{ "Event": { "published": true, "date": "2023-06-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-11", "timestamp": 1686528181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ccc3af08-405b-4646-9f8d-19e531298b30", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4ce328-08a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686522568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522568, "uuid": "91a595d5-4986-4c56-82df-dcb7c3297079", "comment": "Malware payload", "value": "e989d709307821ddd4e534aa648c57a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522568, "uuid": "c0133ab3-5dc9-4d3f-ad7e-b211ed301cf0", "comment": "Malware payload", "value": "01c31af7cd3c53adf52595a2e1a70b711e5f774bd80fe529fba299e15e31bf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522568, "uuid": "230a2f4a-b062-4835-ac84-ce413ee54949", "comment": "Malware payload", "value": "789e61e3723ceeca310c232e0587d60d870b641f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522568, "uuid": "3dac3990-78c0-4fc3-9680-b2db2c35b5f0", "comment": "Malware payload", "value": "37ce91d0aa1a28c18f019096d664378f7d98c2e151bfdf4eafbdfc9cfc7b10fd8fe2e16914e0c90532e865f882634abe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686522568, "uuid": "c3283d55-0c49-4c31-a823-28d6ad5673d3", "value": "T10FF36D57F2C28477D2232E79CC666156A326BF523D1AA45EAAFC0D08DB3A3D534381C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686522568, "uuid": "b220de1f-d933-4500-b045-983c41c0ff56", "value": "3072:1P9TtT3L55w/yw+wJfTUYsyU549j7nxswGrTZgKgzSqJdsqVwu6PZhbjju:tFj5QJ/UtxT91qJdsqVwuqTbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686522568, "uuid": "7b0686f4-7996-448d-97e2-371f52c9897a", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686522568, "uuid": "5bf5080a-5584-4194-ab95-418123e0364c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686522568, "uuid": "4d72036d-e8c4-42d0-b001-46d0aaee6f7d", "value": "SecuriteInfo.com.Packed.Win32.Morphine.a.586.16586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cadf054-08a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686522567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522567, "uuid": "2f76c48b-831b-4bf6-b68e-3a76313ddb55", "comment": "Malware payload", "value": "24e4bb3d8d67f3f624aab9798e0bceb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522567, "uuid": "edc71f20-7855-47c2-b0b3-ca585f89e122", "comment": "Malware payload", "value": "02a05ebf9bc6cf8680de0dac633715ba2df54ed6c9bf2df23cfb5beed9a2731a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522567, "uuid": "298d27d0-62cd-45e0-9f86-b50b0c88c9ac", "comment": "Malware payload", "value": "20e9df02a8849ce652a31f4a0731fd046453a3a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522567, "uuid": "d0fbac35-4d3c-46bc-8573-5f2756f98bcd", "comment": "Malware payload", "value": "dd6b89ce28bc7682a910acdd10caf47e0ce18cf5a7ac5c0c130f35ae9efa6399a40d6b1b3c036a5775a83984afe1d5ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686522567, "uuid": "51b37426-5800-4ef8-89e6-5286bc022482", "value": "T1C8047D63F1C24477E2631A38CD5A6166B72A7F523E69E44F6AF80D089F392D5782C1C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686522567, "uuid": "25e90311-0fd0-4656-b26f-711d3cb98d8e", "value": "3072:5ydH2dZltg+m1wFZA8syvKVG/fiBgJKm0SiUxCCdsRVwu6ayZ/f:M92d6+mm1KVKKnqCCdsRVwu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686522567, "uuid": "a28b1714-1e32-4d58-bb84-ec49865d2496", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686522567, "uuid": "83b04c44-9abb-4dfd-8ce5-ca14c8f82c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686522567, "uuid": "67fdbda1-4d8d-427c-8d14-5410a941fb5e", "value": "SecuriteInfo.com.Packed.Win32.Morphine.a.22049.21684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412defdb-085b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489852, "uuid": "5fcb8383-7d8b-4e7b-8b37-1485a7c796fc", "comment": "Malware payload (Mirai)", "value": "d597dca9d3fb8a1d039d4688926eea7b", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489852, "uuid": "dd0f8607-9e03-4976-beed-f81d3b7a31a4", "comment": "Malware payload (Mirai)", "value": "071c75ed604cec6ab525790eac8d2f204d16a192df2b5bb8eb2a3a8cde649399", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489852, "uuid": "516da52a-88e5-44ed-8e8b-88e89f870dd7", "comment": "Malware payload (Mirai)", "value": "3b9e99b48caa4b693c0b22e6a42aebd5c4cb73fd", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489852, "uuid": "6e27dd07-2b04-462f-be3f-fde4d95e7e04", "comment": "Malware payload (Mirai)", "value": "708221a07963908b98b4327b39c0ef50bb49e093bac9b8211edc01cbe446f0b93a54781e1f0063f7b84d73dc2b022958", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489852, "uuid": "2ea8c8d4-cf48-4855-ab9b-543988998a0b", "value": "T18C41F04A2FD01F32DDA6CC36455A2B512ACC902BA16A23926234DD64BD3E605E7D38AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489852, "uuid": "477cee0d-88a9-4cdc-bda0-44b858ed1ccc", "value": "48:0Q2zNnuDW3B6df9C+SMTLWPkeTL2FaXp:0QQnuqYf93SoLW7TLB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489852, "uuid": "50b7cb5d-7994-4ebe-b3bf-501ba46d07c3", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489852, "uuid": "80eec3e1-a024-4101-90bc-1ca7418a0b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489852, "uuid": "c79ab7a0-284f-4a59-bf9f-cd25d5140524", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4960738-0870-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686499119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686499119, "uuid": "501c41c0-cf10-4324-ab28-e6581d5252bb", "comment": "Malware payload (Amadey)", "value": "8a06751312436a705c6404180c8b1519", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686499119, "uuid": "7a8b0822-0468-4d26-9077-7621a165cc34", "comment": "Malware payload (Amadey)", "value": "0875f2085b2f40b96db96d317cfdd1d870541182d4200de33fae9cbefaf07797", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686499119, "uuid": "4e0ef998-14b8-4aac-8db6-1a2aba90d558", "comment": "Malware payload (Amadey)", "value": "2d1d3a9731159943463257ee2e94a070e39c3b36", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686499119, "uuid": "398f5a77-410c-4b7c-9c8f-0df2d7086473", "comment": "Malware payload (Amadey)", "value": "0851ead0e61b007f2852e71f0c90afdbaea2618dc709e15dd2e3c130505eac73c09d9812674411ab6224635ca34ff171", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686499119, "uuid": "aad9b598-f121-4eb7-9a8b-af16ad06618b", "value": "T105358C61B03CAB35D75986F94E25D7EEDE7F3573FB120A04A99829844DCA9C29C023D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686499119, "uuid": "86b43729-dde7-4a4c-a009-5bfab5e9fa7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686499119, "uuid": "a11d5121-97e4-40d7-9466-471bd4e7fd9f", "value": "12288:aV8Jo5Xb+qCPuwvko4WzuqimH8ISEW4Wq4/OS7oS/8lTkJKaG0BHDKnn2yoSXkHN:aV84dM1DyqRrJ55KU882tMkHWiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686499119, "uuid": "32772095-2d5b-4647-a151-5246a23994df", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686499119, "uuid": "0a249aa8-a0d5-4661-9b4d-931526ec0a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686499119, "uuid": "0a35475d-5cf3-47ed-b0f0-bd95c655c9e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db10c13a-0800-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686451026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451026, "uuid": "70db8058-3341-498c-97b6-1d88396b8313", "comment": "Malware payload (RedLineStealer)", "value": "f19fa90ff55e27340dd39410e6dffd39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451026, "uuid": "db988105-e1d0-459d-a114-99c78ae8d3cd", "comment": "Malware payload (RedLineStealer)", "value": "09165d1bb48ef976dac9b9cee3c66d2a2bf5c36b455f480c5db49cd0ab50865d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451026, "uuid": "c8df06df-5fc6-4ccf-acbf-b254e1fd60a9", "comment": "Malware payload (RedLineStealer)", "value": "6ff2b0805f5766dfeb73ffb74bb5bee154a33222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451026, "uuid": "a1c9d79a-f072-49a4-af64-71681bfbaf79", "comment": "Malware payload (RedLineStealer)", "value": "e4f6743bddead8b481e46dcb728600c33ce9fc13bdfe99e77947544d2e141ad763271891f50537bff543efcc94296882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451026, "uuid": "24bd1e49-6751-4970-aee3-4165cccd030c", "value": "T1A6F42217E6D84072E8F12B7049F207C30B367DA79D70A91B67887E9E4CB3690A572763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451026, "uuid": "929c2f03-285c-4a58-88f7-a40dae7eafa6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451026, "uuid": "c6501f49-52a5-4037-bc76-7c93b02b0d25", "value": "12288:aMrly905KP0huYxgMOj1rZed5MA76VesQjREgZ/lzvBR7A6UsbjpisKe4z+0e:fyLP0NqMeZG5v76VesQ9EM/lzvT7NUsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686451026, "uuid": "4f25ff35-1022-4deb-a448-65c91f9ea24a", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686451026, "uuid": "ce169dda-6cad-4e2d-b122-2d8c5841226e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451026, "uuid": "b54c0d0f-b7b4-4b53-ab9f-aa6f423953bc", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01339892-0866-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686494469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494469, "uuid": "a169cd07-7fe3-4bfc-a84a-daca0aebb7f2", "comment": "Malware payload (RedLineStealer)", "value": "097ddd6781f3858d61893d04f9b05d3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494469, "uuid": "a639199c-1a08-44a2-9881-c2289535f385", "comment": "Malware payload (RedLineStealer)", "value": "0faf46b77e0dc61eac5dab98d372ee9ffa412a53883d901c00887de6d22bdca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494469, "uuid": "2b63f4c8-e844-420e-aebd-3a5b4d16ff63", "comment": "Malware