTVh8cCxhc8pu2eE:tTmT3BpcqAfYBV2cKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160556, "uuid": "10817369-d341-40cb-820a-f18d74647072", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160556, "uuid": "8e563762-7d7a-494b-bd9f-95f8ce8fc7a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160556, "uuid": "bdf149da-266a-45d1-8038-30bca6b88c64", "value": "1a2dad4bf1e34046c74cae7c72b2de2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b63891-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137668, "uuid": "05c43119-ab45-450f-8e27-6025f26c1e8d", "comment": "Malware payload", "value": "a09ee9c1c2be686ed60c49b41d777108", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137668, "uuid": "7bed9ab1-6106-45b3-b4aa-8de781f4c9d0", "comment": "Malware payload", "value": "c1b542799c21332353807f9eafc3410500bceb6f36c3102770d71bb75d456866", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137668, "uuid": "dd9661d8-f235-4363-a1fd-aa5e7f6cdb30", "comment": "Malware payload", "value": "535e43b37a5799190418b5c8c0e426de08537b4d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137668, "uuid": "82820e2b-6f83-49e7-8f2e-38061aa3b1d3", "comment": "Malware payload", "value": "795403c3e20fcbfa9e49f8116852e6c669adcc992dc740ed6ada01c9d285644feef4202a940592cf45128954c72f11aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137668, "uuid": "f79350b7-9ce3-4118-8438-e0c3baa6dde4", "value": "T131B26CC71FE8AB52DAAFCE75E0F1D2262F72B380F956C59E249D92C41CD3760250891B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137668, "uuid": "f8d1463d-5be6-42f5-8093-45bf707728bf", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137668, "uuid": "d2407397-cd59-452c-9e57-6f2dfff7e7de", "value": "384:gFY5Y2kHBPjCYTMVTgcCul5dsgpjnYPLaiSKnWeOTY5iSKDHiL:mYZVT7TCgpjxi1WpY5i1TiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137668, "uuid": "6175fd48-990c-409e-bd7d-49497bd3deb0", "value": 24864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137668, "uuid": "18eef24e-f299-4e8a-b957-8ae4160d6719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137668, "uuid": "a1ec2e42-8405-425f-8dc7-3a0e60160668", "value": "SecuriteInfo.com.Program.Unwanted.4695.662.29541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198dcd9c-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137695, "uuid": "73333523-64eb-4ee7-b8c8-13ec8a4e3685", "comment": "Malware payload", "value": "23e351b4a5b314764bac0fa72f7cc1e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137695, "uuid": "3bf4e53a-4c54-421a-b71b-7d37d69c32fb", "comment": "Malware payload", "value": "c32790654f9a590f3340475ffd635ec2b908d04be6bf1d9efe35791501724b37", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137695, "uuid": "7d90b8e4-8372-4ede-a201-bbbc93f40434", "comment": "Malware payload", "value": "324a21481779628a6274be384a540f846681e02f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137695, "uuid": "54c15315-554b-4d7d-a091-ba6fe39dabee", "comment": "Malware payload", "value": "11701b4f7d60300d3c5fb603dd80fbb35c3431d67e0291b4f87696e3a8f67d8f57569c7fde74d6abdd9bc92186153ffe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137695, "uuid": "6bc557b7-1c66-446f-ad3a-5710a5b14837", "value": "T14F921B9B1BE53176FE836D71A7D6E25B9D32F3D0D6A2C45F10AA82821FC0790376502D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137695, "uuid": "bdfad042-7a90-41f5-868e-2a10e7a4f30e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137695, "uuid": "5671e525-7952-41dc-a4ff-674db1ab2a94", "value": "384:S4Ic3LczH2womRmTcYSjanYPLaiSKnqTLxiSKfRiK0:S4I8LczH2womR0Sjaxi1Mi1fRiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137695, "uuid": "f7e24406-3f0c-4b7c-bdcb-1fb0d4c20bd2", "value": 20256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137695, "uuid": "2b8fb05c-a39c-45db-8745-ca98bb82b739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137695, "uuid": "dde0af16-c6a4-4f6a-97fc-5e64bae66d11", "value": "SecuriteInfo.com.Program.Unwanted.4695.8388.13056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa369ccd-e0a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682125053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125053, "uuid": "ee700fef-cd45-48e0-b3b1-a2b41750c04a", "comment": "Malware payload (Amadey)", "value": "a0d3a011965a2ca0151c4b65f5ba3d3f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125053, "uuid": "2a42708c-527d-4e32-866e-c0262c3069d5", "comment": "Malware payload (Amadey)", "value": "c3eb3bed7d6dba93895f080d25b6bad9769803aa252926ddb3c402467db5c46a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125053, "uuid": "5ac661ec-f76c-4c97-966f-e3e895c38ee0", "comment": "Malware payload (Amadey)", "value": "8b22773b7a1dae1864a6ace4ca233b06e339bddc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125053, "uuid": "ab2fb21d-1a41-46f7-8935-7f94035271a5", "comment": "Malware payload (Amadey)", "value": "980326f5bbe8faf38fbab9dbb4f51f43fc12f9b44e747c1f89d722e153f13761c920d4322ee29d1539b1a1c546a03259", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125053, "uuid": "bf1a59c7-508c-42da-9c49-16b5079a6351", "value": "T10F34E0817BF1D4B3F87740754821CA946A3FBCA1A695C59B3308ABDF2C726D19A77320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125053, "uuid": "d051fa12-6977-42a4-9147-b8fc6f495113", "value": "61d85d277266f17cfef1e7003ed47fb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125053, "uuid": "f99d07fe-48ee-41c9-be11-7588879f2ec3", "value": "3072:whVKAYZGuPQv4sCK2stQXA2zX2/K9um05gmqxpcE5RWF9:wDKRZ5QJCK2stOTzX2y9uuBpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682125053, "uuid": "cafbe9ef-df04-45de-b29a-a90bc7a4d1f2", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682125053, "uuid": "826cb908-72d0-47dd-a1ed-91a74fd71c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125053, "uuid": "d812139c-1d6b-4541-99b3-cdccb13fb750", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0299d3e3-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137657, "uuid": "fd5d048f-9cdf-4b2f-8e96-81b975c8cbb7", "comment": "Malware payload", "value": "ababc37ba056caea0d876feb19921a82", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137657, "uuid": "2ea592da-88ee-4cdc-9ff6-b4e4acfa6232", "comment": "Malware payload", "value": "c5d66645144ff18920ff76c493a890c9f508590dd74af496bbebb9f27f621690", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137657, "uuid": "697c987c-c7c5-4930-94cd-25007d4b61a2", "comment": "Malware payload", "value": "967d698eb4fd0bf5dcee5eff0517b5f389302231", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137657, "uuid": "beb8a28f-f147-4470-b9e1-b8af69edcd9b", "comment": "Malware payload", "value": "03706d7ad1bfb4ce5296949c71345a6bf869258a1c716529c9b9aa4023cbc425ee7b129133c4973ff25d4987d6ed9157", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137657, "uuid": "1cdba9ea-76e7-41d6-9769-065b8f3a81cb", "value": "T1A0D36D95EBD314E5D9530A7882D3E37F4638A640C221EDA3FB48A676EE737526D1830C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137657, "uuid": "099c65e1-39eb-4008-a496-46a89e52a4cf", "value": "ae9bac2697fe5a87df0cf86f2c10214d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137657, "uuid": "6ad4c9b2-b650-4123-82c0-2be23fc60116", "value": "3072:AcAPIq7L/iB8HVC4Gom8luKyldZsKI4jri1Hi1c:xAPIq7Lc8By88Hfjrkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137657, "uuid": "4d96bef3-1e5d-4235-89e1-ef8f82037223", "value": 135464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137657, "uuid": "009ad165-384c-4868-a3cb-31624590a117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137657, "uuid": "e7c07128-952d-435f-97c5-789a46dc7d26", "value": "SecuriteInfo.com.Program.Unwanted.4695.10733.2342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8defca0-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135439, "uuid": "95247072-2d36-46c3-b705-f83336bab69c", "comment": "Malware payload", "value": "09df2202c086abbe02acb5c9441ed6d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135439, "uuid": "916cf3fa-eab1-4876-86c0-8d0476b99542", "comment": "Malware payload", "value": "c86cbdd612d8604f010e25fd1072cbc48ae8acbcd163e123c592d625b0b730df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135439, "uuid": "b42a39cd-e731-42de-8ed8-dc699e3302d8", "comment": "Malware payload", "value": "e30486bb0e248323c15c877c83ffb2b50b5e2e46", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135439, "uuid": "ba7acc41-0097-4310-8628-2acf2de34d2c", "comment": "Malware payload", "value": "0da13fc29996aae0f933b83fa55227f4d91fc607295560ff22af1c3a1e88da034090fe1b45fab925433e9776da8a56f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135439, "uuid": "94038787-430d-477a-88c1-61feaaddd002", "value": "T1D7E4D0026626D473D5B20471ABBCEB66E0796D34476D81EBBF40EEA01938FD2637C346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135439, "uuid": "a5ee92ce-91f7-4db9-8675-1982ba6ac3c9", "value": "6144:6X1Gl4z14wrRZvO3LKQQej+CAjIHn5i5VL3L24ZugZzPxiAjlC4:6X1GonrRdO3+QQ+aIHk3L2IugfI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135439, "uuid": "5c571147-d8da-42d8-8e2e-c3765dec693c", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135439, "uuid": "01b59f93-1b45-4ffd-a823-df947ff40ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135439, "uuid": "59365156-df40-4feb-b0c7-84411324a34e", "value": "2023-04-21_09df2202c086abbe02acb5c9441ed6d2_teslacrypt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b470d08a-e0ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682162436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162436, "uuid": "9441bf61-4aa6-4b57-987c-1eb87d9d7690", "comment": "Malware payload (RedLineStealer)", "value": "72902d452a3bae827135fd6e40a308a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162436, "uuid": "06945c05-6c40-4907-9b99-e630ddb0e761", "comment": "Malware payload (RedLineStealer)", "value": "c8874fba9d75b6123dd36ac6b5f5b070cf9cac892b25d5e457c044d550f83a7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162436, "uuid": "d49fd1be-59b5-45c0-b1af-02785eb9f7a3", "comment": "Malware payload (RedLineStealer)", "value": "332023dd891f6f30333eb97323fc6f4ce3018839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682162436, "uuid": "1707f7ae-8738-46d9-afa8-eff8ff1c4a7e", "comment": "Malware payload (RedLineStealer)", "value": "46e0e852fff55a6c10e1c350c94a7acaebc378b710f6c602b563d936ac0d99d05f03974227ace457b20936500cb9b0e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162436, "uuid": "34b7801b-808d-4b75-97b4-ff390d576b0b", "value": "T139252312A7E84133DDF41BB088FD02830B35BD86AF39C6D766D694D998B3488D531B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162436, "uuid": "1238dfea-1f1f-4549-b199-4e934766dea3", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162436, "uuid": "3658f32b-d470-4f6d-a2d9-d177ed6c9692", "value": "24576:myL7QsVJIdEfyEbDg0AZ4z2ihsnJnWtZOLq9:1L7HnI/KDgTqqdJn+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682162436, "uuid": "36a2ccfd-5207-421d-bb82-61aaa5d9de2f", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682162436, "uuid": "60908f80-7333-4131-858e-fe7afc879bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682162436, "uuid": "e939ca79-a25c-49fc-9929-b76b463e7bd7", "value": "72902d452a3bae827135fd6e40a308a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4bbfd7-e0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682157029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157029, "uuid": "050ea2aa-3a2d-4566-80aa-cbeffc3f8572", "comment": "Malware payload (Amadey)", "value": "1679e820521ea7f93aeb36f6de4efc2e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157029, "uuid": "8db5616a-13c4-4428-942a-3f7af488183b", "comment": "Malware payload (Amadey)", "value": "c96b70df049c4475e4712d1a58926081e638f6f9458e1de6d37153564d273b37", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157029, "uuid": "3410041b-bb15-4676-ab4b-908810a18ec5", "comment": "Malware payload (Amadey)", "value": "06ebe069130784222dbf9293795a7068f718fb21", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157029, "uuid": "891fa07a-83b2-4801-8e9a-2a133a849c6e", "comment": "Malware payload (Amadey)", "value": "0b773ae62b002715c03339c13393f9efeefe4486ed568f83b6d33e95ef7edbdb675b8d210adba72e68408507e39bbb3f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157029, "uuid": "e1db64f0-71f4-4c06-9109-a0b8365cbcbf", "value": "T1AA252312A6C8C03ADC7A27B04CF517831F75BC628B7997DBA7506C9E5C72AC06832767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157029, "uuid": "7199c362-d3bb-4fd8-8e26-97aa5238281a", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157029, "uuid": "acdbee0a-409c-4435-b6b0-6a1b01948884", "value": "12288:jy90rcALIqZg1j6kQkEipGJB5nZPX6i3r62u/k6pY71QdmuOiz/ikB8pEAv3KoP/:jyRALO8zFZPF3zdQ0uOiuesEAvavj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682157029, "uuid": "a06a6626-f76a-4e5f-9e3f-e695b777f6dc", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682157029, "uuid": "6d69081a-d2ff-4fa4-a552-e666181ee858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157029, "uuid": "c276db2b-09c1-45f7-8836-08106f64efbb", "value": "1679e820521ea7f93aeb36f6de4efc2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b992e0-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137722, "uuid": "46b0eb8a-4c48-4d70-9952-b71ce7d724e7", "comment": "Malware payload", "value": "e25a0d70fb26c8d04dea0b92012bef28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137722, "uuid": "e3993bf6-3623-4cbd-b421-a185d2342484", "comment": "Malware payload", "value": "caf5b0090ee7d8556ec86f582a52bdf769fbef380bf03fbdd129df64e6b02bbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137722, "uuid": "9882dc6a-9587-4384-a5fe-6f14e34852f8", "comment": "Malware payload", "value": "471953eb59cc5aa4d32814f96f7b39ae89c91864", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137722, "uuid": "a130f474-eeae-4cf6-9019-9a3fe9909507", "comment": "Malware payload", "value": "b43c9a2af87467fdf463c1b888ea9c3cf462fc8d5469d2ce2b233e5ee0d5dce00688b47cc551bf8902b8a279f5cddd68", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137722, "uuid": "04213e46-31b3-491c-87d8-03b26c15bbc7", "value": "T173A4AE0127D8475BE1EF5B79E0B691A1C7B2B562B93EDB9F6D4064EE1C12380D900BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137722, "uuid": "20407f83-1f13-4265-8856-251e1e709dd3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137722, "uuid": "30addd83-7f5e-4128-a482-5662c205047f", "value": "6144:/RYYIiJaeEWfTXQyu8+yi4ZiwAEsFdnQ6uw2lQc2RGtSV41OJDsTDDr1LUe6GNxw:/F9agBr6ilLS4msT1oe6kf+IJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137722, "uuid": "f5750eb5-ce1f-40df-95b1-9aa05792505b", "value": 469280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137722, "uuid": "24d74e80-8186-438e-be96-f68aa785f882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137722, "uuid": "8e21907d-c33f-4b4e-8774-583cdceaa186", "value": "SecuriteInfo.com.Program.Unwanted.4695.8453.31800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79e231b-e0a9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682125558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125558, "uuid": "f2780ae1-3af2-4584-9b84-51259c940306", "comment": "Malware payload", "value": "83863beee3502e42ced7e4b6dacb9eac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125558, "uuid": "45003192-d1a3-4e86-85b3-085b63dbae76", "comment": "Malware payload", "value": "cb470d77087518ed7bc53ca624806c265ae2485d40ec212acc2559720940fb27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125558, "uuid": "0b5fbb88-444b-46a0-ad69-68b757635c2b", "comment": "Malware payload", "value": "d9d40cb3e2fe05cf223dc0b592a592c132340042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125558, "uuid": "2376cd7e-bfce-430d-92b5-3fbc7572eab7", "comment": "Malware payload", "value": "f8b527ea148505b645993656866c3f059b03b6250484b516ce77cbff6a7999dc192d6559ca70b8446e6611372aa9397d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125558, "uuid": "dffe7b05-f2df-451d-8cc2-1b2e3ae8ef9e", "value": "T11B759882B93DEC63FD9C38F0C886AD583C0D3E9666AF34AF357AF65994339109680D15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125558, "uuid": "7ae3e970-6520-43b2-82a5-5a17e819840d", "value": "01c1fa6b7b1ef3853014170a206e5f32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125558, "uuid": "b6bb9d6c-4e3a-424b-81b0-7262cb8fb4a0", "value": "6144:lkxsldgbztkAzkAZqrEdrEAZUCwFjNNJKa:lkxsluNPqrEdrEBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682125558, "uuid": "40a37517-dac4-473e-b82b-3625d598f153", "value": 1635112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682125558, "uuid": "fa3a1a8b-affb-4163-b231-ba92ed3dc936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125558, "uuid": "67a3a426-f797-47bd-8526-06d08b606046", "value": "cb470d77087518ed7bc53ca624806c265ae2485d40ec212acc2559720940fb27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2f14d3-e0ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1682154153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154153, "uuid": "3038e8bb-431d-422d-92aa-9e4b53a6e614", "comment": "Malware payload (DarkCloud)", "value": "75eba265227589a5a677be0ad54a36d7", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154153, "uuid": "bc73a0f4-4a5e-4767-b53c-5b92734b9108", "comment": "Malware payload (DarkCloud)", "value": "cc762d5a9bb646b2029fdaf00930e44b24da79b1d39ebd392d7471bc92ae1df8", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154153, "uuid": "28a20591-777a-4810-bd76-393743b63510", "comment": "Malware payload (DarkCloud)", "value": "a203cee9cc091c8f04e06d0821baba931519a651", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154153, "uuid": "893b903c-dee2-4ccd-9fd0-d8f1d763d3fb", "comment": "Malware payload (DarkCloud)", "value": "4a29a67d30b10ae999dc6fb717dcf8f12808acc51ea1e3437d1f9dc33fd13283cf2d091cca537dd5bef709cf9c8d81a5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154153, "uuid": "c7c098aa-7f3a-4e66-a241-bd5444bfa1d9", "value": "T1324533680244F277E08FDD0E75C8F8F0D576C9C8D5E75AC52A329677970BA82E0D1AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154153, "uuid": "c547dafc-319a-49c7-8dbe-fafa4161e782", "value": "24576:1Tt3JqG4GdMX3XX9QFXQKvsl43vBQJgfQTjzfOEggVEDikq:1fv4Gq9QS74fpkOEtkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682154153, "uuid": "fad6b45a-8c3e-4fd3-b3eb-eac8d279cdfa", "value": 1165579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682154153, "uuid": "8c9dcee0-4e2a-4c4c-8977-e1ec230ceae5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154153, "uuid": "98d38250-9bec-46d1-8ef2-fae32d922e06", "value": "Payment Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f4b302-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137694, "uuid": "b9b662f8-77a3-4a03-9fb0-ce2d1bc03fa9", "comment": "Malware payload", "value": "b7efe027d9e699a3d8e6706e0899d9bb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137694, "uuid": "c75a0cb7-f780-41bd-b4a9-3f5d842b2671", "comment": "Malware payload", "value": "cdd0702b7e96ebf780382f24a7258e2bcb6311586fd266941c642e423743c72d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137694, "uuid": "034dec0b-5aca-48b4-8df6-f02337413e74", "comment": "Malware payload", "value": "031e4a71d0e9d212a672aab97a44269c3f97b0e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137694, "uuid": "4c2b0ec4-bf0d-4a10-bb06-8191e4e5f512", "comment": "Malware payload", "value": "3a28f0b294d795840a04a85f26276dd4687a1ddbc3c7cf51fac20cfe0ac6b47c7532a29ba2b2df044bdfd10e65a6947c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137694, "uuid": "4ae9b9d0-db23-41db-9003-709fec29b339", "value": "T18123197529D93035FE127BB25BC9E25DE76BB2D4D783962F20AF424317C1A50372A234", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137694, "uuid": "18b9e601-0103-41f9-bf64-efed3cdde726", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137694, "uuid": "d5c3d960-cae1-4a9b-8814-91ca3c6b8c6f", "value": "768:434u+RRfzh5M4pGtloFie/PxVewHRmm1eoezXbXwmUX/KlSbcP+yNYuIEQeTtvZn:4ILbVT4/QeRvZ8QsUUUHNlEA8i12Fi1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137694, "uuid": "76f1d847-b88e-4b0f-a814-6d0013eb7f9a", "value": 48416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137694, "uuid": "ed73b037-bfc3-4d7a-a511-42c39d5efc88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137694, "uuid": "87012ca8-8fb6-4f58-acd9-262cd814964f", "value": "SecuriteInfo.com.Program.Unwanted.4695.1765.4861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa0f0e9-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135450, "uuid": "616ee976-8f5f-475a-8cde-0801eebaec22", "comment": "Malware payload", "value": "f4518eb51e3293efeaa24aae0e611e03", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135450, "uuid": "ea5857a8-5411-4f70-87bb-a0e2dd3d8c75", "comment": "Malware payload", "value": "ce0143f37f266452fbd2d158d8fa40bc72cfec1537ef45d3d167885e497dcab1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135450, "uuid": "e6f8b5e5-3c1c-48c1-ba71-53d532ad5b6e", "comment": "Malware payload", "value": "0e9d6e201bd40c3713aecd53bc6b5e45c24cca24", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135450, "uuid": "a6aee3d0-bd1c-42ba-a883-e77f0b259188", "comment": "Malware payload", "value": "1d28a7a059ce8bc7c3ba17cf3d88b9cb72d1a6755ec9e39af86a2b929744b7daf36d1a572df053ad728229f36fc4ebf8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135450, "uuid": "e04e888b-3536-4b6e-b7a8-9f5c25c2a0c8", "value": "T1DC947C0271F08572E9A219386CB16AB6436EFC741F60C6C77788F56FAD712C19A32397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135450, "uuid": "7ea073e5-fcc8-4528-8ff1-3283ab680778", "value": "12288:iKPmrwhovqk0kQkM0k0k40k0k0kikckyk0kgVa:iKPZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135450, "uuid": "5fd261b1-7d0c-45e5-be30-13fd701de8bd", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135450, "uuid": "d713c198-d694-460f-af1b-4846fa6fb254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135450, "uuid": "364b386c-2ed0-4a75-a44d-1c8b84d710d5", "value": "2023-04-21_f4518eb51e3293efeaa24aae0e611e03_locky", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b423001-e0a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682125323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125323, "uuid": "712ef394-8746-42c0-a58b-ad341b6658e2", "comment": "Malware payload (Smoke Loader)", "value": "fdf52f22136ba739df08c52c94d81f1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125323, "uuid": "91489822-264f-4c5b-93fc-cb037324650e", "comment": "Malware payload (Smoke Loader)", "value": "cf0c8fb5107e1050a82bceac1996d5e5e8ccbac9026996bbbb463b15075b61f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125323, "uuid": "7ec5f984-fa1e-4ff2-a485-92d6a37b102c", "comment": "Malware payload (Smoke Loader)", "value": "30c613fd4b59b6dd3df93eba626fb492ad286ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125323, "uuid": "f569d9ac-dca4-477a-b5d2-ba64a220d409", "comment": "Malware payload (Smoke Loader)", "value": "48bc347e02a5b27ace83e3913a78331fac40d5e70a29bef7f2432d564681dee0ee8f546322a168837c1b90f4aad6ad69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125323, "uuid": "63754163-ec48-4d69-8600-792975fba9d1", "value": "T11D34E001BEA2D476E82740355465C6D16A3EFCA56A9982DB33093B7F3F323C19B67321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125323, "uuid": "9c75a02f-e1a6-4958-b529-ec42007be174", "value": "8cb869f42d9744fa3286b04b1d083ca7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125323, "uuid": "760eb63e-ddba-4040-93b5-a7ce17989a6e", "value": "3072:faN+y8bdCBl/sGa+OiA82t5vg2JUNXV45H/hELJF:yN+fdiPr5Al/g2JGo/hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682125323, "uuid": "bae55c16-9a55-44cc-9ae6-47997405a89a", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682125323, "uuid": "06101459-77fd-49e8-a973-e624eb6bd120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125323, "uuid": "374c4d08-863a-48a4-864f-dc880fe96eae", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c74660-e0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1682154521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154521, "uuid": "ae5e2f79-d815-4521-b20a-eb5d9baf0278", "comment": "Malware payload (AgentTesla)", "value": "f373c922340877df774e4bb39dc4bb8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154521, "uuid": "f106c476-42e3-499d-b307-fa6b4338ae6b", "comment": "Malware payload (AgentTesla)", "value": "d0417481a2546ebd19cb1661893d8564fb9d4f7a32f1adb7560329f509a52047", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154521, "uuid": "179be80c-d993-4e28-9432-babb4ae4d5a3", "comment": "Malware payload (AgentTesla)", "value": "17a5eaa820d861e8855ff06c7aa8a2c8be2201bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154521, "uuid": "4a217971-7273-4e1e-a204-c1194a6b9921", "comment": "Malware payload (AgentTesla)", "value": "3b51bcea27b2b6e2bd961fccee678d17847be89ce298695aba6b0a7d67c911c7991948b6f5e8abd823f141b86b28711e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154521, "uuid": "045c1f8a-96f5-4e9b-bb33-798361a04d01", "value": "T16E82D0B8DB11961785957241B1EFE1E56337923F8A47DC98C548FA08BAF00DE8170EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154521, "uuid": "168fb04a-a49a-47b5-a788-7262ed0b007b", "value": "384:06MjjibqRqfjkjs0DfD8N65KKdpwqf9ETiY5E6D/O9kquNsELRMkl/88QDeZZJGt:PwD8NeKKdpL94XtTO9kqKsELnl/9QOZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682154521, "uuid": "25670990-ec34-40c9-a99c-464afffd2e1e", "value": 19298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682154521, "uuid": "79f57dfd-2eab-46dd-b49b-ee4ceb719288", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154521, "uuid": "8c7d7e80-27f3-4168-854c-9371fba19e29", "value": "Invoice No. 024PSE-042023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37064021-e0d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1682142469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142469, "uuid": "24356914-d0eb-41be-be7a-b38a92ec0590", "comment": "Malware payload (AgentTesla)", "value": "8b34f1ff4b8a9a0186eb1dd4c8c0be86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142469, "uuid": "bf9d927c-c83f-4ded-8e67-28f64e02fa99", "comment": "Malware payload (AgentTesla)", "value": "d215dda73b82eaab3f0669e5e7ee603b98aaea9abfba2b80ad7ed8272b0ae8e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142469, "uuid": "1d0abe5e-4325-43e1-9728-5ae77762be1e", "comment": "Malware payload (AgentTesla)", "value": "cec9e95ef3fa126a36b11b415ebe09dbfa738c43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142469, "uuid": "7bcc602f-22c1-4af8-9a80-b094d475bd20", "comment": "Malware payload (AgentTesla)", "value": "2c93d509d7d708c6475a3a455e9fb853133680d8ffdc83fe22b055ee1641d2e7de09fa41f2365a02ff5f15789da2698c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142469, "uuid": "104095d0-4793-45ad-a66f-d5e7218ab078", "value": "T113E4019D97E5CABBC2A80FBD405666882B7440E37A37C63CDFC74499FB47B041E84686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142469, "uuid": "4c87e096-b452-445f-a44b-fe22501196ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142469, "uuid": "64519b3a-3bbe-42c4-989d-8ed41cb9353d", "value": "12288:EOBO5ZZC/W2n9NssMFoKZk7WcUDNIhJTH3J06wHnMAv:EOqTC/fXssMFocS3UDNcJ+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142469, "uuid": "3d3e3008-3956-4ba8-aa75-e506b5dbac82", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142469, "uuid": "7869f548-7fb1-4080-9cd5-079d1797962c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142469, "uuid": "24b8950d-9b78-4c1b-9afa-70d3a1160f42", "value": "ENQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d3ac3d-e113-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682171102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171102, "uuid": "a5b4d306-f4ae-49d0-9eab-61d1246a3489", "comment": "Malware payload", "value": "ee66abf2501f6004348e2efd096759f5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171102, "uuid": "69d55f59-cb8e-4aab-8525-19305a1338a0", "comment": "Malware payload", "value": "d243aeae6826a4860c17ec40d9891da10eda878376bce5172eba60bcf0c98588", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171102, "uuid": "3368cbbf-463e-4885-bdd7-c96a2cea828c", "comment": "Malware payload", "value": "e07900e8b5ca49892820cde90a53357c0713c8ac", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682171102, "uuid": "6bac17b1-e0da-4e58-9135-5fad183d0768", "comment": "Malware payload", "value": "4f7ecfd880f58c2adabc1b3498a1bda537a801dda0e513a3708b4bc2071cf15133db5bba8080b8309fa95d0b7d9d6c03", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171102, "uuid": "ca53411d-f3f2-4a45-9b49-07cf166a18f2", "value": "T1C465E121FBC76132D96A017C297B76700A39ACE11A6CF52BEBC4721E2D711D06335B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171102, "uuid": "343495cc-7d88-4511-9531-c0f56751be88", "value": "24576:CKSOxtwYX2BopGiuN5x5szaQ4JQbcwOVARfl9VyT0:CKSEt/2B+G1LtQ4JQtVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682171102, "uuid": "d7ef6c8e-bf31-4b44-91f9-90d3797272b7", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682171102, "uuid": "1d4305ce-6b87-4540-87f7-c5f17ac28709", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682171102, "uuid": "6b700842-e49c-4495-a1af-c4b28dd66185", "value": "Bard AI.