payload (RedLineStealer)", "value": "7b82946ec10785267568ec89db467757521237d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494469, "uuid": "7f147dec-5de2-4a6e-b89b-3cc4ce78efe0", "comment": "Malware payload (RedLineStealer)", "value": "570de3397fa4d5241479ea99e7419258e076ed054c6e30f5588b671c0ceb7d54181a11f3a0cedd31616c39cf9363f2ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494469, "uuid": "7576e89d-98d6-42f9-851f-2d360db349ef", "value": "T12154CF117AB0DC32F6A745318834D2E4EA7BB872E964D58772542F5F6D332829BE2303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494469, "uuid": "3ed34970-9811-4985-9d7b-d865caceeef3", "value": "1b96bbe7f35030dff720bfd4a2e62f20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494469, "uuid": "3680fff5-474a-44b5-b8f5-d03bb817efd6", "value": "3072:y760v47OwsQcRNSWdSnutpsRfOrPxjKYmwm2BuiJyT75enFW3h/1wRdBFtDaH:C68wOT7RNUM+R+5W/N1TV/+bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686494469, "uuid": "05e58f7e-f6d1-42f9-8c35-26867e70aa9e", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686494469, "uuid": "d03b1968-40d1-44cf-aaf2-7d6a13cc7d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494469, "uuid": "8d5f9096-9722-4ee5-b9db-ab547dddded7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b22622-0867-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686495062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495062, "uuid": "32207a40-7fe3-4fdc-8e41-ea2dac1a767f", "comment": "Malware payload", "value": "72b273f97b01db4555f045e0367fec2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495062, "uuid": "47c8eb6d-edfd-4c20-b97f-72eb2b0eccf3", "comment": "Malware payload", "value": "11dc5e3e31c29008a5294f02fd468c5987858bd6c3923e0ff51ada1f65077345", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495062, "uuid": "194914c8-fc78-449e-ad76-657a7fb3ba31", "comment": "Malware payload", "value": "2ddc8ab62b533372334475f3a176728f14655f13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495062, "uuid": "60a9b24a-8cf0-4a81-9530-88f2014c2944", "comment": "Malware payload", "value": "979ac04259944c68d1d0762a946860a8e80b9d64fec3784b1aa6fe359bc85e7943ce1f8b50b53d890e6bbcf4885d436c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495062, "uuid": "70253f66-773d-4064-82af-000fdd0dca5f", "value": "T135A3B43777270E63C0CA547101EB1331ABA9DE4438B94BD7A9917DA83F36E8834593DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495062, "uuid": "2eebeced-3f6e-4c59-9f9f-9f8ae65761d0", "value": "1536:qIumRLOB2fHSo958f9tutjUiwbPAjzUI8:9L3SoP88CAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495062, "uuid": "4cba7628-eaf7-452b-992d-2c32d3e0f47e", "value": 102986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495062, "uuid": "6218d6c2-ac80-4be8-ae03-c8df5afdbbd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495062, "uuid": "9fa142f1-1d6e-43b4-8f35-93ede2be6d67", "value": "72b273f97b01db4555f045e0367fec2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f97abc8-0870-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686498788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498788, "uuid": "9a6092c9-6630-4ff4-bd08-7b2842df4fe3", "comment": "Malware payload (RedLineStealer)", "value": "f8e31a85fe0f5d3adcc45c3f29a210c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498788, "uuid": "115e939f-90ed-4827-8ac8-47d562303a90", "comment": "Malware payload (RedLineStealer)", "value": "12ab0f4389fb376011431b9ffc35cd90447edc980b75574b6b376ef0fd50fd59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498788, "uuid": "e8b1e4f5-032a-46bf-b15c-9cdba1736249", "comment": "Malware payload (RedLineStealer)", "value": "c54a5e3e379d4b80f6e36ad60705553e047321a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498788, "uuid": "ac973127-909f-4ac1-87d1-b94185c8ff38", "comment": "Malware payload (RedLineStealer)", "value": "5429fb56b0ed8160750c1586283cfa7e486d638c484a1aa62ef5820c07a5bcea3abf12d28386908c6c7d18fb83ff362a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498788, "uuid": "194a9bd1-aaa5-4cb3-bcf3-65bbaab816fe", "value": "T10F754B1663A85515F5F73A319DBF0CE80B367E22EC74D61F22507C4E28B194AAC62B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498788, "uuid": "6a2b49d6-c6eb-49ce-b05e-b87576fdf8ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498788, "uuid": "cee9bb4b-7cf3-436d-84cc-bc8765d46399", "value": "24576:KUP7SdUKAUYrTzGbg+QrWPre7r1Rrdirra:vzSzAUYrTzGbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686498788, "uuid": "9fe17e46-6264-4a6e-b7fa-de8af19e4d97", "value": 1621672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686498788, "uuid": "d10585c0-60d4-46fb-a72c-40d83f2e2897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498788, "uuid": "fa94c984-9bb9-444a-bb63-a14042636393", "value": "0x1200007F852015420286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbe1340-07eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686441714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441714, "uuid": "798abdef-c888-4a99-b928-3ea04d5bbb41", "comment": "Malware payload (CoinMiner)", "value": "6e39a59c8f6c3f52f122f80fb0933c9f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441714, "uuid": "eb907f26-15cb-45e3-ab39-21551ea94502", "comment": "Malware payload (CoinMiner)", "value": "17f1d39417de8a58e1c64a84aa10499cc0462748a47d3e82f358f97ef536a671", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441714, "uuid": "71c54c4f-3cb5-4a98-adb6-c5962785ddae", "comment": "Malware payload (CoinMiner)", "value": "cb1e56e022de8660579a5812b97303529bdca5d5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441714, "uuid": "0a823f0f-ea45-44db-8450-0f231ca59cf5", "comment": "Malware payload (CoinMiner)", "value": "2dd839271332e2caf23067818aa2fda83a909a659f458078994608272d6a606e50bfb526bf4b139bafce44403431871b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441714, "uuid": "c2cc1593-b322-4f38-a259-7fa8809ddd4c", "value": "T1EFB6D0A329E0595DD46EC4FDA51AF8BACBC7396CB647B94730B13079C8234C13B58B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441714, "uuid": "02aae9d6-90bf-4dae-a026-953cd6c189fc", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441714, "uuid": "f3bf7f69-afdd-4429-9bff-d04fbd62747e", "value": "196608:ewsu2RW4y/m+QpIW96WWQfKH5BnF6UQFaq4Mj85JnZEZDo:zsnzhp597KH4U7PMo5Jn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686441714, "uuid": "157634c5-ddd4-49e2-9968-4f5d3aed18f5", "value": 11347744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686441714, "uuid": "701dc9ee-47cc-43a3-abdc-865f40f69192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441714, "uuid": "6df4e0df-5287-43ce-ae43-805f6ff7d4c8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baf8b41-085b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489816, "uuid": "9d6e5f4d-3fa2-46dc-a3c8-975e7ea1d820", "comment": "Malware payload (Mirai)", "value": "1f9f516e90895407fe1b0be301f160ec", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489816, "uuid": "cd67c5fe-e096-4bfa-9b11-c8397d69bdaa", "comment": "Malware payload (Mirai)", "value": "1a072c5612239f5ff2d4962727861cbad647709bef2c976cddac03c28f80ab0e", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489816, "uuid": "278d88d2-9c09-4e45-b426-ecc5535b437d", "comment": "Malware payload (Mirai)", "value": "5cede5ad8e81c43bc84a71f83189dfc59ea6f8c7", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489816, "uuid": "71b89ff8-574f-400e-ba35-8bca208c0704", "comment": "Malware payload (Mirai)", "value": "f072e4e02dd9cdbbbfa1dd5e6951fda1aebf34f53ff6182cb1ed4cae71f3206a1930cb44eb7e0816a625f0ce1e7d9843", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489816, "uuid": "428f3819-b21b-40c0-bf31-a064c9b4e3ec", "value": "T1BE31FED1A3D09DBCCDA491BEAE5643107365AF84F0C732A392087B19BE2EE7D5C27046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489816, "uuid": "534bc450-a250-4dc5-bb6e-5b5051b03cfc", "value": "24:vKGpa7Urz/jlfojXK1hH9Vev3gRGH9iMrBBu2zlxrR+zLLh4:vKGpa7UrLZ3Iz1Bu2zlxrsLLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489816, "uuid": "451afa3c-aee1-4d88-859f-96ae76bf3c23", "value": 1452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489816, "uuid": "67d361cf-b076-4706-ae14-f445aad51ebf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489816, "uuid": "cc589c32-9274-4815-b08e-9684edbaf3bc", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dff31aa-07f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686447487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447487, "uuid": "30e00bb5-5b62-499b-8c28-3ca4883ab86b", "comment": "Malware payload (CoinMiner)", "value": "b06f56f80714dc5b2d3d5e6d4abe3757", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447487, "uuid": "5b635604-6e62-46a4-b085-4b45e8c3bc76", "comment": "Malware payload (CoinMiner)", "value": "1b3332ac024389903f2d1f73ea7b758a8ce521a1fca4f058d955c99709672db1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447487, "uuid": "ffe748b8-0328-47d5-b40e-e4110eabe49a", "comment": "Malware payload (CoinMiner)", "value": "a7b8e40b18c7802053048ae0ce0df5b186f1ff29", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447487, "uuid": "a577e4da-8e09-4486-b501-d70eb8ae32f8", "comment": "Malware payload (CoinMiner)", "value": "1bd82edd7162948581ab3709784b3c10bbc7118f5b386e6531dd98f007627f36080fedbf6594b70e4e5769a762359c41", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447487, "uuid": "b2825a76-0415-4aea-b685-dc4b73598af6", "value": "T1E30633086D8F9AF4C501B773D0D1AE5EF8185FE84E5481A3A368B3165C7197E8CEAC6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447487, "uuid": "2097eeea-9939-476b-a4d6-ea833d8cecf4", "value": "e64ab2f4e7dbf88e67dbe16da9682293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447487, "uuid": "4eb5cb78-15f8-4dc3-a983-dabd4864dcc8", "value": "98304:3niYY+Mi3SGza7TRh2VA+PogWkA3scbItpyLWz:3nX3M+Sv7CFogs3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686447487, "uuid": "3cbf4389-0225-496d-af1e-2de4c1031221", "value": 3701760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686447487, "uuid": "0e4a4c31-3dc7-4f9c-977b-68b5b35e9bad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447487, "uuid": "8e35ba19-fe8a-4661-b4bd-b6283d299aa0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5bb288-0853-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686486488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486488, "uuid": "4b5319da-a73c-43c8-a0fa-30df904638d5", "comment": "Malware payload (Mirai)", "value": "b6d9bc5bdb1ce4219006b8f0075ee007", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486488, "uuid": "856e0b99-a082-4d10-b2f7-704f50bb8d25", "comment": "Malware payload (Mirai)", "value": "1b5bfa46d7b8daccef6daa5191f63b74f492dc27e0eb5e42a57c8bb25da43d99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486488, "uuid": "2a981e32-2b06-4d3e-bd77-256dda40f58f", "comment": "Malware payload (Mirai)", "value": "2bc265f094956e2aec4f899cecaeb9547317e23e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486488, "uuid": "61e51b60-12dc-49a2-b512-b274e0309eeb", "comment": "Malware payload (Mirai)", "value": "ca2567dc07c91cc7ebf49b26bda80cbc2091ff538a121c4c1def6b78495197149cb8a508080c0e7e3e91ead429251800", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486488, "uuid": "1c3289ff-0931-4b0a-bbc2-aeef0fe66885", "value": "T139B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486488, "uuid": "69273e35-380b-4430-a1ad-3d364ea962db", "value": "3072:MSY+46m1qOzsseFPPKNy+AmkZrQAhPDCXFke:06mgOzJeFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486488, "uuid": "b1eca850-200f-4d3d-ae87-31f1b2f5b5cf", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486488, "uuid": "dae37873-e75a-4889-8d8e-df4d09e4feef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486488, "uuid": "ed5485d6-55db-486b-a23f-bf0d35499368", "value": "b6d9bc5bdb1ce4219006b8f0075ee007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef5a548-0853-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686486493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486493, "uuid": "274d9958-5fa0-4c26-bc50-cffbbaaa5901", "comment": "Malware payload (Mirai)", "value": "465110182037b6ed3051e5af5c4d870c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486493, "uuid": "e8a1fb1d-7c60-4191-ad46-1bc421c6adf1", "comment": "Malware payload (Mirai)", "value": "1e07b07f860c74adb2175e0b535b7965ded14bc17399923546d65529ab2e0a40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486493, "uuid": "5e55bed7-cd1f-4940-83bc-ed440b1a05da", "comment": "Malware payload (Mirai)", "value": "a37c3f67da7642b2ea424455a8f735dc65e01167", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486493, "uuid": "0c13bd71-7b01-4c94-921e-ee864454be90", "comment": "Malware payload (Mirai)", "value": "8c4b5f14a03e3a4f07723260672254e56de4d7543b09b9e88bb44f4aea23da4abaa38b3d2233c9e86d4e4f806650a457", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486493, "uuid": "64c20739-4f6e-4a0c-a169-196bced9eb93", "value": "T126C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486493, "uuid": "8e0498e9-5495-4002-beeb-ce03e2e7a427", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBemEdWfRZrmW+IFj:Ted0W0MZQHUd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486493, "uuid": "f9024959-53c0-4343-9e74-c41960c627aa", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486493, "uuid": "fc8eaeab-badf-4786-91ae-aee807908862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486493, "uuid": "3e9332c5-d8be-4bce-a9be-ba758c356735", "value": "465110182037b6ed3051e5af5c4d870c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9283207-0834-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686473330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686473330, "uuid": "cd2b5bd5-3cde-4ccd-9300-9fd9cc2eb42e", "comment": "Malware payload (RedLineStealer)", "value": "d88609c30b057004a846a4ecc8b19c25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686473330, "uuid": "734fabcb-7100-4fdb-8963-5296330de91c", "comment": "Malware payload (RedLineStealer)", "value": "21fda73dd761f3a421f9cfbfa0944ac3226ef3e36905de421dd69060fe1a4b7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686473330, "uuid": "6db30e0a-bdf2-420c-aba9-e7dbeee85bfa", "comment": "Malware payload (RedLineStealer)", "value": "946d8046812da0b0ad70151b4632a8f4c4d19232", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686473330, "uuid": "e2e75879-ec25-4ca8-8221-2513cafd29fe", "comment": "Malware payload (RedLineStealer)", "value": "0d8337124ee41265d5281762d79c9d41df110884c250471af226fcb710a61585aca6b46bb370be08f16f8b6860ccd344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686473330, "uuid": "0e4fc378-da1f-4353-bb91-65aee3b16262", "value": "T11154C0507AF1C832E5B345349825D3E0667FBCB2A975848FB2943B5F6D332C29AA5313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686473330, "uuid": "9efa1ddf-09d1-4330-a415-89853873a26c", "value": "d6d834b82d5aa93f8c82e8d8030ea44a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686473330, "uuid": "05609483-075b-4767-96fd-6570550acc19", "value": "6144:FEoxlHOZArVQ8Kitt43I8ugMTyAC+iW55fW6Gx8G2NlQqMLt:qEBrfKiti3I8ujg+iW5oU1lQqat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686473330, "uuid": "c9a2fabb-d280-47f1-8e58-cd8da6a549b4", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686473330, "uuid": "0adc834a-b4be-49d4-b42b-0273a418eede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686473330, "uuid": "3f6f040e-1420-492c-bffb-a3b476def39b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cc81a8-0832-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686472331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686472331, "uuid": "bd402b9f-2200-48a3-8eea-dd1f96406883", "comment": "Malware payload (GCleaner)", "value": "ef247b70451184a0419a1fbf290f6e6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686472331, "uuid": "23a1a426-4ab5-4be1-9d30-1fb673506ada", "comment": "Malware payload (GCleaner)", "value": "2507ed3ba3db274213ed6f01d08da0d9db77b3b83a522999f3dd6912af282853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686472331, "uuid": "57a14941-2da0-4f4c-81c4-1ddb7daef3aa", "comment": "Malware payload (GCleaner)", "value": "1a16b3911a3cb207a8cdf8db94a819edda321bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686472331, "uuid": "a7cceffc-f8d4-40ea-8a01-9bdb083e112f", "comment": "Malware payload (GCleaner)", "value": "40db4e8a3023fa57105ea025994f59c13919b478ec92dd75b1df19de1bb9c62aedb38c8c74063c422297e6a5cfc06582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686472331, "uuid": "63812b32-7554-4d2a-9f54-a284c6df42f9", "value": "T15DB522169BBDFA20C6D948F36FD214DDB22C95207BFF442B6CB7D41AD469A443C2E608", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686472331, "uuid": "3902d366-a573-42ca-93b2-0a6121d670de", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686472331, "uuid": "811020e2-a551-4006-8e6d-2cc62e0f8214", "value": "49152:J6dJ6sPoWmMYzDBkWguc+VPaN345+spBE7BR2pFbjbj5c44mz++d7QGHT1g7Ir86:cdMs2zD+Wm+e1spBo7IFbjX5r9QWT1ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686472331, "uuid": "4314a4d7-fb1f-4122-b548-46df58e125a2", "value": 2354422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686472331, "uuid": "ac979f0d-b503-4df9-b519-7f29199ee2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686472331, "uuid": "80f6a4d1-d978-42db-b15d-9334fbb930a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1faf4080-0801-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686451141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451141, "uuid": "1fe6610a-ad21-49d6-a807-5bdf2c12cd83", "comment": "Malware payload (Stop)", "value": "2aafb741be724664d8ae79cf79426823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451141, "uuid": "76f4e16b-6572-4ff5-8479-9b86a494471c", "comment": "Malware payload (Stop)", "value": "2bb69d10c71e28bbb51a7f6d261ee78b31c289abef0fdb8af28d6c7b4de5f5cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451141, "uuid": "7c5c33c2-17fc-4054-924b-b86dcb71823b", "comment": "Malware payload (Stop)", "value": "d0b521d460be744e0dfee41a16e7ca59a99e5d66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451141, "uuid": "02ac683e-7501-4afe-ad98-d641e617bcfb", "comment": "Malware payload (Stop)", "value": "fecb7498683bf3025aadde5de81309fb6420ff72517f700fe0619e73fd14f4dc84395aa44170473e2da277c416b43c18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451141, "uuid": "b6399945-c058-4d0c-999f-aa6491ed7a8c", "value": "T1D705D00352917C55E9154B728E2FCEF8764DF9508F093BA66A18AB2F15B12B2C172F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451141, "uuid": "94ef0609-93c9-4ef4-b5bf-5d2505955d5f", "value": "ee55eb48a3e3a4949e7507357f34cccf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451141, "uuid": "3eaafc6a-3cb2-442d-a6e9-4bf3942161c4", "value": "12288:uUJdPGDxdEsp1HW2I6smfTrPAnkoHw8qfFW5Wc8jG5XJZ8pnyi57LRUHIAghxa:uUJmgs/HWOrPakoQ8yElUXLRUHIAg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686451141, "uuid": "52ff8493-04a7-443f-bd21-90bcad14e966", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686451141, "uuid": "d83de5de-809c-41e3-a921-d5f0e3f6cc84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451141, "uuid": "b4804372-e23b-4c4d-a45e-4b6d364ce947", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be7ccfc-0833-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686472636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686472636, "uuid": "4e752e93-13d3-4c9e-b81c-7fe1caf40364", "comment": "Malware