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffce13f-e0c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1682136954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682136954, "uuid": "0c051edc-be93-4a47-8fa6-1e3fac7a329c", "comment": "Malware payload (Mekotio)", "value": "2ce0c27147c20019f5133a1ccb1fae44", "object_relation": "md5", "Tag": [ { "name": "Banbra", "colour": "#B77AF7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682136954, "uuid": "3228bf2f-3521-4e3b-847a-33a7ffb7c089", "comment": "Malware payload (Mekotio)", "value": "d55efd7cfe9f2d5e748eb40301004c8d913446bf66e27576f1ab9f2a1eb57509", "object_relation": "sha256", "Tag": [ { "name": "Banbra", "colour": "#B77AF7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682136954, "uuid": "4fde38f6-12f2-48ec-b775-76ad3dfc3e19", "comment": "Malware payload (Mekotio)", "value": "25e68e2443d445e7c1eb65f34b7e9dfb81536213", "object_relation": "sha1", "Tag": [ { "name": "Banbra", "colour": "#B77AF7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682136954, "uuid": "8f11ca0e-6ce8-454a-91f6-a41a0de1e1ca", "comment": "Malware payload (Mekotio)", "value": "38bd9f11771b9bea85d1dd1fe373a1325565196011479f149d46977f36cbcb344969ae35abffb94cd9cf1d611e45330d", "object_relation": "sha3-384", "Tag": [ { "name": "Banbra", "colour": "#B77AF7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682136954, "uuid": "4bb51960-f5ff-4820-a6f7-9c96c362c395", "value": "T1104623737295413BC0DA45700A3BBFE971B51A2547A298FB16C8ADCD3B725E0A333993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682136954, "uuid": "e7d9d966-a669-4c58-bf17-7c078e8f30e3", "value": "98304:HYB4IV+thVSbmD93MHHvjTTm1eIwyQw1VwbKP+LQiCS7Z+ntffQulGtMHA:kDyoVPnTm1eIwybwbQ+aS7snNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682136954, "uuid": "e177e674-5a19-42b3-a332-a26adb2723ea", "value": 5876224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682136954, "uuid": "02b2ef66-c1ba-4a29-9c88-c16de3d5d9ff", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682136954, "uuid": "809c9f6f-5e26-451e-8be4-ccd940cf964a", "value": "00198871766757868798794513.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdd52ea-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137701, "uuid": "6cc5bfe3-5d89-4011-9bfb-7a0cb85fc67d", "comment": "Malware payload", "value": "45841d88781fa4c6b4a7c35607b687d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137701, "uuid": "2cf22f4c-7f20-4434-b05b-3112fa198f08", "comment": "Malware payload", "value": "d5c8928f4356ef53f2a571039255d0f4c36b522e3e190bab8ad433b4b6bba70c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137701, "uuid": "0f650b11-9d18-4894-8419-f50080aedaa1", "comment": "Malware payload", "value": "518cc0754ea56def3be2f48fb0722b6257e23653", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137701, "uuid": "2f929cfd-69c5-4286-a4d8-5564fdbed243", "comment": "Malware payload", "value": "b90260e260d4a11009a1cc0e519bd1fd0b9e4bd2d62c688fb681471baa9d5f5b5057edb959bce6f07aa5a5c287e67f10", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137701, "uuid": "784c929b-daa3-4a05-b57a-66b0e56c714c", "value": "T12423E85438DD303DFE167EB39BC9D2ADD56BB3D49352C9AF202A928327C16523762138", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137701, "uuid": "e522164e-71e3-4ad4-b699-cca9c2443c16", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137701, "uuid": "9bba7440-e46b-4010-b867-546cd35ef8c3", "value": "768:R34u+2zdcH4J4cbLkfbFvalCQkcvvpGghZmE7E4YPiIl1P1jv1dx7lQGARKRnQJs:RIZYkvsKqRkwFi1R7i1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137701, "uuid": "6c466c8e-c7eb-42e2-9574-c0f34a07d0b0", "value": 48416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137701, "uuid": "d5f0c772-72f1-4556-99db-2930d869dc7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137701, "uuid": "fc046e43-5e21-4b81-9480-eff39ceadfa0", "value": "SecuriteInfo.com.Program.Unwanted.4695.10334.19263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6778f2-e108-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682166419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682166419, "uuid": "82018b69-385d-422c-b906-74604a5f9cae", "comment": "Malware payload", "value": "de96889f683e35be177fec5f20d6ffaf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682166419, "uuid": "35ce192f-01cc-4258-9d16-4de652615464", "comment": "Malware payload", "value": "d5ca22fcf93f36b93c83ffc688de6c57641eb201f79414239381ac41d9f417c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682166419, "uuid": "7c92f121-53f8-4d95-8744-49c86b6ce029", "comment": "Malware payload", "value": "a147bad35120fe10333ee47fac0afa72107b6426", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682166419, "uuid": "0ccdb1de-2837-43a1-a153-09f914269971", "comment": "Malware payload", "value": "a9d34c3ff3390dfc4e69999be33df4df69270e1ea9de82790d2d3ee30d283843820c25f9c2243ac7b6b59b9a1593bbe1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682166419, "uuid": "a10fb914-76fc-41a3-bf36-0ad1c27f44a2", "value": "T1F8C48E423196D0D6C8EB94B49EDB672D7958A060431980E3B7D43F4F6E3AEE788353C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682166419, "uuid": "69c6ec57-5c60-4d13-846a-cadee1b678e5", "value": "6144:7PrSLVPFuVHEvO5LYBp9fb2rSAOntTVx2QZsP5OvKAON:7YPFuJ8B1AOnF+FROvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682166419, "uuid": "d3758b12-016c-4cc8-ae3d-89211aa2e1b2", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682166419, "uuid": "c7f68708-7ea7-448c-9946-269388cf6d3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682166419, "uuid": "29693e4f-8822-46fb-9cf6-fc9a5b0ca460", "value": "SecuriteInfo.com.W32.Virtumonde.AC.gen.Eldorado.15775.9064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394a2b55-e154-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682198737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682198737, "uuid": "2f1687c6-665e-4104-beb2-ddd8a042c2f0", "comment": "Malware payload (RedLineStealer)", "value": "e9d45eb873b8c5101a61f7027d923cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682198737, "uuid": "2ed9d01b-4881-45b2-99eb-4f7f21f8fb87", "comment": "Malware payload (RedLineStealer)", "value": "d6ceb78f6e8263216c727660761a85b2bf8c37c9b6eec5a564c251ec81585d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682198737, "uuid": "f099e5c9-da14-4c44-a487-c3e236a0174a", "comment": "Malware payload (RedLineStealer)", "value": "841e570b2e9054fe0c3be8369c3ca12e00b6b46f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682198737, "uuid": "36079789-16a8-4d88-a1ac-850e59f5644e", "comment": "Malware payload (RedLineStealer)", "value": "35b57473053ee6a730f9d377cb0e3836d8f60aef31155d0814f813a4248b9e45cb2ec0f64ef975b79e5de7dc7a95063b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682198737, "uuid": "8359ab66-c0a7-4f3f-9041-b483ce534230", "value": "T1A3D5546B388CD3DA8575E2D790D167AC35D55761B087B2FFB90038ACD804FE02A4E5BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682198737, "uuid": "a7f3c794-4237-4dae-8f4c-06c357c58fe7", "value": "a0222e526294c98d9d0ec63a7fbbe6a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682198737, "uuid": "edb675b6-4048-4d3a-b76e-168e7c02402c", "value": "6144:ROYzcbHES+VvHfl/c4Df810g3W/yZEXAWFsCbpCFOh:ROYs+lHfl/cIq3+IENZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682198737, "uuid": "051e0987-733c-4d8b-b27d-1e401cb2fa1b", "value": 2858656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682198737, "uuid": "eb4156bd-f34c-4205-ac9b-2160744e0bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682198737, "uuid": "d84d7c57-41e7-44c8-abe3-391253b4f5b1", "value": "e9d45eb873b8c5101a61f7027d923cfc.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588b58bf-e0af-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1682127922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127922, "uuid": "ea971d6d-26f9-4775-b5ee-d059f982efbb", "comment": "Malware payload (RecordBreaker)", "value": "b56d12e111e21493fa45831fe7723542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127922, "uuid": "c5def7bc-1189-4d51-9f41-f387b64f7996", "comment": "Malware payload (RecordBreaker)", "value": "d75531da2a56e7bb421f77d24864976be5e25ab9260249f1af2e1abd6ed9e9f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127922, "uuid": "96696a19-897b-4325-b3bf-c84332a08ab0", "comment": "Malware payload (RecordBreaker)", "value": "4c696241e5cbb4cd68aa6fbc9d00419a5e460a1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682127922, "uuid": "e3415d9f-90c8-49bd-a577-1c69b57a6a00", "comment": "Malware payload (RecordBreaker)", "value": "a819d2316d83a9e2473e1d1d2edc4f713d963807d8b655e1fd1a764c7b9d58e76249c489d705ad84139404ccff8f38a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127922, "uuid": "536caafb-3793-4b9d-bfed-06a9e9291dcd", "value": "T114C533A3581AB429C6B5C1B9DCB9B77FC5769A5A5C6E8404074B037F1FCA878C010AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127922, "uuid": "4a8829c3-415a-4a63-ac28-ddb2488a3277", "value": "9e92e4f1e52f17fae3bb6e92252e0eaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127922, "uuid": "425b7ade-21c3-40bf-b2d8-a40573fac401", "value": "49152:WJZQdK0ZqZ3TACMdqXnst8butNAHFJCBVfB2AQreW5kTD:8Qd9CM0n3u+/6fBLQre+kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682127922, "uuid": "93791ffe-cf2d-4755-b63d-c26758c4fb64", "value": 2502656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682127922, "uuid": "4fb8a254-2770-48e2-82a4-512dc5c8d4b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682127922, "uuid": "72eeb21d-8389-4e52-9e8a-e82c24201d6f", "value": "b56d12e111e21493fa45831fe7723542.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b436b8b-e0d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682142020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142020, "uuid": "06227478-aba6-46de-872c-2dc18e9d08d3", "comment": "Malware payload (Amadey)", "value": "84aed236b3e29b09045cb40e9e88c56c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142020, "uuid": "7cf999a2-9b7f-4383-8a67-db0080d248f9", "comment": "Malware payload (Amadey)", "value": "d7b289d1ec2774201e21905331c105ee8f10e12a61d7f44f1253e7ae9f6fbae2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142020, "uuid": "69b42620-f28d-4030-9391-1c1418817a91", "comment": "Malware payload (Amadey)", "value": "5f2189ea685e2d7e25292b761d34ca935375284e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142020, "uuid": "da5b22e1-88fc-4cc6-9ca3-ca59206939f8", "comment": "Malware payload (Amadey)", "value": "46465a041886a505bdc19085568fe7e1b6e65ddb433b5c13345df0b057576f747c74be08328616ee423de15e6775dfaa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142020, "uuid": "0cea65d1-3288-4e71-b4be-41bb7b0dbc85", "value": "T186252316E6D820B5CDFD17B02DF6035309397CE24E70569FA24A3A8E59735C8E2353AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142020, "uuid": "e3c66b71-7eee-4835-b2cd-2f54e2bbbb29", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142020, "uuid": "158d7701-cb47-4bd1-b1b4-d1eaeec2eff9", "value": "24576:IyysEuXs+Hc66dGD0XIUg391nrGyF61/wViY7:PXssWGD0XXe7S0c/wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142020, "uuid": "7025ef72-2567-425f-b02d-1d0447e10dcb", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142020, "uuid": "c52bcf2b-6273-4165-8a8c-15667e44e52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142020, "uuid": "269f2454-85b2-4a31-8759-2ec2e34f3aab", "value": "84aed236b3e29b09045cb40e9e88c56c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07439ddb-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137664, "uuid": "5b7462e8-4d9f-40a9-818f-7bece3ea6999", "comment": "Malware payload", "value": "4a7cce92573dd1d65a90fef38b9e90c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137664, "uuid": "e38f1b0e-de9e-45b2-af6b-0d21755700cb", "comment": "Malware payload", "value": "d7feb6518543067c9de325581195c40ae6cf3daf5441a9ee43af1d852bb1c628", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137664, "uuid": "0aed8437-08e2-4d15-a8fb-97777c9de9c2", "comment": "Malware payload", "value": "8e50408f596dc679f1d763de11d0e3b8b22b79b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137664, "uuid": "57061ff1-0550-43e7-af2a-b993c3789190", "comment": "Malware payload", "value": "fe35139b58c13c194f0830969277a80a7bd8c5742f802228cc4a645efc01523f5bc8f2a07edaf0a7ad6e3b2592eb8490", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137664, "uuid": "84971644-4bfe-437a-88c4-138e26f8ded7", "value": "T10A92199B1EE43266FE827EB557D6E2AABB33F3D0D6A2445F1099C1421EC03A1375903D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137664, "uuid": "488f13c3-71c5-4902-b86b-3a156ed181db", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137664, "uuid": "b7b7e1bf-65a5-4405-b71a-62fe6458fdf2", "value": "384:a4Ic3PMm7SwY7Z3g6Cpl1oBeRKnzanYPLaiSKnVv2iSK5lAi0e:a4I8PMm7SwY7Z3Aplq88nzaxi14i1MiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137664, "uuid": "a932cb1c-920a-4bdf-9049-35d0353863ab", "value": 20256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137664, "uuid": "c40d62bd-01a8-4a2b-880e-235b40f12a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137664, "uuid": "f021a769-0ae6-4c2d-9c75-4c5f06e6fabb", "value": "SecuriteInfo.com.Program.Unwanted.4695.4768.21521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c0e802-e116-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682172290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172290, "uuid": "970b7bc6-36c5-402c-ae75-bb7a67c0c1d1", "comment": "Malware payload", "value": "3b6f04cf436e7b5e71388e981e411280", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172290, "uuid": "e9a8cf74-1626-4c93-ab47-59b6c1eb7fee", "comment": "Malware