payload (RedLineStealer)", "value": "f154f17a4f926042e3696f27c724c0c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686472636, "uuid": "c41996d9-0187-4e80-a6ab-7d5f9442efc3", "comment": "Malware payload (RedLineStealer)", "value": "2bdb87ec72b7d7735f116e40df23e9999bbc43a8f54d57a381aca468fbe8be79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686472636, "uuid": "af96e21d-a6a9-49b9-8ab1-65b853a1e8a7", "comment": "Malware payload (RedLineStealer)", "value": "f325896b98f458e0373a9cdce55f43453d372082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686472636, "uuid": "ffbf128a-e3cb-4b4b-8ffa-62484f64ae70", "comment": "Malware payload (RedLineStealer)", "value": "5d3048e81669de4d08365a10c42f14f36aa6263668bfcf9cc7e23527b1af0d4f369caba2472106cd2b80d43458681733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686472636, "uuid": "b78450d0-b153-42e9-91e1-9daa952c4c30", "value": "T1CD54D0107AA1C872E7A345349934D2F4657BFC72677589BB32943B5F28323B2AB61313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686472636, "uuid": "f67fd784-5d4f-419a-a8ec-3e8dfc4fd1ba", "value": "d6d834b82d5aa93f8c82e8d8030ea44a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686472636, "uuid": "e399f96f-4f6e-49e7-b7e2-4c23eb5c3a41", "value": "6144:aHIouH6t6sbWxkHuWDfl1ZrD+26wp4PRGt:SIh6trbAcDN1ZGDwp4pGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686472636, "uuid": "19a0807a-2e28-420f-8788-b5f35a793633", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686472636, "uuid": "bb31ecca-1a05-415d-a20c-df55f34cd67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686472636, "uuid": "02a925a7-7e15-4bc2-a71e-62689d1089a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92d153e-07f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1686447614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447614, "uuid": "b1e02527-2b9b-45ea-8606-da86bfae8043", "comment": "Malware payload (QuasarRAT)", "value": "769a35589cdbb4c0893c0ec138d21e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447614, "uuid": "b61d0594-088d-4778-84ba-25b8b2b3d3eb", "comment": "Malware payload (QuasarRAT)", "value": "2be793fba87cd5dbc7d1c89f31e2fa18ca34bbaf27a624e09a10f9b962f55373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447614, "uuid": "fe821ab8-db8e-4ad5-82e6-c28903cad89b", "comment": "Malware payload (QuasarRAT)", "value": "291b808f6b8f65e9ac217bbb44e622dcc061278f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447614, "uuid": "6dd5ca16-c8f2-45aa-a6b5-1d3cff026e4c", "comment": "Malware payload (QuasarRAT)", "value": "2d9270dbb8e4073581c49d8b9dd99fef6d16abfe7277b163c6389fc8d753a9119230ff80f98f915704ae6a3b6a08e1fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447614, "uuid": "cda006c5-7ce6-4e6d-8bcc-570300991e4d", "value": "T1B255339196F1CE30E28DAD389F63B6888EBBD78428E98D3F85D511168F5785CC7580EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447614, "uuid": "22f510bf-3b95-486f-b772-a238203d229c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447614, "uuid": "7bee7d2e-1ebe-4cb3-b0ce-d193d959bc7d", "value": "24576:xveJyBHA4KC1Qsx+9uAKgPOl4TmZUxQg5YtlpAE:gcBg1C1T+TKf2KCS8spAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686447614, "uuid": "d40b6417-3de9-4424-a752-b5d889133b6e", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686447614, "uuid": "98bb06f8-dcea-4eb9-b62e-556501ae9e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447614, "uuid": "d0326171-5bde-40d7-8ee4-2dc985537a2e", "value": "2BE793FBA87CD5DBC7D1C89F31E2FA18CA34BBAF27A62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363e9e85-07f8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686447313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447313, "uuid": "9e88b8bc-72ac-43a0-a168-918d1441fd4b", "comment": "Malware payload (Loki)", "value": "69aeb5019cb9f0cb6d720075091331ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447313, "uuid": "6c4dc594-3224-4862-ae29-3a446d8e5b95", "comment": "Malware payload (Loki)", "value": "2fcd24d3c153b7f35144d157aa3a397b2c69a0a668aa4d4b61c76a7c8ddd010d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447313, "uuid": "e8806ab4-2d0f-49f7-8fe9-c1356e9d8ce0", "comment": "Malware payload (Loki)", "value": "0cc685198bd64f162a2d3edea8f94d376bb93a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447313, "uuid": "0f01d002-d104-407d-9161-ecc93bef2e68", "comment": "Malware payload (Loki)", "value": "a8ef6116271b6250d7ede17042006873901876056b4ab54016df5815f9858548303a4295dc9d49d0d2fdd414d73b75f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447313, "uuid": "f0c7fd9b-92f9-46d7-ba28-5e64e510f7ee", "value": "T1A455F1725747FEDBF7B62D24DC8516840C802AFB879890E4F8D805AE62F7664EE45CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447313, "uuid": "5b6c0b2c-133c-406a-a870-275e3eb69c49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447313, "uuid": "eda44a04-a934-46f0-9cd3-1e12e41d181e", "value": "24576:BFPNRIWgATT6+FJ3fskY+J1gIc2dG8Jivv1i4jPMI7zD:nTpfd51FcDv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686447313, "uuid": "0ae3d599-0c0b-410f-b0f8-661cc02c5c7e", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686447313, "uuid": "221f438b-8370-4a68-9d00-2760c83631ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447313, "uuid": "b0b5ffdc-6999-4483-baf1-ec59d8658884", "value": "69aeb5019cb9f0cb6d720075091331ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3993fc-07f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1686446788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446788, "uuid": "3d857a09-f3d5-430a-b67c-e6c1361daeae", "comment": "Malware payload (Fabookie)", "value": "f8412ea00c09808959281109e0363c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446788, "uuid": "74b127a2-e2a9-4861-9135-2acd4a7086f5", "comment": "Malware payload (Fabookie)", "value": "33f93086c8ad0c614e01c503d5c299b5fc86c480007597756de02884bccc5e67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446788, "uuid": "3e2d19a4-53c9-418c-ab83-c8e7801a1bd0", "comment": "Malware payload (Fabookie)", "value": "39f29615266d7b2f1162b914ddb455fd657c2473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446788, "uuid": "9a829729-9b97-4426-b51b-b9bb0338204e", "comment": "Malware payload (Fabookie)", "value": "a5f3f2adebbf5ffb653d32ded4eef73277fec4e1feb9b7ea855eb1475c3fcf4594c73fd5114a28ca25631f7394bdf9bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446788, "uuid": "76ca0920-075e-42d6-bc4b-f375bd0f342e", "value": "T10D449E4663A44495D06E8172869397B7EAB07C141F1057CBA2A0FF6F2F337E2A73A345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446788, "uuid": "40da72ab-908b-45c4-aeee-fd2db71a1620", "value": "8a8dc8ce5095001627500b8a055afd28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446788, "uuid": "961407fd-7506-46bb-b9c8-c6c536452e8c", "value": "3072:V0NpYHbuq0/DB6KvN7xmf69ekGsytvDc276N5lNJcgFx9kqJFXFkv63rw/JeobRK:V0NpY7u59Kqek1y1DNcHJh1nvQeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686446788, "uuid": "0fc8d921-cdca-4b52-ae7f-b3b4abc6d5f2", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686446788, "uuid": "267a8c99-4c38-4a4d-a6d0-7cba279fbdc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446788, "uuid": "245b60f9-d18c-4a11-9942-45f6638720a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f267696f-0868-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686495733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495733, "uuid": "8ca3438a-1a12-4804-987f-735e2fab4f11", "comment": "Malware payload (Gafgyt)", "value": "a33e5f5583e6e1fec9fe04920dcc8391", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495733, "uuid": "5594c79a-3954-4895-9b45-71601823955b", "comment": "Malware payload (Gafgyt)", "value": "36050089cf821b058e3c3494ac9207c8bfb227fd5a576a2965e0f441fab8e997", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495733, "uuid": "fd14dd14-054a-4eba-b3eb-509419c250f9", "comment": "Malware payload (Gafgyt)", "value": "6d60ea8c94a4c36f9b342d25e38c6ba12340aa43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495733, "uuid": "bac4b9e7-a063-457c-9320-5100ed80bf75", "comment": "Malware payload (Gafgyt)", "value": "843d2e45d963d3d94894fef546a4a35939bebc0d4caea477808a71186e8e1566796a1ec5438a913c4f3d40e2c2754477", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495733, "uuid": "9a7e0058-96a1-4e4d-9a35-29cc1dd69302", "value": "T1B5836B23A651C67BC0875BF92BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495733, "uuid": "ccbc77a3-06eb-4233-a66f-adc0c673d2b8", "value": "1536:eB7cH1LhKlBqIKVhuzdPQq0aJP9sWtjG7ew3nnLWODPPmoIYuOVje+ZNne:eRMhKlcluzdPv0o+QK7eknnL1DHmrYur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495733, "uuid": "92836915-6c01-4dcc-bd47-73bdb0250250", "value": 85796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495733, "uuid": "a417164d-8600-4724-801e-cab91aea9068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495733, "uuid": "c794b1fe-040e-48f6-a256-277e0272878e", "value": "x-8.6-.Fourloko", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4351ee1-089a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686517211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686517211, "uuid": "2b503eeb-5ae3-44b8-909b-4053342a7459", "comment": "Malware payload (Loki)", "value": "baca046e0c5667c8f2781be323953335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686517211, "uuid": "09494b12-d606-481d-a7b6-69ca965a142d", "comment": "Malware payload (Loki)", "value": "3be658e5c91bcbded0777881592d53f65b182857a6dabf30c58245921272aae2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686517211, "uuid": "9414fb40-3149-4944-99e2-c3c27386e345", "comment": "Malware payload (Loki)", "value": "3ccd08ff28588cc26ea52a783c7202610ae832ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686517211, "uuid": "f0ea2cf5-2bbb-409b-9c7a-d49c416d3c96", "comment": "Malware payload (Loki)", "value": "14696a509d91b99cb05586727535e2669d73dd55b00612272082f015e7b1185a4c552d0e3e07b61b5543d8bbb49b8d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686517211, "uuid": "c17b81e8-43fc-4807-b47d-a1adf3cb5c4c", "value": "T1DE5523927C90C996F80506F26EF3C2A9A5386C240C1FB64735DDB7AFD636446AC0D6CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686517211, "uuid": "5a15d823-ab27-4afe-a0c5-1bffc75edd83", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686517211, "uuid": "1a291c89-86bf-418c-b90f-76a1c5d5ae59", "value": "24576:sPwOYizPEUm1z0E6G3VibpHIdebodR6jlKFtQVUv+iP8o79bO+3:sVxEUZG32poHRS2tQuWikK9j3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686517211, "uuid": "cbcafec4-0836-46e7-9f18-d7fd6905ae97", "value": 1317744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686517211, "uuid": "e9dd08bf-6e48-4499-aec5-294aa67e4a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686517211, "uuid": "df0793aa-709c-431c-8f9f-cd2edb447499", "value": "baca046e0c5667c8f2781be323953335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ff208d-07fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686449278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449278, "uuid": "e8486eea-fcd1-4ff3-aeb7-2820bb9d9943", "comment": "Malware payload (RedLineStealer)", "value": "8b5e163c4645fd9ea96e241706f2b5d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449278, "uuid": "2915500a-8958-4194-a929-7549ff490671", "comment": "Malware payload (RedLineStealer)", "value": "3d59c1b58d638d953978177f75eef3a731e5a315ae390ef1ad6f4f2864ccb9cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449278, "uuid": "a4801ed9-71b9-4382-9873-c5c80880fd2a", "comment": "Malware payload (RedLineStealer)", "value": "510e4c001cb98413acdb57c3e63f9063cf7c01f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449278, "uuid": "bef9ddcf-5597-4fef-8773-2a24ee844983", "comment": "Malware payload (RedLineStealer)", "value": "9980bb5956de5acb6af1a6137692c8374c3343351821f7525b21774351358c2bc66daed2204924b00801adfd8dcdfcc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449278, "uuid": "974b77fd-8d7b-4839-bfc0-4dd433200f98", "value": "T1C744F12139A1C432E6A7F9345D3983A4763BB8736932F48B7348176F9E312C1AB65703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449278, "uuid": "a2c469c2-c78e-4c3d-b579-3f36f2b507f7", "value": "5affbd003e86f6425e6f5983fd37fec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449278, "uuid": "2ed777cf-ec69-4875-a4c6-50bc9b806371", "value": "6144:HkLoYKVqCXwxrfcUVMAhpXkLVUW2lQdZlopQ7w7t:ELmVqCXw2Vvh/2sF7Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686449278, "uuid": "56c8b653-e2b2-4f48-82b9-2cc9e710aced", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686449278, "uuid": "90cadc39-3940-4e9e-afc8-16dc7adf5e37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449278, "uuid": "4f58338b-ccb0-408f-9aef-eb0396f8c546", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46495d3d-07f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1686446481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446481, "uuid": "b822915c-1759-4148-a7d3-a70be1225182", "comment": "Malware payload (PrivateLoader)", "value": "da7adaa57242edd6c3d836b3731c5c76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446481, "uuid": "ab1f8c38-bb83-4495-9a19-fc38f4c3b801", "comment": "Malware payload (PrivateLoader)", "value": "3d9d9746dab8d68d2149a28c8790910c9f0593a75bc42d61652b09ae97a3d691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446481, "uuid": "0b641d20-c09d-4419-b8a2-dcf88b7715d8", "comment": "Malware payload (PrivateLoader)", "value": "3cfb7ba031108a6dd3d840711ba31c5859af494d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446481, "uuid": "28d7e141-fc0f-41d9-873d-4b75e1d4c835", "comment": "Malware payload (PrivateLoader)", "value": "564a9ec76e8046756db7754f1616c8a3ba98c9379ec9facc7f67fe970da1852f48d5a985d36734e33919c2e27c73d461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446481, "uuid": "cf4fb19f-6103-44d4-936d-ef42f03b8ae2", "value": "T1ED86236323250141E1DACD3EC633FCC634F22BBE9F40987E16E9A5C62A759E5DA43643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446481, "uuid": "8ab24383-1176-487f-af6f-9ccd0a6dcb3d", "value": "00143c7843a6bccd9702bb42aef6cd34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446481, "uuid": "edee27aa-6527-4e75-bd73-dd5b6d03e454", "value": "196608:xkAVh0QLZY36FsVa2yJB59CyaWXoxBiV4DzCzTm0cySYxNHVA:xkAN1K7Va26Tkw4xBiCCf++HC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686446481, "uuid": "367e98c1-b0c1-437b-bfd5-20f39ecaa56d", "value": 7864024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686446481, "uuid": "9ab77616-0edc-495d-ab78-dbda9294ca4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446481, "uuid": "01d3a7fb-f081-445f-81e7-e15bd93d1584", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7038bb-085b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489874, "uuid": "cf0a19fb-343c-45f2-baaf-6e531db3802c", "comment": "Malware payload (Mirai)", "value": "a2b4ea23e73b913dc2b6d0607f7db3f0", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489874, "uuid": "67f58302-8896-4261-8b1a-300a3b675d44", "comment": "Malware payload (Mirai)", "value": "3fc33bd4334834f061d08f8ab7bfa7277072c83534be46ecff330a3e95e9a36c", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489874, "uuid": "feb7b1ec-1ad6-404a-ae1c-5bc96bc51712", "comment": "Malware payload (Mirai)", "value": "9f18c480d140015167695bf23d600ad294d4b23d", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489874, "uuid": "a918a163-0259-4d0e-a302-ffad5d297fce", "comment": "Malware payload (Mirai)", "value": "6036a44c11c684a3a5781f4496e24205150b40d8452269a6f3c2573d65654a7a785af1be23235be5dce6c8682203be61", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489874, "uuid": "8cd93647-6a21-4a39-aadc-ca7503854710", "value": "T12C21EFBBFBBB9A16C850913A4E63A3143660DC4C0015D26ABF617A1DDC126556F962F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489874, "uuid": "e84883e9-f61a-4f7a-9b98-efc80ebca8db", "value": "24:3jvDq3N0yTK99kGl8MAQOlhCrjSkvySJ9lonpNTawqFk:XWVTWLl8M5DvB9+npNuPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489874, "uuid": "5c25a2f3-a664-4080-be7f-2135cad46826", "value": 1272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489874, "uuid": "cfd9eac4-ad5b-4708-896e-b853bd038c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489874, "uuid": "3869d35b-8856-4bb5-b1d1-6c1f334667fc", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b8f257-082e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686470593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686470593, "uuid": "52018149-c1a0-4bab-a362-b315fd56fa77", "comment": "Malware payload (Amadey)", "value": "515d84ebb2bb662bb9a1dab1fede8402", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686470593, "uuid": "9d97fcf6-f982-4253-9b02-eb37ec986358", "comment": "Malware payload (Amadey)", "value": "45d3214bd87ec6dfd30e5a1d44801939645f795f48a3eb5d6fdd04fc628e14ce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686470593, "uuid": "35e2aa52-361c-46a3-a7f4-354fc45e5b68", "comment": "Malware payload (Amadey)", "value": "890dc2bb60ea6fcc045815c27f2dcc978fcc2819", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686470593, "uuid": "72ce5f01-f75f-4bd2-872c-eafe2757f038", "comment": "Malware payload (Amadey)", "value": "f7cb52a08d2063dbba6c5bc43251bdee2786ee10389ee5991fe9a8b78aeda3a996aae9ff9241695dbe0dda063ad30c0b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686470593, "uuid": "ef2956cf-e68f-424d-9fb1-c7641f9ca78c", "value": "T17405234397E980A3D8B11BB008FA079317327DA1597892672761F80F5AB3784F93677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686470593, "uuid": "c6b2ab98-8fad-4796-a45e-066f8f24923d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686470593, "uuid": "f4dd5e3e-8e57-4b82-96cd-cea339a99bfb", "value": "12288:jMrKy90zf0CDW9Osw5jRucaBsPQoGOqI345lnJc8dLlf7QCkhdttYIdVg8k:1ydJwucai9GUo5daIf7QxjdVg8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686470593, "uuid": "02de9ce5-4ad1-414e-8beb-13ee6eb6fd5d", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686470593, "uuid": "a2be14a1-8d67-49c1-8591-06a13ab9231c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686470593, "uuid": "1195f81a-0610-4be2-b06f-9d7d4d59a043", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125f672f-07fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686448971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448971, "uuid": "5ac122e6-f8d9-423c-8a60-9871e1dec7ec", "comment": "Malware payload (GCleaner)", "value": "fdb1209f7a56e5a48d63a3fb1c4bd09a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448971, "uuid": "2942b733-b2f8-4a0f-a689-a7660963810d", "comment": "Malware payload (GCleaner)", "value": "477b4c4a0b4a95ad547b7dcbb4285b2d11775d10a31be8a10d1d0e82f55ac40a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448971, "uuid": "ffa5d45b-cce9-40ff-a1f3-3d404b47d890", "comment": "Malware payload (GCleaner)", "value": "7ca49bd5c1151ab65f6b95a6b2a2eaa760f505c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448971, "uuid": "ade72e84-fb8e-44d8-8386-873a06759d4f", "comment": "Malware payload (GCleaner)", "value": "a05d4e03ad7f5f6b833782e266117a05123c7860db764cb6e379c24b3c40b200802650a6703d3dd0c2eba3a5a4e4ca2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448971, "uuid": "4659b8c7-18a5-43b0-8bbc-66da18da81ab", "value": "T1C99522169BBDFA24D0A848F7AF9114CC723C56357BFF451B68F7E94BC4A99043D2A208", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448971, "uuid": "d6ff6572-40ba-4799-9bdc-0b0fd10501d0", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448971, "uuid": "10ff8c8e-d12a-4f9e-85ae-99f69dc68065", "value": "49152:Z6dd6sPi3Ci1bWnGm7rDo+E6eTuVf8lGF9jFxw8+TKj1g7Ir86:sdYsajshrOW0wZ+Ti1g7j6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686448971, "uuid": "f94b650a-d7b2-4a90-b921-4b6fcd56203d", "value": 