payload", "value": "d87eff4ee5c009cb971105b2075cee0d9da56cc209b8b35954c9a2b3d6b8d093", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172290, "uuid": "6414e06a-e838-45cf-8db9-378147db3485", "comment": "Malware payload", "value": "15df87f64d16d4dfa4ba6f1d24019f1357d231c7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172290, "uuid": "c6dd9fa9-f9a5-4f10-afe1-702e81adcd42", "comment": "Malware payload", "value": "9fcd428760b7e2e4fd1e782866e86b9506ff947ec3e8ceb5b0fa615a62316d46b7a96eacdda5e168d65abe099ee33d34", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172290, "uuid": "119b62e2-677c-40a1-928b-bf6c5f219845", "value": "T16F25332BF7446A8604E50BABA7D4E048945F061E972CB2CB9328BF475233EA77D55FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172290, "uuid": "60aac05a-c4a3-41f0-a94f-e3476dff5319", "value": "24576:zQWFvimb0DK9gcwkexlJMl748PnEn91wKEd:Tb0DK7wdJMlM8Powd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682172290, "uuid": "21a565be-2e97-41bb-9234-92d983262788", "value": 999792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682172290, "uuid": "507bc951-d994-41b9-b70b-cef27b56f9f3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172290, "uuid": "5168f014-a93d-41a2-8a51-27a3a04a149c", "value": "Bard_AI_1.2_setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06b6e68-e0c9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682139263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682139263, "uuid": "fe9b29fe-7505-4b01-aaa4-f13437f9a26c", "comment": "Malware payload", "value": "4961eddc4c3a3c16d53052129e2d1729", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682139263, "uuid": "227d0960-9608-4f62-8616-2d8aca38ad1a", "comment": "Malware payload", "value": "d8a198497691e518949afb66e679b3f6de6bba37f92940dd199c851137f2cf2e", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682139263, "uuid": "0fff7271-b80f-4585-8958-8e1a651e033e", "comment": "Malware payload", "value": "84fd916ace270d3e136642542297f9e9433f17b3", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682139263, "uuid": "199b9e8d-c536-41f7-be30-9da8e4e86cf0", "comment": "Malware payload", "value": "5196c54f148410da4a05f96452b622b53d494ef64c438f2734b50bd8be5a610fe3e90c678724ac92a8625a1b56690aef", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682139263, "uuid": "f19ca995-5deb-42f7-be71-2e76af3ba2fb", "value": "T14526335938DD01E2C824C17327FFA74CA2F16520E0E61DDB399E429A647B5FF272A245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682139263, "uuid": "69962725-cd37-41cc-a124-fff9c7360b6c", "value": "98304:ssZt5L5cDor1PJ8ht/pc3A72PQZOKt2y0DW7teKmci2ni5:RO4h4hcQ72PXKtgDWhevci26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682139263, "uuid": "073898df-62f9-4b48-b8b1-6f20460b4969", "value": 4772985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682139263, "uuid": "47b5c989-664b-4b5b-aeaa-7457307e9338", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682139263, "uuid": "9e92c390-8718-47a3-a59b-146038a28dbb", "value": "Arc_digital_AdjuntosLBZLKNKNKOPODRGoeuiu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c813c74-e0cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682141727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141727, "uuid": "5d641929-ce95-45fe-99cc-37d272e1f6f1", "comment": "Malware payload (Amadey)", "value": "69572adeba7c6c2f9aa8d14f09403cbb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141727, "uuid": "dfdc71c6-28ef-49fa-97f0-95d5514e5cbb", "comment": "Malware payload (Amadey)", "value": "d96239eb6f4f3af1613dbb8513d97b895dccf7b986adb6d2a94a3bd3064b471b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141727, "uuid": "111b5677-bdc5-47df-89f7-2ae6428af87c", "comment": "Malware payload (Amadey)", "value": "049472cbf168eb5d70783c1bda593a6061046a40", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682141727, "uuid": "d4e30e44-97af-4bc7-8691-348ad8bc178f", "comment": "Malware payload (Amadey)", "value": "b480214fd48ef199c290fac259c336b7994bd9a02ad8ad09d12752092406b71d4499a31667f79d34f53e0a0a9713e1b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141727, "uuid": "70c8978d-36d0-4a1b-86a0-496c49a7e1a8", "value": "T16D45234AA3D91423ECB41BF00DF923430B357EA19B7667AF260644DB1EB26C4593877B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141727, "uuid": "89c27fd8-844a-4261-89d9-d336032e6eb5", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141727, "uuid": "1a7ed7e8-c145-4bfd-a330-14084c279b71", "value": "24576:myu0NUGWD4saGhdW5Ue/TMvo8KDliQdb/WlUDx:1PG94RGhdW5Ue7b8KYQb+l0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682141727, "uuid": "f076db96-9e71-45d4-a007-38af904f7237", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682141727, "uuid": "9ffde868-7bc5-4c6f-b499-37c19ae6365a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682141727, "uuid": "bead61e7-6820-46ec-9a83-537c80bbd3f6", "value": "69572adeba7c6c2f9aa8d14f09403cbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29026242-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137721, "uuid": "bbe38f33-2f92-4763-b19f-ce24261b5302", "comment": "Malware payload", "value": "4a38f09ffa29021bef01a9f46f192d20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137721, "uuid": "d62e2ebc-8945-4441-a798-44b06edacd7b", "comment": "Malware payload", "value": "d97f137640170ce5bd67635e47661ccf6cea256a42395f9c9612e80f1d068d7d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137721, "uuid": "8428cc03-2e75-49d7-ad2e-1b12f29cf506", "comment": "Malware payload", "value": "3b604218b6907f697e5e9e7dd6d2a1128fb3cc8a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137721, "uuid": "84b9e776-9ece-42da-a67d-c5f7934cb11f", "comment": "Malware payload", "value": "4c67c4d1624a5270eab36bb42ff99aeba754635352cec7068db5dc316f801d89d0f53cd46dcd910e72b0aa28c83728ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137721, "uuid": "cde62250-dbfe-45fd-b247-b950ea41fcad", "value": "T191F58E20B741C23AD4BF02B1AA7D9B6A947DB9641724C4D7E3D42F0E59B09D36B3270B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137721, "uuid": "786f2cb5-ca72-4f93-87ad-578cc045328d", "value": "c2acc285b0ca178c3cb077eafa45ae58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137721, "uuid": "28a49012-1e58-4e04-85c9-7ebe154e022a", "value": "49152:Xy9jC5327LeAyDW06K6mBzsITo59wpGlU+2StoJrtf5ink3:XyjO32fyDW0Gm5sIToTwYTgh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137721, "uuid": "4c3fd260-5f57-4398-ad17-904fe1c9d559", "value": 3326312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137721, "uuid": "ffa5077d-fa37-4e70-89fe-14797417444a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137721, "uuid": "8a801f0c-d4cf-4d6d-b2c1-2985364644de", "value": "SecuriteInfo.com.Program.Unwanted.4695.22711.1092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a69075-e11a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682174003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174003, "uuid": "46952ad9-45c0-41e0-a28e-39db3868655f", "comment": "Malware payload", "value": "483da837d70e72105520ea82033c49ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174003, "uuid": "0ac824d4-b249-484f-94d7-f1946d1d1a99", "comment": "Malware payload", "value": "d9f553bfe5254e734f2c687a69d9a61f082b87c74fc03af1a51dff715a6d7e9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174003, "uuid": "d0967254-dcad-4120-be55-a75447b65dbc", "comment": "Malware payload", "value": "4339212b959c1ead23bb5cc31dcf12736ee3e1d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174003, "uuid": "9d45b5e4-7284-446d-9164-3cf0d359c800", "comment": "Malware payload", "value": "8db32179435d45092fbaf224accacc80fbf1eb742f407372f3388630d09f054bf23db5322c5f7e0550856a7dd0f0d8db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174003, "uuid": "e6819174-b91f-48dc-a1a0-4acb03cb8607", "value": "T127D51965E37B9551FA2D07F0A0621B82FE3DED46B351D738BDC8B0BD80B620447936A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174003, "uuid": "33bffe50-6133-4f9d-b6ef-37c9069db6d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174003, "uuid": "52693dae-253e-4358-8ea9-88d8a4a4d7a2", "value": "49152:B3+xTCM1oVeG0kGj/esU462SJJm0tjRU+hT9Lgr84zMG8qK7kyjF3U4RRGef++fd:BLGefGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682174003, "uuid": "ee72e5f6-c54b-4a3c-81d5-c81409a3ece9", "value": 2987520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682174003, "uuid": "608b8df0-fedd-410e-ad1c-548f2e765223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174003, "uuid": "2d2726d6-22ad-4b7f-8b4b-fb16909fa239", "value": "PCPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdf598f-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135446, "uuid": "6d333caf-4a04-4240-b744-9c6f9f09dd0f", "comment": "Malware payload", "value": "93d4eb996675019ed856d0b8c5c46515", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135446, "uuid": "ccf1284c-42ea-482f-9b8f-82bbc1ad7a45", "comment": "Malware payload", "value": "daa41f52309815eff99483c87788bfb56b8576f15eaad42cd5b06bb3cf0cccde", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135446, "uuid": "9b3e9179-e293-4b7a-a426-24188f7a17ea", "comment": "Malware payload", "value": "a9f67e260a098a55252f0eba7b9333c1cf5b8374", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135446, "uuid": "d619fdf2-85b7-413a-8a9b-53ac0472bb63", "comment": "Malware payload", "value": "13877915ae9ef3b2e06372e91649bdee1f037e72fc74bf59c384361ec869a2bca96c68fb6eacccf2d33ccbf764e7d51c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135446, "uuid": "b4261c35-db32-4c40-8006-1a0bc4aa82a9", "value": "T1A295AE01F1D280F6C2D5243005AAAB36DB7A9E554F15CFD3A3E4EE6D2E32191D63723A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135446, "uuid": "792f8179-6e8d-4910-b49c-360a1761404c", "value": "1e1918699dc3915ea36f3d3f5aab09b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135446, "uuid": "562ba9fe-e8fa-420b-a9d4-c24191582e6d", "value": "24576:tnxLSUXY7WSIGgjlvYaxKMiZA+yH6uw1ECvGX6H7O3YpPNaG:txOUpSIZZv1xim+y6HLOO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135446, "uuid": "deb301c9-6545-4fb7-85e0-1decb2f7f166", "value": 1957888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135446, "uuid": "689dcbe5-b7f1-479d-9148-1cf63bc4df48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135446, "uuid": "3e4097b8-5767-4584-8615-7a0479880cdc", "value": "2023-04-21_93d4eb996675019ed856d0b8c5c46515_termite", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670fb9ef-e0a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1682125370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125370, "uuid": "564573e2-62e5-47dc-ae4f-d947a41f6965", "comment": "Malware payload (Rhadamanthys)", "value": "c0a10e2cd6a4044b40d6e0f9f6d7f826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125370, "uuid": "dfe520af-6673-48c2-9dea-4aa0539ee701", "comment": "Malware payload (Rhadamanthys)", "value": "db3a36dbfab5203c12279abfd53196d9f0495a9303a956fbd9795e45d99bd7e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125370, "uuid": "92703e58-3365-44b7-b5af-09e87a3d6478", "comment": "Malware payload (Rhadamanthys)", "value": "485fd7fc1896ce84005aaf4da1e5b6a4308e6e2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682125370, "uuid": "3b4746e2-7992-47db-ad42-77272a1ca1b4", "comment": "Malware payload (Rhadamanthys)", "value": "c9acd17573054a96849e27f5be26315fffc9b4c4bb98bb6969a00c6e7dd6d70e08d53bb5f4a2e568d265363d116f5c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125370, "uuid": "154740d1-276f-445d-a2ef-9c3019e7ab07", "value": "T1E564E1517AE1C836E8A645B59860C7E4697FBCE2C25C919F374C2F6F2D317C08AB2352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125370, "uuid": "4c903751-b1a1-4ea6-b6d6-58b5e60cd8b1", "value": "c2613217b278bbf906136c8e0c29af3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125370, "uuid": "fa54a0ad-d391-4a87-9289-8b328b302db6", "value": "6144:hRV887DKLNa+EK/yHwZMSt5Lqfg5/kje+pMGYp:vV82DKg+H/2MMMqMkPpYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682125370, "uuid": "a889c172-0565-49c6-8bed-9a8ff8a98f20", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682125370, "uuid": "a5843d7b-78e5-45af-b464-77a8d5931c10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682125370, "uuid": "6c397988-33dd-4069-9e6a-4dafde18bbd7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888647c5-e0ab-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682126285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126285, "uuid": "4eff12b9-4464-4213-92b4-7b036c1a7da1", "comment": "Malware payload", "value": "b6aeee41b0198e03a004fb0d77d9019d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126285, "uuid": "42dc2320-b1fe-410b-8f3c-b778f16c4690", "comment": "Malware payload", "value": "dba189ded0db555ce536385f81ad1490d1123534ec89b72acf4f8be65c001eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126285, "uuid": "2560f7d2-95a7-4eee-85c8-133fd40f11f9", "comment": "Malware payload", "value": "6e0a24b8c8b909a7729d90c62af505ccc310f970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682126285, "uuid": "b9de3946-26fe-4246-8774-59d2f6d12ba9", "comment": "Malware payload", "value": "960b42e469824a1e3b856ff6e42b00ac819a733bddc9035ae340473e23362516aac9062d262c8903cd5fb8f5fddf3e47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126285, "uuid": "a721247d-eb21-4a30-87aa-02f8f6d9b5ba", "value": "T1032512DE67B4D6B3C1690BBD406A25852B7440E73A73C238EF8B948DFB87B182D44647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126285, "uuid": "21d119fe-2df0-4dab-bcd8-f736c899b6f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126285, "uuid": "c5402870-c7c4-4fbb-81f3-bce6493d334a", "value": "24576:PyqTC/fI4T3MirauGdpcoL2XoLKmlNMbn/KSDTKR7f:PXMvraSoLNLblNMDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682126285, "uuid": "ea0bf703-4baf-4a0b-85e5-8060a90de692", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682126285, "uuid": "dcbe2478-64ee-4348-af16-b90e2063202b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682126285, "uuid": "e3a884c7-8d0b-4eec-9bfb-859d57168aa7", "value": "RFQ# 437179.