1989550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686448971, "uuid": "564f9187-243c-4e0d-8a06-0d0a1d2961e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448971, "uuid": "e11e4026-6535-4d28-9b2a-47f43ed3e8d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0096270b-0870-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1686498763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498763, "uuid": "f8ef482b-bb7b-46f0-b8b3-4c5b303a3188", "comment": "Malware payload (Stealc)", "value": "8bd071440f97ec644d62209ef6820196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498763, "uuid": "e9cdf65c-48cb-4dd1-b97c-06cded2d598f", "comment": "Malware payload (Stealc)", "value": "482e5fe773d626bf512eec924c456ff4ad0514da396a9bc5e3e89ce2f86e7472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498763, "uuid": "8e819e91-4fd0-4c8b-905c-2330dda50f5f", "comment": "Malware payload (Stealc)", "value": "456ac28af0b415c227f5f2955db29e31fad75226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498763, "uuid": "c8a19630-33cb-40dc-a6c9-95acc321cd59", "comment": "Malware payload (Stealc)", "value": "10c044783abcccd77891853f4f337e989704cc9de98c215bae551b970db0fb64abb45e6868f28e0b6498ec07fc807e47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498763, "uuid": "987003ad-fe68-4412-891a-bc44bdec2636", "value": "T112753A1263A89515F5F73A319DBF08E81B327E22EC75D51F22907C4E28B1949AC72B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498763, "uuid": "99b9c6c2-4e36-44cf-8cb0-d6710e526666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498763, "uuid": "595f7368-f0d5-43eb-9d50-8f2a1b017bf5", "value": "24576:J+QW8OAPxWCUYrTzGbg+QrWPre7r1RrdirrG:cQTOAPUCUYrTzGbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686498763, "uuid": "84c1e37b-51cf-42eb-be64-a0ca2bb80742", "value": 1559208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686498763, "uuid": "b6761690-cf2b-45d6-bfb7-5a815dbfe6e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498763, "uuid": "a4ac273b-89a6-4c43-841f-276fe99fac6e", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad1ddbf-08a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686522912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522912, "uuid": "06090ef6-4252-400d-9b88-ccddcbfb3b0a", "comment": "Malware payload (DCRat)", "value": "bd405c747252120fe56aa8734d40df8b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522912, "uuid": "f4a0a508-f641-4627-acbd-01542a383f0c", "comment": "Malware payload (DCRat)", "value": "4ae98d07149ba3a2d9e00594f4da6e65c0386a6e95c0fb168a05607cbb0d2a65", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522912, "uuid": "54b7bb02-13fa-4381-bf05-cd720a15e92f", "comment": "Malware payload (DCRat)", "value": "e11ae735a5d76f19b1ae0a65bcd052af7ff2ad25", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686522912, "uuid": "19c44d48-b964-4956-a0ce-64bd490a0eda", "comment": "Malware payload (DCRat)", "value": "e9eaa060fbc7ddc23031b5e75790d4243daa6103c1671f95d12cce8601a9cd11d85d2da4c7eecb74e35a8bda35cad4e9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686522912, "uuid": "bb91f239-500b-4db4-9c28-bf12539e1987", "value": "T194952303F9C5EDF1E4621C3256196B65757CBD201F698FEB63D82E6ED9211C0E3322A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686522912, "uuid": "71aeb0e8-cd30-48ef-96a0-bdb2f5fb4364", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686522912, "uuid": "72187b32-967b-4c47-a3f4-8b30ece02c7d", "value": "49152:ABRhIjunt9Tj8sgDwKynOnMm7FM0RYB6XWaXyewLI49:aU6XH9nmlRgcyewLI49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686522912, "uuid": "56689ec8-2796-4ca4-a3d4-e7d11c5aee1f", "value": 2057875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686522912, "uuid": "6cbbd856-c6ec-4012-95e2-f7bb89a12b89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686522912, "uuid": "28286c6e-da2b-4c47-ad50-710a2c59ac0d", "value": "bd405c747252120fe56aa8734d40df8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a73815-0845-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686480565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686480565, "uuid": "3f7c2b3c-dbb5-42bc-97e7-0028c07b308e", "comment": "Malware payload (AgentTesla)", "value": "78d89f704eb07583c68b99e569b8f019", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686480565, "uuid": "0abe9fff-80b1-4db0-810b-2da664a5504b", "comment": "Malware payload (AgentTesla)", "value": "4b0f3dd16fcd416c9cdcd55e292a5a04ee6c1114e99935118f375f10ec48b5bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686480565, "uuid": "5a831412-ae2c-4624-9f04-ad949fed6062", "comment": "Malware payload (AgentTesla)", "value": "a0529dff3de2fe92a2eedcb323340d23ee8f4a06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686480565, "uuid": "496eeebd-bc93-4d25-b789-8be703dbaf73", "comment": "Malware payload (AgentTesla)", "value": "2de62c5ba7e7150941e388509da0b6d478a21f183dc5767f25547217741d15cb0ed53e800dd7200422c21a3168a3fd52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686480565, "uuid": "e3491b2c-d659-4ec8-9240-8aa8627d6715", "value": "T10305F149B6BF5F2BC436ABF8023051305BFCD955602FD64A8ED361DBA564F702A81B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686480565, "uuid": "7ee35480-43b6-4042-ab1c-af14c1601b89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686480565, "uuid": "f895318c-1b8b-425e-9a87-f0210a6dadfd", "value": "12288:Rx+OSUAh3NVbJ2iNa7xdvo/MdyrhFgtDsuBHsSj5J4+saBGQTvVxJxz7g8vsTuPE:O1U9BqmycgiH75BDPjzhDPDuoVvOAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686480565, "uuid": "52b8c931-98eb-4213-ae8d-a94f18d635d5", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686480565, "uuid": "4c77b58d-5981-4737-ba09-8188d82a3ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686480565, "uuid": "f6cc8c06-dbfe-4970-888e-c3bf2284c754", "value": "78d89f704eb07583c68b99e569b8f019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a70375-0867-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686495067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495067, "uuid": "3980ba14-d9a5-454c-afac-fda5d14bc5f2", "comment": "Malware payload", "value": "48355893660d924c8c886324b6f86618", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495067, "uuid": "6c892cba-b6d8-4aa3-a018-f71d745d2222", "comment": "Malware payload", "value": "4dfb81503889ade0369be0f32b3a14c7892e21e5b4e5e366d02a2dbf3ec8a2b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495067, "uuid": "d0f738f0-accb-4f23-9eef-a83bc9477e7d", "comment": "Malware payload", "value": "a8ec9e5df2d8ed8240f54c882f35e28b4063f377", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495067, "uuid": "c30e912f-e63e-4365-9ed0-b9faf3dbef65", "comment": "Malware payload", "value": "16ed86436a2287813d6034fae1cfeaeface8675d9825edf0932499ab288de95f790068fc775166589a79a2ef75dd8439", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495067, "uuid": "865a5187-b59b-4809-a22e-ff7067e33eb7", "value": "T1ECC3955AA761CEB7E85ECE3B069A450110CD9D4A02DD6F2F72B0F61CE3AB88E45D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495067, "uuid": "40ebffe2-c6b2-44f7-a2eb-1232c7ef869f", "value": "1536:umSoeTABpDae/NfeKOpyzLZ3UX1y6wo7I/LbXj+vg8:uMvfeKOp4LrKqLbT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495067, "uuid": "ae8a3627-b465-4e36-bf48-2331743b4f96", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495067, "uuid": "edd37e91-b648-4292-afc0-76e17dc002ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495067, "uuid": "f830d25e-22ce-4184-a53e-461147e5dde0", "value": "48355893660d924c8c886324b6f86618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4063f0-089d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686518112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686518112, "uuid": "2e50f812-ebea-4092-86d5-001ad1fd9edf", "comment": "Malware payload (DCRat)", "value": "bb1ef2ca98ae809bf836c6f1767cc426", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686518112, "uuid": "662acaf9-2cd5-41c9-b109-97a5d5faafe3", "comment": "Malware payload (DCRat)", "value": "5232c6db5c412780ace4c035be6bde85e2ff91f4d5699f849b028939dc39cf74", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686518112, "uuid": "2d8285ab-b754-43ac-82a6-628c06792632", "comment": "Malware payload (DCRat)", "value": "3ec5f3acbf39a52ae978cfe6d440090e6e7e85d6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686518112, "uuid": "d032ae22-6568-4701-b6b7-4aa72cae64af", "comment": "Malware payload (DCRat)", "value": "962e9a509d5f2990e14529c4299c66d4434ccfea16a59be3b118543a9096a8f096ea5ee94c7546b27ae134929954d019", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686518112, "uuid": "1a5190a0-9098-47e9-982c-1f9e4db85c0b", "value": "T1CF05F7027E44CE01F0091633C2EF494847B9A9516AA6E72FBDBA376E55523E73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686518112, "uuid": "d9c19642-3642-48be-af1b-64fa00892cfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686518112, "uuid": "9c40d5ae-eb7e-4367-b0c5-66b89fb52300", "value": "12288:tuSciL28Yzhe9iolOGbdUUd+3JQvv0Iggv0v/X8qnNLblqR:tciL28Y+iYOGpUUd+3HIg3nNLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686518112, "uuid": "451f4fde-2e66-4518-ac4f-5d935365685d", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686518112, "uuid": "81b0a1f9-67e8-4e66-a1d8-7e71b4121ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686518112, "uuid": "a86bd73b-d77b-4962-9191-a68fa11db20d", "value": "bb1ef2ca98ae809bf836c6f1767cc426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a26fcf5-085b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489840, "uuid": "bc951162-7c49-48af-888b-fcdf16d611eb", "comment": "Malware payload (Mirai)", "value": "311c1ac7fe3d90f88101dbc0b198c2f5", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489840, "uuid": "78770123-4bbc-4722-b9c5-bf7769d4129b", "comment": "Malware payload (Mirai)", "value": "574bbcdabd4f14af4295b92a2aeeaf0ac1341d555f34e9e9d258880a7712d325", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489840, "uuid": "18cdbe14-5592-471f-af68-0d5a6df20adf", "comment": "Malware payload (Mirai)", "value": "2cc5ec957801c3179af3c73359230397f2055e01", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489840, "uuid": "fe1b7534-c18c-42a8-baef-6597517f36fa", "comment": "Malware payload (Mirai)", "value": "7e44abc81c013c38d55f3832d6e1134237bb893914fda56abea035d3e1b94e161d2606ddb3e687d3f68683fec843ba48", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489840, "uuid": "7c41b523-3dde-47f9-abba-5ba8c1db7370", "value": "T16721A64AF3492D8FD9A76578582B023A34307A5AF4139412E36A8E3F7E7B5D4121A18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489840, "uuid": "dcf2e48b-569e-4c31-aa18-7d4a13b9b06b", "value": "24:38jaAa8DzSWPpbP78Pwy74+CibTHEphHoJbDD8ECAfGLioxjiVNT1tCQ:MjaApP3hb/mVTGhIJbv8DAff5VNhtCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489840, "uuid": "7fa08ce0-574a-4b22-ab92-5dbcb41c0d5d", "value": 1248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489840, "uuid": "1c97932d-2883-4a87-9fb0-096b5fd75741", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489840, "uuid": "a326f0f9-77bc-4f3d-91ff-33e6dfb13ca6", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1abdcd-0815-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686460044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686460044, "uuid": "27c5a3e8-e3db-436b-b7d7-6e9895f4de5e", "comment": "Malware payload (AsyncRAT)", "value": "a56a9082d19e43fe06be3b46a7adca55", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686460044, "uuid": "3ec88619-b936-4dcc-a4d0-372769e21dc3", "comment": "Malware payload (AsyncRAT)", "value": "577047181197a34939a106666deec71d3e91e386deda32d412ef1e8b3de2b000", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686460044, "uuid": "e5971d87-9bfa-4b4c-9c5e-d6e872c410f4", "comment": "Malware payload (AsyncRAT)", "value": "c9ad80fb107156afa8170a3dad55c3c078f4eb83", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686460044, "uuid": "30ec26fa-eeff-456c-b95e-e2e697ebf036", "comment": "Malware payload (AsyncRAT)", "value": "1067461e5c7d65094a56d64c91718a4fa47d7bd9eb894d1f3f9e06c7406d7b43dd4589e7052cdae5ba1175377d16c662", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686460044, "uuid": "bc264a15-3d32-4295-843d-1d8028d5cd0d", "value": "T195233C0037E8C12BF2BF4F789DF26145867AE6633A03D54A1CC4119B5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686460044, "uuid": "dcc24c01-b7d4-48e4-9c33-3be2023ca568", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686460044, "uuid": "7d6da095-7e26-4a60-b2de-4896795d33d7", "value": "768:jum81TQwtPtWUN01nmo2qzz9Y66fvPIAzSb/gX3iNN4+jVP3w18NqaBDZ/x:jum81TQq42sKSAObIXSv4yVY6NqEd/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686460044, "uuid": "7adbd9f8-a14a-4c1f-9292-e23fa61bddc3", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686460044, "uuid": "7f7ea1f2-82c3-498b-8306-7d4ab3b366f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686460044, "uuid": "5d609474-9e58-4fca-b476-2647b1236ce0", "value": "bNwG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1db1e1-0811-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686458118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686458118, "uuid": "f808f33b-a2cf-4e25-a4c2-d5773e2af94c", "comment": "Malware payload (Loki)", "value": "3315bdebdc17d6688165fd98c0c5209c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686458118, "uuid": "a13e5926-1020-4374-befd-77bdfb673ee8", "comment": "Malware payload (Loki)", "value": "5fc4a212a633dfb96b0e8150b822599ce2e49d63f016a8af9ca76870e38f7513", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686458118, "uuid": "f0926f65-1396-4f69-a091-dcb95dc84e20", "comment": "Malware payload (Loki)", "value": "3140298ee33bd081403bd32852d090f1bee735f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686458118, "uuid": "d02c910a-af92-44e2-8824-572fbc8362b9", "comment": "Malware payload (Loki)", "value": "4c99224bcd379dc682cc2b17b20067b62e708ea95fdec71ed9d2aea3473c0f68b665ac565645732abd6e60b9f924c56f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686458118, "uuid": "b26cd4af-9762-4454-96ed-27d083cfe49f", "value": "T1EF54F71393A17C54E53D8BB38F2EC6F8760DF6508E797B692219AF2F16B0072C263651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686458118, "uuid": "357cf113-59e8-4ace-a453-7d1385f42370", "value": "af40ca862bb560756a6239b041d2950a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686458118, "uuid": "41bc208b-5188-4f16-9798-1a7bbf006c8d", "value": "3072:QnIMJUNJ1Nz/OExSRIlsxCK0wKtHk0fg8DpdfF6akV95XR0s27HmJt:1MJO1Nz/OUVsxtoE0fgyAaK95XmmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686458118, "uuid": "23872f6c-9f6e-4f99-bb51-a266d89c75bb", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686458118, "uuid": "a6998cfc-dca2-49c0-bfd1-701fd1f2ac6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686458118, "uuid": "d70f15ce-ad0a-4802-8557-e6d691c7b1f2", "value": "3315bdebdc17d6688165fd98c0c5209c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61469d44-07fe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686449963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449963, "uuid": "82f2da3a-aa6c-472c-af19-100f79f0dac0", "comment": "Malware payload (RedLineStealer)", "value": "08df7718b8097e002547816c846e3bb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449963, "uuid": "1ac5ecc5-0532-49c2-a0c2-d93facd3a174", "comment": "Malware payload (RedLineStealer)", "value": "60ba317c673641c96c24921d5908169b1eb27ae2aff2e0cb1d5aac43d8e3aa47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449963, "uuid": "b8ed61ef-eaa8-41e4-8c6a-86af61372735", "comment": "Malware payload (RedLineStealer)", "value": "14a7a0636065745eb4cfa91e06ef945b1e903d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449963, "uuid": "8a7dbc18-9bb2-423b-bbec-7090c0428eea", "comment": "Malware payload (RedLineStealer)", "value": "1e3ae587822f7a832569ba075060edba8b66be0a153dfc6a9d44891cae65f3ef6d7bc2b39b6ae463ea8f9ac2eeef8030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449963, "uuid": "20f9f3c5-cfe4-4909-8b05-bccbc72ffa82", "value": "T15B54E0207AE1D437E1A745345934AEA02A3FBC72AA74B59F6314162E5D32781FE7230F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449963, "uuid": "4af1828f-7839-4a40-969b-6bdd78e41bc8", "value": "5affbd003e86f6425e6f5983fd37fec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449963, "uuid": "06b3cb15-0693-41b0-8223-4c22b1bec8b8", "value": "6144:UdhvWEKhB2sEyEg97M5XKnAtt60KxcKtpu7weCkSmbqjS5TUst:e4x2fyEg9S6nAt60Kxt0czmb2SFUst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686449963, "uuid": "38df1070-c276-4009-b3b9-0b87eac21c70", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686449963, "uuid": "d4e6214b-26b5-418b-9585-367406cde3a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449963, "uuid": "c2d359e6-0c3d-4982-a004-10a1043c6735", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d90497-0853-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686486484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486484, "uuid": "fdaf7e4a-eadf-406d-9f84-da14694ef044", "comment": "Malware payload (Mirai)", "value": "77409655cd0553157cbb90ce889c0185", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486484, "uuid": "c9a4030b-25ce-4922-a812-b313f83b7422", "comment": "Malware payload (Mirai)", "value": "622b179bde8905f28d494c769bffa504d91c727e13450502a5799f297fd9ecef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486484, "uuid": "9d334a93-850c-4bdf-b275-03426572315b", "comment": "Malware payload (Mirai)", "value": "35743ff107541075646a60f62dcd9ae076e478c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486484, "uuid": "92f17eaa-2ff0-4c7e-a220-fd9c3f09dae2", "comment": "Malware payload (Mirai)", "value": "c74561f79534b374459cacf664dc781cb51aa4863f677fe3593367714d8fa3c9644d2498b961ef6f1d570c11aadecb95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486484, "uuid": "9df6eb1b-b33b-490e-b084-17fe79f5fde0", "value": "T14AA30896F900DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486484, "uuid": "a7466712-434b-4ab6-8334-38e859b5ecde", "value": "3072:nkrWBIvC/IymEdH8ffc6OKmuxVqDr78fz1e:nkrWBIrym+8s6OKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486484, "uuid": "8a1ff3c4-94ad-47a1-9c14-1ec072dce2cd", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486484, "uuid": "15254124-0878-4151-9241-e38adefc7594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486484, "uuid": "5f1ff388-56d4-4295-8983-1c6bd029b90f", "value": "77409655cd0553157cbb90ce889c0185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2fb165-0869-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686495935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495935, "uuid": "e7031252-83be-4487-9f32-e7a7efe3bc74", "comment": "Malware payload", "value": "b1bca20c6171cc32f2c767215a93d165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495935, "uuid": "f8b3e193-af00-4423-97ff-9afd149149a0", "comment": "Malware payload", "value": "640c3d2a72f210b142708e9736720f021308f5566a8177caf44fbdc2bd034286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495935, "uuid": "bf5ac2d5-bfe8-4071-983e-7beaf4e516a4", "comment": "Malware