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca301e0d-e0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682154742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154742, "uuid": "c777f136-9d40-41b7-af7e-ab70de8ec0bc", "comment": "Malware payload (RedLineStealer)", "value": "cdb142b1064d87a9ac318b76d0fd9318", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154742, "uuid": "02410bd0-aca7-4996-a990-82da994349d5", "comment": "Malware payload (RedLineStealer)", "value": "dc3170bd18d6df2b7654d08126324476d29f753f123f87a78d117bdbdbafaf68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154742, "uuid": "42150fed-775b-476a-a90b-c5cd10012587", "comment": "Malware payload (RedLineStealer)", "value": "3fe6945d4ff8618a828f5076f1d6808037d2135d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682154742, "uuid": "f324d09b-6216-44f2-9cbe-d2ab9c086d13", "comment": "Malware payload (RedLineStealer)", "value": "401fa1909bf4a7c034d3df7974eb2d75b649af3c7793fa5e19f504017964f463f0e05d6374650577b7be7f7e5597218c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154742, "uuid": "94981b57-aa07-4718-9250-45fdf16ebcfc", "value": "T157C41202B7E88132ECF917B05DFA12C30B76BC929B74539316A6D9895CB21C5D17237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154742, "uuid": "74edf041-57bd-4806-afaa-39c15ed67302", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154742, "uuid": "3c244686-4f31-4fab-a110-34eabcc6dde7", "value": "12288:0y90d9s9gezcO8i92hx9xaxE9JaO7kH6/eV8pEB2QB32mXd:0yUFezjf9NEPxVEB2QvXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682154742, "uuid": "236c2562-eb9c-429c-b4d1-5a42a90637d5", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682154742, "uuid": "c632bed4-497f-4b6f-a83c-63f440853dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682154742, "uuid": "c3a540e7-693b-49c7-82a9-3aaa3bf0fd5e", "value": "cdb142b1064d87a9ac318b76d0fd9318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cd6fe9-e0e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (MoneyMessage)", "timestamp": 1682152662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152662, "uuid": "6d2f8e08-7090-47e7-866b-c2438a3cbca3", "comment": "Malware payload (MoneyMessage)", "value": "400fa5d02c1ac704cd290d959b725e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152662, "uuid": "23ce95c4-2617-4a68-a319-fd1dd326fcdc", "comment": "Malware payload (MoneyMessage)", "value": "dc563953f845fb88c6375b3e9311ebed49ce4bcd613f7044989304c8de384dac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152662, "uuid": "92d98fea-885b-4f97-b71d-105a70a30b95", "comment": "Malware payload (MoneyMessage)", "value": "456e5cb1739cb5f29020d1a692289a5af07ce90d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682152662, "uuid": "0d6d3fa5-4209-4fca-9c33-3b5045c0cfc7", "comment": "Malware payload (MoneyMessage)", "value": "dd6d719b04ccef56bfbb1420a58cd73338fc6dc9d2656b47b2a21d650c881fd3f413fd1dea8a8c80bb41058b4ccbf93b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MoneyMessage", "colour": "#5599E0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152662, "uuid": "f6339e5f-29d0-4655-a9c1-f6abebcac542", "value": "T164F49E313585C037D5A201B24938EFB5A6ACF9300F7519DB73D41B3E9A289C26F36A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152662, "uuid": "147bbbb5-2c2a-4364-8f1f-27fb1896c605", "value": "1fce1172b1846e03a9af5ff84d37390e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152662, "uuid": "0a064b1b-5517-479c-b766-254815e04514", "value": "12288:aH3fcbXX/qkpwGarA0iKKjk/1RobRWGDmEd7nLTzGnabKJiM:aH3fcbXX9pwGarA0iKj/1RCWGDmIHQpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682152662, "uuid": "e5ab6a9e-16a9-4350-b04d-d5c5aa021cd7", "value": 784808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682152662, "uuid": "a7d5b0ac-31b2-4c44-aad2-b951c8f080fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682152662, "uuid": "7fc9c1b8-7a20-4347-9974-7e94e0a0ad25", "value": "dc563953f845fb88c6375b3e9311ebed49ce4bcd613f7044989304c8de384dac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f03435-e0a4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682123219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682123219, "uuid": "248a732c-58a3-4399-a35a-48b885600b0b", "comment": "Malware payload", "value": "bc7155d6025688a593035333417ce62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682123219, "uuid": "3c9c2425-2cb4-4020-b016-9c94c753cefb", "comment": "Malware payload", "value": "de44f12d5b907cf5de360929b9d359aa75a4763ee4168336854f95051ae3bbc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682123219, "uuid": "fd1f8593-3e46-47fd-a84d-4c35b33114c7", "comment": "Malware payload", "value": "ec077a7e519aa603a5a8cb8a136cc7f5853c8136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682123219, "uuid": "ecc19bae-1eb2-4c16-bfec-5884008b423e", "comment": "Malware payload", "value": "33ec520c968eea47975532ff2eff9b119935bd74b3d0833454ceabeacb1e7097e8a529b376f0db1b283df7dfeaa05010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682123219, "uuid": "80d2f816-387b-4a3b-9c4f-dd8a48da5d02", "value": "T1C3F2A80A1C7E99F8D85DC4B6CE9DA3CD213A6C467C90EAB3EB61786EC570310DD6050D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682123219, "uuid": "a1c4d090-9e7c-4eb4-80e3-b0aa8c02aeda", "value": "96:Y6E4Dg6n5fWi0+WWDNhWCutxkAWyxePgMZVJjS20jSB9/ZSPIT:RvDsTiNhWPtxkSEPgwZhgIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682123219, "uuid": "aab658ad-5ffe-4b51-ba7d-7f6fda87596d", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682123219, "uuid": "e508c4c6-76ce-45a5-ab2c-f2cca2a38ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682123219, "uuid": "bce8b9f8-8c0a-4a7e-ad58-681269723031", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1333029.12009.12205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c102f00-e0f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682157617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157617, "uuid": "809e4575-c867-4521-9eaa-30d55bc40efe", "comment": "Malware payload (RedLineStealer)", "value": "0d89ded5f35ade08477ae9cdc277144e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157617, "uuid": "f4bc06fc-abff-4cb1-9159-3e6a07b3a1cc", "comment": "Malware payload (RedLineStealer)", "value": "de5f8b1c713fb981ec5fc6a279c1b600c9238f5674ccd6f0de9ac9b481cf3870", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157617, "uuid": "e35c3637-3362-4e94-9ae4-12cbfc86504b", "comment": "Malware payload (RedLineStealer)", "value": "0be0bb748d8581e843acb8b12d282fb1053f6a0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157617, "uuid": "5ae4fd6d-8726-45f2-a688-29435aa60f26", "comment": "Malware payload (RedLineStealer)", "value": "10ca7e74b780eb3fbde10fd066e06c8b21ce35ec10f6334352d8330460a4d3012a1e1a2da7ba5e7425659a0eefb937ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157617, "uuid": "deeee73f-b565-43ab-81be-268bad8af12b", "value": "T1D4F41257A7D84173CDB523B008F903830A35FD950B7993DB326AA9992CB36C4E53637A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157617, "uuid": "e3b2dcea-9e94-4631-a6e1-8e653bac366d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157617, "uuid": "1bd06db2-cf75-46a7-a534-40c578df4752", "value": "12288:vy90BJZE/iI62cWdMCkhkmUkzU792Fj6rOsG6I/cD8KaIjUo1r3:vyMToz69nhkjkzU792Fjvdb27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682157617, "uuid": "0b472ab1-cee9-4011-ada1-318735851776", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682157617, "uuid": "0d5e5d5e-e1ab-4929-8ddb-3b4211cb751e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157617, "uuid": "c7d5b5d5-5fc0-439e-8766-c17d310875f8", "value": "0d89ded5f35ade08477ae9cdc277144e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b2b2e8-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137529, "uuid": "ee729f92-e186-475b-ba4b-3b791bf28c58", "comment": "Malware payload (Mirai)", "value": "f39952ee61212434ead4472cbf84e5bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137529, "uuid": "cb9f2f4c-7f26-4bc6-88b3-aa1b745a40c0", "comment": "Malware payload (Mirai)", "value": "de86d0c5fd06d6c88cd5a9ed7635e95b44363e462840337b80b35193d79545da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137529, "uuid": "cc8fd2ca-575d-4051-b491-8196e0e1f39e", "comment": "Malware payload (Mirai)", "value": "8b34e5a3f0de75ed9422ad26e114d584640ed4a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137529, "uuid": "90729438-99d4-4ffe-9859-fc82ce5ca3ba", "comment": "Malware payload (Mirai)", "value": "9ba23ee22f46d0bdef2b41832d30284b8bf88dbdfecb6000fed03ebb2f73f98527957771f3860209234abbf756978db2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137529, "uuid": "f3821b8a-a885-4360-9f37-218328a4488f", "value": "T17563A64D3E319FACFBA8463457F39E20A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137529, "uuid": "b348b8c7-66fb-4053-abb1-c9c86f2d3cd4", "value": "768:RzZWyvL5MsRXxPx2pqV2Ujz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UdGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137529, "uuid": "607fb22d-535d-40c1-951e-7860e6231c64", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137529, "uuid": "5fbfe841-d167-4da1-867f-e04ef97c64e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137529, "uuid": "4de0ea5f-1b79-4467-978c-63b7c1a4f869", "value": "f39952ee61212434ead4472cbf84e5bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70936798-e116-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682172201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172201, "uuid": "ecca2bb3-2c5a-49a1-81f8-9c2b031eaeb6", "comment": "Malware payload", "value": "f933599c574cd61ff8a1bb4658106f49", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172201, "uuid": "bb152a0f-2975-4811-8596-2d804ecf990e", "comment": "Malware payload", "value": "deaf16e125ace991c0897520573e614fa43ccd4fa27a6682e44410a913b988a9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172201, "uuid": "c9828629-f008-4ae5-9372-9cdffb362c63", "comment": "Malware payload", "value": "97ce010fa3077c68a79c3bc9421e4315a90874aa", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172201, "uuid": "b2565578-3a55-4fb3-bfb4-60daa0207e19", "comment": "Malware payload", "value": "9680d2b55b7903cd590bb41670fe1311e5d66a48ca30fbe12d193d1ca68178b080b680634456426fbb3dadcf18f08add", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172201, "uuid": "f6af5bf3-aa16-4483-b4e9-5134d76e524a", "value": "T1C855F1017AC79733D1BA0230257FA7B06B7DAC305EA5861BA3D47A1D3D71290A365FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172201, "uuid": "2ea7acc4-077c-468a-8dfc-f8e7528df090", "value": "24576:VEtOxtwYXzB7wrZLiqqHUitwwEyDCejj6Y:VEtEt/zBcrJiNHUrwP+iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682172201, "uuid": "237fa3ae-aa15-4ddc-a882-e6b306d635de", "value": 1319936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682172201, "uuid": "a5b389db-651b-4446-a49f-0ab1dee661da", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172201, "uuid": "5c41ab45-1b0f-4700-9761-13f5c6933556", "value": "GPT4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc3fef3-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137726, "uuid": "d3aa9492-7c05-4113-926a-31c544219823", "comment": "Malware payload", "value": "c1831ab0f4ac5627e9dba7c172201157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137726, "uuid": "8ec63fdd-d056-4a20-9eae-4cd91f8a082a", "comment": "Malware payload", "value": "dfa41272925dcc86d799d678433ed956dc2ec70dd0426f613da273cd22265940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137726, "uuid": "f2ee4d22-7b13-4d96-bded-209b198e25e8", "comment": "Malware payload", "value": "d06bd8ece58de2fb12eca645af201fc8e0be8e1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137726, "uuid": "5cdc158c-de8a-437d-b77d-1ef5796dcefb", "comment": "Malware payload", "value": "78b62ad00eda25be191c1271eb13a6c917a173d76ccd2efd45bf97fe1e39d1fce0ccb1076ad1cec471f0b2a35c0a2cdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137726, "uuid": "0ae56e6e-4485-421a-beef-a29d0b0a13b0", "value": "T192C35A037AD19071D4A30530C8B4DA114B7FFDA38A71998737983E6F3A732C25A75E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137726, "uuid": "7d1213b6-73f5-4b3c-b308-e6e6d666f057", "value": "a4e6ab6b6f4be5756273f27819a31166", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137726, "uuid": "b0c589d9-3a4a-4522-9d88-d1d3c7df90e2", "value": "3072:1WcR/vYdDBS6x+XyU4LHY1zioATi1oi1k:1WcR/v2vjHJoATTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137726, "uuid": "1e0e16f7-63b1-4aa3-9a2a-e87fecb3e933", "value": 129312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137726, "uuid": "603f3fbf-50e0-4a36-ae5f-2140ec7b864f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137726, "uuid": "2727e3f8-5c85-4af4-a1b0-73599adbb108", "value": "SecuriteInfo.com.Program.Unwanted.4695.30392.23303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace10019-e0c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682137513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137513, "uuid": "c8a3c1a3-981c-4204-8fb3-18c0e2068b81", "comment": "Malware payload (Mirai)", "value": "9010ef3304419a76735db8db8c6279f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137513, "uuid": "e68c88e8-e17b-4ed4-b062-e513bd86ab98", "comment": "Malware payload (Mirai)", "value": "dfd03c3cee583fe61468ddd080795e3a83afc1dfe9269e41980d32166ed3d432", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137513, "uuid": "db1e6e63-8035-496b-add2-650733a99ded", "comment": "Malware payload (Mirai)", "value": "f81e8f2591744aea5069baf870a0fad931132a6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137513, "uuid": "deb618dd-ca88-4e68-871e-5fa3ddd4413e", "comment": "Malware payload (Mirai)", "value": "328f82784e9e4fba61604e016d136d9eb060958e7c361cfb87621d8250ab9eac8571bc51096a25fdd813b8587afab84f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137513, "uuid": "42b3e8ab-334d-4595-b0f7-803ec886ea60", "value": "T1F793A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137513, "uuid": "0257434a-b431-45de-8d2f-f88e5fa054b7", "value": "1536:a5DnSB+v5PjQm2z17xk49d6xZLu8vJ4TGo8S:a5TSB+v5PjQmG1GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137513, "uuid": "bb706f38-6961-4da7-9b5a-7cce089a5b17", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137513, "uuid": "96e09906-f994-46f1-bab5-02699374778d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137513, "uuid": "6bc3228f-080b-4890-906b-6798bde0c2fe", "value": "9010ef3304419a76735db8db8c6279f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6184e56-e0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682135434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135434, "uuid": "0943cc21-c604-43bf-8745-02df4997563a", "comment": "Malware payload", "value": "2c6a15af2ce1f20002440f627d67486b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135434, "uuid": "b8c6f537-6ab6-4da2-b59f-06273e34bf2c", "comment": "Malware payload", "value": "e12dc3e4d18873fc538e14f81dc775a03c13f66b9ea2ad6825978a7479ee841e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135434, "uuid": "1a43f0af-bc56-4fea-869e-eccc3960a499", "comment": "Malware payload", "value": "b9dedee1b6ec473dfdb71966fba9a08a5543655e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682135434, "uuid": "b6ce4d62-94d1-4efa-8e97-929598bd6665", "comment": "Malware payload", "value": "b34ed5e00a2e6813963b3b97aafc25eb2b60be5d40158c0a989e6571036374ac00765de168f3906a88ef5012336e6d9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135434, "uuid": "d3a15eab-4156-40e8-9213-3103e1bdeed6", "value": "T1DC043C11D050C7BAE1A244F9C7E90DBDB8364D50630509CBB2C23F79AB52DE5AB31BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135434, "uuid": "bf579515-9fea-446a-8615-461b0a82a464", "value": "3072:6ZvVk27jPiQ4RIb7DrcnftWG2mfRGIR8oL2AA5NWCdxN2UnPF1ELW5550:6gqiVuDrcnV9LfRunAA5NWCdxN2UPF1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682135434, "uuid": "8e503f30-7a5b-41f1-ae57-9753e7e4bd39", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682135434, "uuid": "99f4113c-d0b6-4ef6-9773-3c9192e10e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682135434, "uuid": "012a531b-7fd9-4ef1-82fb-178b07d06399", "value": "2023-04-20_2c6a15af2ce1f20002440f627d67486b_cryptowall", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12390daf-e107-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1682165600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682165600, "uuid": "973be4f2-f04c-4de7-b5e1-7dfb2a05c9a6", "comment": "Malware payload (Formbook)", "value": "18d9a8ecfbeb3fdebf8a83d814d37e78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682165600, "uuid": "540c3b28-891f-4de2-a073-b9875fcc2a9f", "comment": "Malware payload (Formbook)", "value": "e309e6a7f77ce5e80079ff47a2a1cafb82395f96dadf925d2c0d5cc333b3381d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682165600, "uuid": "44a53dd7-a7de-418e-b93d-420e38dfe226", "comment": "Malware payload (Formbook)", "value": "6feee15843344000be48398c7127b5756b8b9055", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682165600, "uuid": "2fbb4c91-f06e-493a-a492-30ec9656663b", "comment": "Malware payload (Formbook)", "value": "56308a7fc6bf64f1dac696ab78e205e7dd42bb395ce704b527e84e48dc84f9eeb4279df1cca940c6bce6a8ec0b7fdfdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682165600, "uuid": "baf57b66-a0a3-445a-a208-c0b8840b2e2d", "value": "T182F4E1274BC669ECE67DC57182B57F1C23F4CEDA2111A78B2EA031F09E437865B462D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682165600, "uuid": "a9d29776-c320-4052-a932-818c1dca1b4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682165600, "uuid": "0cfecff1-51ba-4b9b-a8d3-3c583733a720", "value": "12288:QLOQjAtWdATeYNEiHB4B3yDrhqNXZUZB/n+pJsixsN2Mvac:QLnkAce/iGB3yRqW/Ms+G2Mva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682165600, "uuid": "12e1212c-33aa-42c1-aec1-57da51a7bffb", "value": 741296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682165600, "uuid": "8f9c7339-42c5-441c-acd2-c8cd66b168bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682165600, "uuid": "854ec541-d857-4145-ba03-319216e0e207", "value": "18d9a8ecfbeb3fdebf8a83d814d37e78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5d660c-e0d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682142023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142023, "uuid": "9c8afd43-f2bb-456e-a3bc-6218775d586b", "comment": "Malware payload (Amadey)", "value": "89db23593b525667d71eb7d68aa19799", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142023, "uuid": "13edacbd-ce77-4f89-8012-eca1d37f8e7f", "comment": "Malware payload (Amadey)", "value": "e41c87f6f2fca08a6ab360e0e7c39ac2572b9694cd1c13328717b4056e1b2a22", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142023, "uuid": "c3cd27f0-37e8-492d-98f3-f01fdfa32ea9", "comment": "Malware payload (Amadey)", "value": "00c475c37a9c548d7c2bc0e53a187e17f47b91b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142023, "uuid": "a98dd6d6-cc0b-4582-a180-6e959a97fc66", "comment": "Malware payload (Amadey)", "value": "ab03df0dca401314e1947bf633660189d51ed64b36c19ef7741f63eac10b6864e33cdac2c748924a8bbe8c4b32004e7a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142023, "uuid": "36c7f311-789b-460b-bea0-080e7be66eaa", "value": "T118251213AAD96172CCE417B05CFE12831A3ABCE24FA5818F63827ADE48711D4D5357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142023, "uuid": "6cdc6a0e-691f-4327-9014-ccd5d64e08b7", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142023, "uuid": "597a23c6-d1ff-44f4-88dc-83feaaf5c722", "value": "24576:QyRng7gYLD3f9GC+gsvCAiC8gDBUMvfJPBNtaG9qCA:XKDvM9tumUsJPBNtRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142023, "uuid": "870f48b5-fce1-4f03-8a36-6f9f45ebdbb9", "value": 986624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142023, "uuid": "7cac1530-6667-4901-89aa-8564776668a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142023, "uuid": "f5885483-a989-4611-8052-0f6501c859d8", "value": "89db23593b525667d71eb7d68aa19799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8799f3-e123-11ed-88f6-42010a9c006e", "comment": "Malware payload (SunCrypt)", "timestamp": 1682177917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177917, "uuid": "40554db3-21d4-4a11-8b7f-eb95fec988c1", "comment": "Malware payload (SunCrypt)", "value": "c34c49a9b96d5a7d748a0a4d9710c724", "object_relation": "md5", "Tag": [ { "name": "Suncrypt", "colour": "#F89D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177917, "uuid": "40684cad-ceb7-4100-a582-c7c8f53a0f19", "comment": "Malware payload (SunCrypt)", "value": "e5ed21e011341affc1149056fdd02b658e0b6042971bc9f5a71e3e899f296f91", "object_relation": "sha256", "Tag": [ { "name": "Suncrypt", "colour": "#F89D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177917, "uuid": "dde6f1c0-849d-4edc-ab5b-1cb7f6d6d55a", "comment": "Malware payload (SunCrypt)", "value": "ff1f0f83fb7ad3de4a6575c8e74e829047a41e87", "object_relation": "sha1", "Tag": [ { "name": "Suncrypt", "colour": "#F89D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682177917, "uuid": "233b77d8-e3e0-402b-b8e5-dd42517babfa", "comment": "Malware payload (SunCrypt)", "value": "c4996d202fc5692a5afceacf2fb0f14d1e534ac12343a3804e15c63c84e9e4182114137f1d8086e7f88e75a9a957f028", "object_relation": "sha3-384", "Tag": [ { "name": "Suncrypt", "colour": "#F89D0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177917, "uuid": "00cfb72c-3994-4896-bec3-31d641b9ba03", "value": "T113846DC4E0A760FBDA1761B8956A31B8335C9FAD84048FB75FE1E37041385A36686E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177917, "uuid": "279bb1c3-d548-4349-9ebe-e4b59bebcf6f", "value": "7c4e153b14b278bd3a896a6b48b24f28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177917, "uuid": "ccd1dd8d-6c15-4f4c-a881-9762dd47f0ab", "value": "6144:C7jCOFm5iEHMvjuEljo4Nx5C/ryU9TIfJLzK9L97w/g/eFAhlryh6Lvtxt+YRoeA:WjCX5iUMvjHljRU9gzK9L9c/g/eFAhl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682177917, "uuid": "b4044beb-6972-4b57-9455-2919b57d90b9", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682177917, "uuid": "fb1c747b-5f8a-4138-bd89-bd35b7d936c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682177917, "uuid": "bd08fe97-47c5-42c0-9b59-20a724520706", "value": "suncr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18522b38-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137693, "uuid": "b69a5600-c4be-44aa-92db-4e52fd82da4a", "comment": "Malware payload", "value": "4c76bcade7c85cbe39b32b17b42e2f72", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137693, "uuid": "47c2fdc1-49ff-4282-b83a-a1fff30885ae", "comment": "Malware payload", "value": "e62c3ac1fcd93ed8ca7da40c59ba3a9c7293420efba2bb55a54a1c704a44ac2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137693, "uuid": "6bdbdcb7-5416-419f-ab72-5ad33d780354", "comment": "Malware payload", "value": "dfe39a7701b0720ab11e5a6c1dc83b4483c09fa6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137693, "uuid": "a8ea833c-79ee-44ef-8df7-d1bd76cfa083", "comment": "Malware payload", "value": "067906e34036b71f99c25d9a3ced7f5894ace81d9b3292a52c8a1cbc1d050c7f85aee3b62d37b58b61a2b4593ccf705a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137693, "uuid": "03f5bd65-6453-40ee-b819-b3041681223d", "value": "T158945B41A7FC8725E7FE2F31A0701A255BF1F846A67ADB9E5E40A5EB1C8774088407B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137693, "uuid": "a220503e-643f-48ab-b172-45269e98b174", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137693, "uuid": "666a4144-9648-4b8c-a8f2-389d0aaed405", "value": "6144:2HerwzLkqCG3uKWf4g6tUwoOkErUx5/Rsnaszr0tZDPEaN+YB5+GonKj4Q:2HerIacuKUtOkESbKQrvB5+oj4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137693, "uuid": "e9258c1c-060b-41f5-a0c3-d9aacc2b8c3f", "value": 437024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137693, "uuid": "980aa141-297e-4ebc-a0c2-dd2c2cf51820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137693, "uuid": "26000fad-52e9-4326-a89b-3ccf71211f35", "value": "SecuriteInfo.com.Program.Unwanted.4695.817.31226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40745ce0-e0e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682148927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148927, "uuid": "594c22af-195e-4c2b-8adf-178ec7227875", "comment": "Malware payload (Amadey)", "value": "fc28336b64bc77e25e64945a3dd1decd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148927, "uuid": "2840efe5-ea7e-4c19-a0f6-bd04a0574ad3", "comment": "Malware payload (Amadey)", "value": "e7a590a0efcce11159c9f547dc63f7ca15418d421c77af7fbb6721639663b0e3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148927, "uuid": "9c473fc7-5bca-4967-b91a-3394aab52b2f", "comment": "Malware payload (Amadey)", "value": "4c63d4bc78c2a8945b1ca57b16e2a845f1f9e47f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148927, "uuid": "b4432dd7-941b-43d2-9d3b-33bed7bf8ecf", "comment": "Malware payload (Amadey)", "value": "1a8f52e6f9271d6b06bd7678e69b68e0d08ec84ac7a392158026855317364c92f03b8cc05084d92a98e6de400d3ccad5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148927, "uuid": "73b90c8d-e92d-4c08-9a99-4a7957717437", "value": "T1F5252242A6DC917AEC7107B05CFA169B1335BDC1DB7C82A72311649F18B36D1A13AB3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148927, "uuid": "2db3010b-c408-4fbd-90cd-555d38a1c9da", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148927, "uuid": "4c69fefd-d4fe-452e-ba2d-915a4d620d8f", "value": "12288:8y90sD4HaK07+jbxqVANZai6e+VDTLEJ/RHEw/wFttPpdrjjQ8c084Ze6JjLJc4n:8yXUHaK0ybMe6NLFtprjdcTy5HwhYJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682148927, "uuid": "0cd90110-700d-4398-b442-c413fbf90378", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682148927, "uuid": "d9024523-bcd2-4020-be03-7d121522fb47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148927, "uuid": "3a8ac6ec-34fe-43be-b1da-6247db76d95e", "value": "fc28336b64bc77e25e64945a3dd1decd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d2490d-e113-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682170862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170862, "uuid": "da78e701-c2c7-4a8c-95bf-326db1728063", "comment": "Malware payload", "value": "62e27e09a20ab3e1ba33800685407b4f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170862, "uuid": "2bafd4c7-3a7b-49cc-bffc-69a7ae881f13", "comment": "Malware payload", "value": "e7abe6123d8a02c9a8e36375eece9f2be2035269e38370ae08d61af444d6c46d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170862, "uuid": "a98e4e1f-616c-47ae-9c38-511938aa140e", "comment": "Malware payload", "value": "61049a0323cd3e739c589ac911c1c5ac5d7b9ad4", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170862, "uuid": "a37f07e8-ce7e-45b7-bb3c-7bed95b0f826", "comment": "Malware payload", "value": "a4f604b46da0626f982ae5bbe1b393f2b5185c3bf1a1d2c449747545d58e87f6afe8cab47e1d0a10901caa06468fc3a4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682170862, "uuid": "af865c09-0f9e-4a58-bbd8-bce4316cd7e5", "value": "T1C3253322A41D30E7B97D503F89205BEBAD60E4E586D48F62487BE60198FAC718D3D64E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682170862, "uuid": "634b9e71-6bc6-4464-8a12-378b03533189", "value": "24576:Gmxp6St3thtCep/HC3T7gMlADieUeaM+KDR3M:VMe3zpvC3oJDibeLN3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682170862, "uuid": "44590196-cf98-4dea-bb83-ed2a10c74b95", "value": 999752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682170862, "uuid": "e4cfb665-3c6d-4d4f-a442-c2736a2a19dd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682170862, "uuid": "51815761-3bfe-489b-8652-d7ec36a0799f", "value": "Bard_AI_1.1_setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eaa24b5-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137704, "uuid": "fe44ae25-8e3e-44e4-a86a-9c1b53e73386", "comment": "Malware payload", "value": "f5f9ae1e736bab98b710c8fdb7d958d6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137704, "uuid": "c4d04e68-93c7-4e07-84f3-2168f6a5c799", "comment": "Malware payload", "value": "e81509c5efbbb4ffe4aea5f650ac70a8a37f449087f29c782e7ba57814b508c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137704, "uuid": "13ea0696-b660-4135-84a3-551cdb908284", "comment": "Malware payload", "value": "653b7d3318cdb0d6ba253a6e30f1c6e99f5ace59", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137704, "uuid": "82b57473-cb77-42b2-90a1-cbfdf6eebefd", "comment": "Malware