payload", "value": "1858f21e9067c427e43d98d6b37bd78d2fc8e216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495935, "uuid": "ec37951b-2401-4b86-95b9-4fd228b6cf09", "comment": "Malware payload", "value": "4107b23b4b3db4b4e9f952bfca8ea89a1cb48314f84f919a1b8544aff3dae130f9fc3be776d2437abd3dc6bc6b46946e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495935, "uuid": "d7d1fb17-958d-4297-8967-6c9982e2d8b5", "value": "T1BFE33B09EB408B57C1E2277AF7CB425933339B64A7DB33095928ABF43FC27994E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495935, "uuid": "3715b459-667f-4740-818c-e786d21be3e4", "value": "3072:bBnEaZUpFYZ6qAllzRohWinnFEM/9WKmpwfvRQfZn:blEaZUpFYsqwRoYinneM/9HmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495935, "uuid": "f6a7b28d-45d6-49a2-82c8-c4f4e495bb00", "value": 150386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495935, "uuid": "da5c7005-1246-4e12-b0b4-e5f605b7d8e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495935, "uuid": "bfdbba3a-1589-4f6b-8e27-46565652b7f5", "value": "m-6.8-k.Fourloko", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f88ce3-0867-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686495071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495071, "uuid": "12a1accf-fea1-4da8-ad02-98a42f66a5bd", "comment": "Malware payload (Gafgyt)", "value": "b34fef0f62fe9e855ed7786f25b9795e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495071, "uuid": "4ede5b57-ef0d-4759-b565-ddbfe675cc53", "comment": "Malware payload (Gafgyt)", "value": "6865ead2ca8b0c6ef05863b81e8d08dad19258e427ef1eda8fcacf248269d0cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495071, "uuid": "75b9ca51-6617-4e5d-a93d-c5421b4162c6", "comment": "Malware payload (Gafgyt)", "value": "5822aaa5cbd58f1f6968923311f3d7cefffa022b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495071, "uuid": "04745a06-4936-4747-b35b-ce71e7e63dea", "comment": "Malware payload (Gafgyt)", "value": "43451a957c4fb786a796f01825a4174c72540a77afbabc8178949a758ba6b6e71517435d59deb715f25bf2418a876f73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495071, "uuid": "80ab4066-3db5-4d6f-a611-af1458546f63", "value": "T18393D604ED505737C2D23BFAF79A42CE77351F986B97334196283AF41BE5B982A39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495071, "uuid": "74f40613-c74c-4c38-8b06-26f04972d58d", "value": "1536:FSyqHwbRuW1i4sB9xQMOvA9dHB1WoAgqWhQaaZiJBU1WhRYP3fH58uPMJ+f6/H2W:WwbRuW1i4sB9xQMOvA9dHB1WoAgqWhQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495071, "uuid": "bb49647d-98c1-44ef-bcb3-7a828520be22", "value": 95137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495071, "uuid": "596f50f5-e401-4eb2-9085-ecf399a9ccaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495071, "uuid": "f087c510-d3ba-4733-b10d-aa16a74c0821", "value": "b34fef0f62fe9e855ed7786f25b9795e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f122a73b-0800-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686451063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451063, "uuid": "19381db5-b99d-4a0b-9013-a0ed6f0f2a23", "comment": "Malware payload (Stop)", "value": "444f82987cae67f656766e9dbf7e7efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451063, "uuid": "206d5865-c710-4843-a271-7dc79db68af0", "comment": "Malware payload (Stop)", "value": "6aa6a0e76e939a500e9bc22484a40d747e769b441843b37abed7155f1060cec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451063, "uuid": "cdff5cad-d36a-4578-90c5-7c561334d28b", "comment": "Malware payload (Stop)", "value": "66390a69f5bebb68cbdffe172697c2ef22edc94e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686451063, "uuid": "aa029913-048f-4cd5-9324-e164b980227a", "comment": "Malware payload (Stop)", "value": "dbfb2a5e0f9d2a3b8c1ddd31ba45a10b4ae1da079895cd564b30017270dadf0d8fec53f11a2af9aba3c14dac8958b314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451063, "uuid": "4285cf15-a522-4943-8533-08bd64179d4c", "value": "T19105C013A2913C51E9254B329F1FCEE8364DFA508F093BA66A19AA1F14712B1C573F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451063, "uuid": "b6583a78-908e-4acc-9bb7-7402d7a50fc9", "value": "ee55eb48a3e3a4949e7507357f34cccf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451063, "uuid": "44de3a2c-8431-4739-b80c-e873aecec1e4", "value": "12288:RqphXaHnG1WFZO7AnD6qAKcqs7JexAKEwNLV84IVneBf:Rqpyn0WW7UxAJJ2FV8LVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686451063, "uuid": "5b325821-f147-4dce-89ab-a3a6815218a9", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686451063, "uuid": "f9193145-d9aa-4200-8dc4-a44d2f04ab79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686451063, "uuid": "e025dd03-6a97-4194-bee3-2d8c6d457dda", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4048952-080b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686455712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455712, "uuid": "811c5e81-239f-437a-9de5-ba7eb9876348", "comment": "Malware payload (RedLineStealer)", "value": "d1db399e6997353e59d214f6792f65d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455712, "uuid": "96fc99fe-a5b0-4408-b0a6-64f8e6a86b67", "comment": "Malware payload (RedLineStealer)", "value": "6d5a2559bb7746c65925047e2dc5894ac61bbfca0a8f3b100cff7ee49b191c16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455712, "uuid": "c3ed93be-08f8-4609-af46-f15cb3863c29", "comment": "Malware payload (RedLineStealer)", "value": "d8775602bd950a718af8dc702ffa39901603250d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455712, "uuid": "3e2d414b-2495-40f4-83e0-06b080a7b4eb", "comment": "Malware payload (RedLineStealer)", "value": "3a303140d72856f10bcd24bc9973939f3b520939a8fbe07e263d4be31b7c4e659639600618372a880101a29ecb0a2de8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455712, "uuid": "082c9bd0-4106-45c7-a675-39ac7aad435a", "value": "T1B6C41222A7E4A473ECF627B04CF742D70736BD91493842AF2345AC5A0CB2795A4357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455712, "uuid": "1c723553-35f6-4380-a00b-845639fcb624", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455712, "uuid": "2867e628-50a0-40f3-b504-dfac5909325a", "value": "12288:iMrdy90fy4PFsMYpvVZ/bjrbcnIfcMm2qt15:DyYyYoxHcIHwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686455712, "uuid": "5fbbb160-a850-45c6-81a3-21d9a5a7b294", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686455712, "uuid": "61c5f234-4571-4704-9508-275d92d3be97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455712, "uuid": "0c248d47-eb73-4e29-9890-e59378bf4d96", "value": "d1db399e6997353e59d214f6792f65d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7c8084-086e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686498090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498090, "uuid": "34dd2766-ba76-43f3-be93-3fd5799a2eb6", "comment": "Malware payload", "value": "7f426b327c878f799c74bb4b8a532cb3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498090, "uuid": "a073cbda-0c92-46f8-8842-3065aab62030", "comment": "Malware payload", "value": "71b24f92a597f6eaab7a64fd53008a8b29eab8c48e32d45caebcc56baf15fcdc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498090, "uuid": "495567bc-75b8-48cf-b48e-8269517696ca", "comment": "Malware payload", "value": "0315cc83c6d781db16e7e34d7efc5e2fb4db4829", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498090, "uuid": "f923171e-0e07-4ebd-954f-5427c2a8049a", "comment": "Malware payload", "value": "4f6a211d4fbee406c679d2f4765fdc584be30a054a5eee687cdf582f02450869de4226e970f74849c617806be232cef0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498090, "uuid": "b641dd9f-2279-42ce-8c15-fc63b086ce54", "value": "T1704612FD6288375CC41A8D389433ED1872F7522E06E995EAB5CB7B907B5B811EB42F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498090, "uuid": "6e3ecc2f-ae6d-43ed-83c5-43da7b894bb1", "value": "1c4dfdba330f9207b50c6b2051ead1e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498090, "uuid": "53a21471-01fd-4acd-a4d8-90eac2a16144", "value": "98304:683d1dL0L1ClJNCsIPi+sSS/DU5+WWsO77LENBn0fVIXp/+:91dL0L1ClKdivSUUgWWHLENJSGt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686498090, "uuid": "c3aad700-f33a-4752-b583-898cb69f73b5", "value": 5621760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686498090, "uuid": "38ccd0f7-e979-4efc-a31a-7dc4271db8d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498090, "uuid": "77f32289-5313-441a-8f8d-97191da34d69", "value": "7f426b327c878f799c74bb4b8a532cb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ceef843-07ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686442117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686442117, "uuid": "6a8088f1-3684-4645-b1e5-543538be5883", "comment": "Malware payload (Amadey)", "value": "13499eab406c0a48dcf39dda4aa38e19", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686442117, "uuid": "786f79c5-0721-4064-bfe0-ce9402753d63", "comment": "Malware payload (Amadey)", "value": "74398e2525fb40b7bcbb7be1db8c765d33257cacbabbf44d38d5d7c387ea0958", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686442117, "uuid": "400951ea-e00b-4d99-afef-c0f149ceb8a7", "comment": "Malware payload (Amadey)", "value": "7bde52bbb83557923b367462cab76b484949c4fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686442117, "uuid": "6368a2c8-b7b5-45b1-b176-3140f04968c2", "comment": "Malware payload (Amadey)", "value": "e7ca79b1e5a26ec51ec85700ea580fe8a3ccf044d7beb99fb324f6a650a284349e15e359aeddfa812b0f41dd0491020a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686442117, "uuid": "7203ba1f-e0a7-4358-8944-3d61721f135f", "value": "T1D6F41212A6ED9573DDB11B7008F703831E32FCB15E7986AA27869C5D0DB26D0987273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686442117, "uuid": "02b9a2bb-