payload", "value": "d8a510ccff0a862e3fbb45b331cf9c189b6e74782327238d7a36ed852a2f7fd3039d0a718e94646f1be7af07dc3f9953", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137704, "uuid": "01a1cd5c-e9c8-4108-aaa4-dcea05293108", "value": "T16353F8E3B774A255DD965BB855E26FE22372E20157B3CE9B803D936A1F032801E4073E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137704, "uuid": "79195028-4a5a-4cd7-8d0a-c2ab31228b2b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137704, "uuid": "964c156c-eaed-4549-88d8-375992a52dcd", "value": "1536:DL9nVJEetVDUxSp1K2z9IDd3g/i1LGHi18:DRVJEMVDqMK2z9IDdQ/i1yHi18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137704, "uuid": "48acc431-ef10-4f18-aa7b-fb4ae8a75653", "value": 60704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137704, "uuid": "2871ad47-1af5-40be-aad7-9a8b2e3994ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137704, "uuid": "bdae320b-d2c1-4d93-90d9-aa386b86b561", "value": "SecuriteInfo.com.Program.Unwanted.4695.13703.15888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c2f4d3-e0d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682142324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142324, "uuid": "f9473b36-bc89-43d0-86cc-18e311f9e111", "comment": "Malware payload (Amadey)", "value": "b639cab71ae163b17e365054a4be3f61", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142324, "uuid": "b3b0ea86-5eb3-4142-a48c-8dd2a0b7cc47", "comment": "Malware payload (Amadey)", "value": "e997c176edd591f2096f8eef48ca3d5f6939d7e859d30e03e28cc0129aef0853", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142324, "uuid": "a2270096-9420-40dd-97c5-1b6e285a1d21", "comment": "Malware payload (Amadey)", "value": "8d0b47d644a8f66142ca4a77593e3c87e168ec82", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142324, "uuid": "a8fc5590-7afd-4a5e-835c-2fdfd5ff8c72", "comment": "Malware payload (Amadey)", "value": "0f7c8ebce4666c5fe8cda4fe8e802da2887947ebca437afd1789283f1d14771c227195b2e0cb40e56822c0df080fb024", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142324, "uuid": "2163ac9f-d9d0-4674-9363-b2b3975b996e", "value": "T162051257AAC49036E9B517B41CFB13930634BCA18F7483AF63564AAD2C736C4993273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142324, "uuid": "03e72bd0-63f7-483d-8e5d-15077bca61ec", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142324, "uuid": "e7aebbc5-7773-4b56-ba44-3e31b8b081bb", "value": "24576:cy86QIo9MGi30FFr8G/DYxthCktRaYvAsPJ/gD:LxqM30Fh8G/DYpC2RpvAsh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142324, "uuid": "ef108e87-67b8-4c5d-8c77-1b12cce8fbea", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142324, "uuid": "33a0ec4b-3050-4d8c-9059-1c33883dfad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142324, "uuid": "233eacf5-68d5-4dd6-a00a-7efb913470a2", "value": "b639cab71ae163b17e365054a4be3f61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866d0661-e0f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682157635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157635, "uuid": "f376db2d-e400-4bfc-9470-5e7768791ac3", "comment": "Malware payload (Amadey)", "value": "fb14cf3dd84d331ed72129de2a093f16", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157635, "uuid": "75bf91c4-9b95-4bab-be81-ce2bde26e8cc", "comment": "Malware payload (Amadey)", "value": "ea07b2d53fa8793d39a63f4f787e3951cf3eb9fab05cc5a2b5cd3e303c241c10", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157635, "uuid": "3dda72b7-a473-43b5-9178-70932767c104", "comment": "Malware payload (Amadey)", "value": "5cddc307f102158e0a091b2fa38bc64fa4c09fd8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682157635, "uuid": "7d397bff-634e-4d7b-b06f-afa554fa5ac9", "comment": "Malware payload (Amadey)", "value": "5b917c6b1ed8e15f21ccdae25edfc84eced317a0ba8f3535568fe0313c223eb2c00f6b622da5c8c3daa1aa6a7e99bfef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157635, "uuid": "83be2ecc-22a4-4520-9932-6292e9c5fa0c", "value": "T1EA35230276D84162CFB6177004F703871B79B8629F25D7DB1358E48E7CB62E66B7232A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157635, "uuid": "4fb6c51b-a2aa-4101-bb9a-f8e2a7df9acf", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157635, "uuid": "6316c769-856b-438d-9504-9df6fd8e6f0d", "value": "24576:Hy8NLbMkSWsyEPh9NDRtC26hSW7jvFnyn:S8NLbMkjEZ9N7C26sWdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682157635, "uuid": "252640ef-01e9-4946-89e9-2a3da0a26cdc", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682157635, "uuid": "8498bffb-a9f2-47b0-a6f3-cbc5cb2622da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682157635, "uuid": "a76c804d-7e11-4a19-9fbf-9a3320e19c0f", "value": "fb14cf3dd84d331ed72129de2a093f16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd70d418-e101-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682163337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163337, "uuid": "2db38967-f594-4c44-9221-df7f3a1148a3", "comment": "Malware payload (RedLineStealer)", "value": "03bbcc6e7a940c59f87542296f821ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163337, "uuid": "c43379a7-5543-4395-8be1-dea497ca0de1", "comment": "Malware payload (RedLineStealer)", "value": "eaa13a9779b5e891db6c37835f1fd346c2296b501a27cb89a1a3816f8da5b50c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163337, "uuid": "cec32d64-a682-476c-9c47-8927e80f66f6", "comment": "Malware payload (RedLineStealer)", "value": "f9d17c13503cbe421999de1dd7761bb9b7784aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682163337, "uuid": "85d66cae-d50c-4aeb-bb76-652b401d5944", "comment": "Malware payload (RedLineStealer)", "value": "cc4a7b6b67466ccf89eda85b24b069209a7ecabad74d0f28f6d4c5b6bb663c73bc547fd764d6a3a19664c880f03755c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163337, "uuid": "f9ad991d-b777-431a-b198-cd64ecfb23f3", "value": "T17BF4231697D95133E5F56BB018F912431F3BFCA24EB497AB2B81698B5C721D0A23132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163337, "uuid": "b2b16fe6-0073-4415-b04d-0164b473bf29", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163337, "uuid": "7ed3c9e3-ad85-45e2-9bc3-9dfd6f2a8edd", "value": "12288:ry90zkg+W//pxMW7NZU0LK5teztZzny5mw4s3hiQEkxqVbRv2bxrHxE:ryjsn/NZU0L+k37y5LhiQEkxqzubxjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682163337, "uuid": "1069e0df-1f6a-4533-9e6f-e91903f4b859", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682163337, "uuid": "37fa5464-c685-4a57-af2d-5d26b37bb407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682163337, "uuid": "58f5b407-5f78-42b4-9158-8b3ae1499542", "value": "03bbcc6e7a940c59f87542296f821ebb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a082aa7-e0f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682159734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682159734, "uuid": "b0918622-fcef-44cd-b210-611d1f7a8a43", "comment": "Malware payload (RedLineStealer)", "value": "908b328e02d89fb70c992a9c1a5c5493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682159734, "uuid": "a63bc160-6d32-4c83-a09d-acc0b7812d0e", "comment": "Malware payload (RedLineStealer)", "value": "eb435aef42e5fa4da77835512b451075696d6c0d09d2500cdd26b541a0ed60c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682159734, "uuid": "090e3674-e2fa-4fb3-a860-9b9b4d126f90", "comment": "Malware payload (RedLineStealer)", "value": "4f69e9edc6e55bef9eeef26527672997e352a74a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682159734, "uuid": "760df408-ec7b-4e9f-86ab-47b72a5665b9", "comment": "Malware payload (RedLineStealer)", "value": "1546d997ef77be72ba7959c60ce0762befa20ea42b2b92b54a3e27cdf98cc7e99dc5c6fe5f915f4dedc8a555b44ca78c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682159734, "uuid": "8114c446-8c00-4aa3-a54f-71b8b014d778", "value": "T194C40253A6E86033EDB527F068F722870B36BCA25E7586DB234A56CE18736C0D435727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682159734, "uuid": "f23d3619-7d50-4e3b-8317-88b5896f2046", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682159734, "uuid": "39f039cb-7681-4022-8725-741d40a76917", "value": "12288:Ey90wUPem5Bel+Da1Y/myrYiYtOlwH3heIZ0QjZCTPi:EypUGyBO1Y/7YtOOh/0MsTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682159734, "uuid": "9d486965-dcf8-44bc-ac1b-22590f31256f", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682159734, "uuid": "d9aa2100-2b14-4a13-b456-51eede94e715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682159734, "uuid": "8cf8c8a6-d685-4717-873d-f1a40a860faf", "value": "eb435aef42e5fa4da77835512b451075696d6c0d09d25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24418a10-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137713, "uuid": "14f4f34b-e667-40c8-9e9d-c5f84f28fea7", "comment": "Malware payload", "value": "8d39dcc69bd96ae8d907b66e61568102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137713, "uuid": "05547612-6fc3-400c-bdf9-1ae838df6ce2", "comment": "Malware payload", "value": "f0ef26cd855f20cc17d057b81590375d957f76efd4fd09eb85ed4e5f8078a445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137713, "uuid": "66f2e6d7-8b81-4804-855c-39190547979b", "comment": "Malware payload", "value": "af895512f206db9e0f5508225d0ae5c57ea7930b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137713, "uuid": "d7a30559-1112-486c-8380-c791e3c1c09d", "comment": "Malware payload", "value": "4f333cac116b0faa0abc935b3839ee12729761edc3b4f1e66fb775ee22b5cb84d5301f3eea61065969a3cfd51e7c1dfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137713, "uuid": "646b7dcf-9a74-410f-9e74-59930c228c56", "value": "T1F176AF00B6F46119D69DA3346979C2245B38BC06FE5BD60B31DF792C2FE23869C057BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137713, "uuid": "6feebdd0-02f0-4684-8af4-d0e4619474c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137713, "uuid": "69cf2259-fb01-4f4b-b051-b65541440ed9", "value": "24576:d0CvKISRiSTO1E2fb8c6PlTQ/ss2hcPaMn1P3oAq7fzZBrQc4JRFrvDhH5va225:d0EKPkE2T4dHaaMODBrlsbid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137713, "uuid": "c3f6ada2-d152-4569-854d-9e5c0c9a3150", "value": 7413536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137713, "uuid": "7b310a93-18ed-4bd1-98ef-3e03c0029a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137713, "uuid": "24975c7d-34fc-4d48-a2b8-003b9974ced8", "value": "SecuriteInfo.com.Program.Unwanted.4695.3864.24759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc44b55f-e0d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682143229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143229, "uuid": "fe13dc85-9960-41b6-b3cd-bfc7605d8359", "comment": "Malware payload (Amadey)", "value": "0746b6bcb69df2a0e33b5fe2ff3ed357", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143229, "uuid": "c1ceb980-2915-4510-bf4f-d3753299af98", "comment": "Malware payload (Amadey)", "value": "f2c17bff01161ce8f74652fd168b07f3ac5acc857d6a4c2cc8f5006b93aa0aa2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143229, "uuid": "4eb246bb-a971-4883-84be-0b79f96bd82c", "comment": "Malware payload (Amadey)", "value": "f4fc8525eaa81e808aea48e1e246ed190dcc851c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682143229, "uuid": "36344a59-c484-41f2-a627-19971bb8ee89", "comment": "Malware payload (Amadey)", "value": "791ed95033c96e6f2e9bd662f4328d7d33cfeca4d65c27933048f9fd3749243cf07ff6aed8892ccf9b65fc189a6c8155", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143229, "uuid": "72dd3427-3b15-4543-89ee-7688fbd00783", "value": "T10C252216E7E99176DDFC27B049FA02831A35FCB25B6486CF12898A9E1C731C095317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143229, "uuid": "797b556f-d14c-465d-9bd2-2e1563a57872", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143229, "uuid": "02ee87f8-47ef-4722-9405-a67003c43dec", "value": "24576:lyHVuVs/CdgrsjtxfcNtYi/mQOXIhi0zA:AHV93rsjtxfA/hOXIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682143229, "uuid": "8e4ac314-5c6d-4e05-a850-70f7a4ae3b33", "value": 1042944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682143229, "uuid": "9b3932e1-b2f2-4c40-a9cc-c92801cf5b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682143229, "uuid": "96ff5dc1-6c2c-40dc-aa5e-2e4ff1d5dc8c", "value": "f2c17bff01161ce8f74652fd168b07f3ac5acc857d6a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd231b84-e115-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682172007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172007, "uuid": "1c60cbef-07c1-4731-b066-308f7a3fedc6", "comment": "Malware payload", "value": "6381ee11daa54565530e7c304123847d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172007, "uuid": "d5b0d94b-a9b4-46f1-8973-34fd6453858a", "comment": "Malware payload", "value": "f5cb2f2a0183673fd4b969132ea6dd7cbcdc0afb64971e236cfd408768ec8146", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172007, "uuid": "7b01a7c6-8a4b-4cf9-b08c-3e5a37f521ca", "comment": "Malware payload", "value": "c93673ef1ccc63c42ec3ac84ccde8746da89831a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682172007, "uuid": "c004d596-fde9-4e11-adea-a2d590f43ee6", "comment": "Malware payload", "value": "fabfdc5ae28b9542b5432d3318d8a2596a5e13505701c321e86a63e521455e378a7a9149fcccda02df8b4639bf6a99c8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172007, "uuid": "9a35becc-8b3a-4b7b-a592-a836a2137359", "value": "T1CD2533D9AE86BDC9191055D4A323A602BFB933B8F2E498F121150C06E6F6FD73473E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172007, "uuid": "25c1f47c-0659-4692-b76b-564c940421db", "value": "24576:wN986BJcBkI3WxtV//dedrzmOdQ5e429iui42vsl7O6n:e1Jct3Wx78FzFdQ3mi42vsVOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682172007, "uuid": "647c9820-6a0e-4675-baf9-8a186626d0bf", "value": 963554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682172007, "uuid": "a6f23182-4229-4e71-9537-a41d03c34310", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682172007, "uuid": "ddf1f957-3a04-455d-837d-788d993c48a1", "value": "GPT4_1.1_setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae8779d-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137670, "uuid": "c9bce722-e88a-4b16-b711-4d4849400194", "comment": "Malware payload", "value": "90e21a537bb217ab0017da17bd538f33", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137670, "uuid": "fb58ea2f-dd8c-44ae-80e3-587672800a54", "comment": "Malware payload", "value": "f7a0bdfdc42ed55b1b65107775f8298bacba7f7655b307943eec39058cfed8bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137670, "uuid": "a6048200-98d4-4d3b-9d43-62fa24d57916", "comment": "Malware payload", "value": "440fadb3788d4aea5910a3532ed886d058456ecf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137670, "uuid": "7e09e628-7455-4012-b7d3-0bb6ce0681d3", "comment": "Malware payload", "value": "ad1a4434cad0e2cba25ba10283bcff02b33a6ef3cebf6aaf0ca3ff844f5f73e981e29a703bb68ecec925f70ef60c8f13", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137670, "uuid": "eb50bbd9-9345-4c45-990b-e5ebc035168c", "value": "T155822CDA1BA93133FF436E7597C9D25E9E76F2E0EAA6C45F10AA82411FC0390376502D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137670, "uuid": "a33115ed-41f4-41e3-bef5-853d713c6400", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137670, "uuid": "8ec7c7a7-6104-4aa3-accc-a98dd614f187", "value": "192:qCipngp9cqH9YIP7WVRfbMxogllnXnYe+PjPaiSsFc4wai0yFniSsFc4wWy7bjub:TipngXcqSIPwIr3nYPLaiSKT1qiSKWib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137670, "uuid": "8d89d1c6-2c34-4946-a2f6-933ad5386610", "value": 19232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137670, "uuid": "48fb0300-231e-4f58-a780-4b1d91e3f094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137670, "uuid": "b442ec0a-8f6d-4aec-9799-ca344dfd3a6d", "value": "SecuriteInfo.com.Program.Unwanted.4695.23759.21382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdc956c-e142-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682190936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682190936, "uuid": "dbd3aa72-dd6c-4d01-bbf7-9981b20b515c", "comment": "Malware payload (RedLineStealer)", "value": "c700e7fd770e19fbaa14635e75a5bcb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682190936, "uuid": "7ae6f6df-3568-4a29-b327-7fafcd29718f", "comment": "Malware payload (RedLineStealer)", "value": "f8eb9a992f5d564cf4e7b5aeb59453e4a0da493040c124f2cca5ccee425d341c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682190936, "uuid": "aee32f59-8607-4b36-9ea6-354bbc0f2e96", "comment": "Malware payload (RedLineStealer)", "value": "0643a49b2b234428ebac0dcae47e9fcb507b0e36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682190936, "uuid": "18e4515c-9c27-4999-b05c-5f09cfbc1e26", "comment": "Malware payload (RedLineStealer)", "value": "2977d0349deff9e8867ae53707c13c972ac1c2e7b174a1902f81f270ee97e69e2fb1f7446855d577d5dfed2e45bf7fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682190936, "uuid": "8ed8817a-e95a-49fe-a0f9-269af52de3ad", "value": "T1AA454801E5A35CFDDA7D197A35909DB0CCEEA5306F76863A4F88071AAA237C17F10A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682190936, "uuid": "6534e5cc-4803-4e10-907d-4b3b7974f50c", "value": "e28b3f7484bd5db9ff26da5bec4979e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682190936, "uuid": "f8b5a3da-4d89-4555-a178-2a365d18d3c7", "value": "6144:C7tDul4+gYAObKMX5bMkh2U/yL7kZ+TpvS3hUa:C7tDQcc5MkhDqL7kZR6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682190936, "uuid": "1df123bd-b514-40df-9611-f2f7d2b152ec", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682190936, "uuid": "f8ce08b8-0f9f-469d-9bc7-541c43dc701e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682190936, "uuid": "42c65bd0-1dc8-43d2-8bf1-694426b07229", "value": "c700e7fd770e19fbaa14635e75a5bcb4.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd5a5a9-e11b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682174369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174369, "uuid": "e849eb52-a034-4ed8-81be-9cde84c40461", "comment": "Malware payload", "value": "40223dfcb0906b84752e898934bc661a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174369, "uuid": "2b731e1e-fe02-47cf-9015-d8a8f6c10ad9", "comment": "Malware payload", "value": "fba90ea29f691bb318f71bf85fe9ac62e22dd697cc7ce3de80dc66c6d574fc95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174369, "uuid": "86b3bb1d-43ac-4d98-9122-4bf2a4b46719", "comment": "Malware payload", "value": "84e7ca1cf876b4147cf135625310c0e5d0f3689f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682174369, "uuid": "8798a10c-71b6-43cd-a33e-aba346533ee0", "comment": "Malware payload", "value": "9feba5c5ebf1c22259f1fa5a3eb914c11823ee354cb431212e44851f5a08bae73fea858944bb84b3599a5ba9cc50ddbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174369, "uuid": "dced0a28-f5f4-40b2-a737-c2cb6266b893", "value": "T15AD51965E37B9551FA6D07F0A0622782FE3DED46B351C738BDC8B0BD80B620447936A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174369, "uuid": "c11dcb55-ee2d-46e4-9a17-9757e6fc87cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174369, "uuid": "8a3c147f-4ed6-4a5c-acab-00f10d87535f", "value": "49152:83+xTCM1oVeG0kGj/esU462SJJm0tjRU+hT9Lgr84zMG8qK7kyjF3U4RRGef++fd:8LGefGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682174369, "uuid": "e30aadce-b5ee-4385-9456-e606946b4990", "value": 2986496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682174369, "uuid": "e185ec4b-005d-472d-80d9-1a9fcf4e15b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682174369, "uuid": "3abcd8ec-160a-41f6-a936-b2827aee6e0d", "value": "LANC PCPS (lancremasteredpcps.com).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df3d73d-e0df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682148628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148628, "uuid": "f84c4cac-40de-4c78-9eeb-aafec11fc6bb", "comment": "Malware payload (Amadey)", "value": "81618d658a842776a9e2315e2b210efc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148628, "uuid": "b9c8555a-058f-453f-a8cf-d528fcdb581d", "comment": "Malware payload (Amadey)", "value": "fd60251d1b284a0794309846abfe8ce3038ae77cad99efac7c7eb94834d45c6f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148628, "uuid": "b117cb41-a86e-482a-8cf4-8e619733a6f2", "comment": "Malware payload (Amadey)", "value": "48429bd0e7b0c1c1460f797cbb44d2184842a89b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682148628, "uuid": "6c74ef99-8405-4136-9d46-b32a7acc23dc", "comment": "Malware payload (Amadey)", "value": "25627a40b1ab1194c41242ea33c2fd29d72c90fa12e2b21245c1fcb74d8653cb31dd87a6d1633ca348b45ec5f2b31324", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148628, "uuid": "3eaf2a62-6dfb-4124-b9dc-6da5c6f8867f", "value": "T186252213B7E48077D9B807F068F623471A24BC85973883EB2391699A5CB23D1763677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148628, "uuid": "6fa2c935-681b-4057-af48-bd93a91f6588", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148628, "uuid": "f8bb0232-7072-4fbf-bd40-ee8c82cf54a9", "value": "24576:3yRYbddQ/MGIv8T/Snas11YrVQcrIZYdrbNId8VWP:CRYrQ/MGA8+nburrIZ4VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682148628, "uuid": "8233da2b-4d53-4a8d-9b7b-74213b61a67c", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682148628, "uuid": "91b855ce-499f-41f4-8d30-6224438ba75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682148628, "uuid": "a1cce0e8-9dd1-433e-b055-f746da60bb27", "value": "81618d658a842776a9e2315e2b210efc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc8d262-e113-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682170884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170884, "uuid": "8239f06b-7c56-4ad5-86c3-844d577e1496", "comment": "Malware payload", "value": "37d7ef08ffe2853f276420738d4c32e1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170884, "uuid": "76aa6c7b-6754-41ef-8905-2a1ae61e43c0", "comment": "Malware payload", "value": "fddee095376081cff176e35728de527e9a99f6b543d9f66181de9e5bf15fdcb9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170884, "uuid": "f8888cbd-ffa2-4307-9ab8-eb471ec4b178", "comment": "Malware payload", "value": "385af9829927806bf261470dc02497f2c926f40c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682170884, "uuid": "dc08c3d3-3b7e-4b04-901a-e5671df178af", "comment": "Malware payload", "value": "8e8f75acac007bcf5cddce1e059a913a80284d3ddf2cbffcb90262d341429f1415e7aa6762acbbf7bd9602817acc76d2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682170884, "uuid": "1017959a-efa5-4624-892a-b97c39ebcbd7", "value": "T11D65E121FBC76131D96A017C297B76700A39ACE11A6CF52BEBC4721E2D712D06335A7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682170884, "uuid": "a0193981-390e-4389-bd93-0c819b1cd698", "value": "24576:CKoOxtwYXRB/wGiuN5x5szaQ4JQbcwOVARfl9VyT0:CKoEt/RBoG1LtQ4JQtVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682170884, "uuid": "0fd45fc1-4a18-4716-b82a-0f25a69ef9c8", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682170884, "uuid": "6a45273b-fca5-4db8-828b-0a8fe1d3339d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682170884, "uuid": "7a83cc9b-f580-4ce1-8df1-085181ac590f", "value": "Bard AI 1.1 setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90c1442-e0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682160350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160350, "uuid": "c7e24c09-3694-4bed-8c6a-fb14cbb00913", "comment": "Malware payload (SnakeKeylogger)", "value": "83ffd0464e69f35ef365250a21183eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160350, "uuid": "e1454ecf-2133-4f0d-a64b-14a358e1aae2", "comment": "Malware payload (SnakeKeylogger)", "value": "fe2e43ede9f445a41bd41df5d99beeaee9aad9e0684ceb148dd81c1f0e7db616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160350, "uuid": "a71a9062-92bb-4682-8a88-d3210b9a674e", "comment": "Malware payload (SnakeKeylogger)", "value": "1d4c67aa044fad27b01643f5e211fa42c97a1e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682160350, "uuid": "e863bdb5-7d36-4411-8ac8-d0a9814d7ede", "comment": "Malware payload (SnakeKeylogger)", "value": "0e8c84f6736129210b3e7bd9e3047e09708e2b8fba5a5aa9ab9b7ae34525fd8e7fd75914c737247f0c113b99d553e047", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160350, "uuid": "5c23b86d-ec42-420f-b05b-bc4933fa3ba4", "value": "T1F5D4E0757027ABA7D7BECAF01248264507F63BA7B67CF1AC9F0E31D506B678009185A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160350, "uuid": "db2dfd45-80bf-491d-aec1-4e7f7c76eebb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160350, "uuid": "5072616e-5c21-491f-a9b3-3e4a99d9890f", "value": "12288:e+52iNsXkocbUUPFHbibW2pl1Bs4DViH8x4sQStZYs:R1yXkoE9bq/n1BHRx4snYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682160350, "uuid": "88b3eb0e-a740-4f21-98b1-527bf9748f73", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682160350, "uuid": "544f66d0-770d-42b2-9a7d-d4ec256b3d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682160350, "uuid": "704e17c0-483f-4949-b00f-5d8b265cf4f1", "value": "specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46502e61-e0d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682142924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142924, "uuid": "ac876a08-f33a-4f6b-b91f-0ecdddbacad4", "comment": "Malware payload (Amadey)", "value": "fa4f65a22f6558aa28a32e34ee50d68c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142924, "uuid": "9767b85d-2a2d-4c49-a16f-69111f20d518", "comment": "Malware payload (Amadey)", "value": "fe7ef420f0d96caf106fc0d78e751b5a389f8023f2cb8c9b67b8f95ec74f989e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142924, "uuid": "fb705fd0-2f4f-4ffc-a51a-ab644af20cda", "comment": "Malware payload (Amadey)", "value": "bf350b622b8971a4103c5533dcb9aedb7c30043c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682142924, "uuid": "0961a18d-9baa-48ed-adfd-93c9cae6ce61", "comment": "Malware payload (Amadey)", "value": "be4134cfef05e4045c23d8cef70f733ba4bcd2bdd94ad879a38e5a6db71e2c141a7a17348d75765c9076d2548e30746b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142924, "uuid": "135fe01e-7504-487d-8930-8c42b7e847bf", "value": "T147352302A2DC80A7D8B71370C4F752531576BCA01F7853D732A8C9AE6DB22D855B6B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142924, "uuid": "3a3e7f80-8e9b-404f-ba90-2d7485a81228", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142924, "uuid": "67ad9c45-a8e6-433b-9d82-9553087c0236", "value": "24576:3yaPjcsRcHiZtRujrnUJhkthoAWb+oQKHjYG78j:Ca/dYjorAoQ+jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682142924, "uuid": "0d1b5b9b-a16d-4719-b700-0f4bc2a24d23", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682142924, "uuid": "0d29327e-e12e-4430-95bc-20449ab6c2fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682142924, "uuid": "b68394fc-13d1-44bd-ad4d-b5b070a2a3e6", "value": "fa4f65a22f6558aa28a32e34ee50d68c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00039961-e0c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682137652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137652, "uuid": "c94db3aa-3e77-4963-b67f-a6f84ff11c88", "comment": "Malware payload", "value": "7bc92dec859255fc3141339f86660b78", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137652, "uuid": "716399b9-b952-4951-b0f1-377306174c0d", "comment": "Malware payload", "value": "ff441648c8edaef936495eab96ac82e213fa2fe0d6a10b3cd47626910e777c8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137652, "uuid": "de51e5b4-63c4-4619-80c1-f9aa29b7284a", "comment": "Malware payload", "value": "164a2b95db97fc5fe72f9a08bdae35f75512e5f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682137652, "uuid": "abbdd4c5-a245-4fdb-8611-de7eebbbae0a", "comment": "Malware payload", "value": "2ad872dcac22800aedb5431546eb845a048870cfd26fce5ca8c94a7b24484caf4c505bc47b1523e90566e925e9cbd6d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137652, "uuid": "332e264a-7b85-4431-ab50-7311f2631582", "value": "T145924BDA0F186212EEC74E71A7E5D22A6E75F3E0FE66849F20AD80D43DC17903E5421E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137652, "uuid": "6a37c841-c8ff-4eda-9309-b2e9a95c9882", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137652, "uuid": "84d69bd9-5f07-4025-945e-2922fe616212", "value": "192:qPE0gGyJgl3masvREJdNhnYe+PjPaiSsFc4wGvtCQiSsFc4wIn7bju+:0E0gG53mPeJdfnYPLaiSKnF3iSK5ni+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682137652, "uuid": "efc1a7a9-6a35-4774-87dc-28242d4a4c10", "value": 20768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682137652, "uuid": "b68dcf3d-21ae-4df7-862d-7fdcd1120a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682137652, "uuid": "02589ecb-d158-4e55-afe6-ba2f7297aa7c", "value": "SecuriteInfo.com.Program.Unwanted.4695.14002.12110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }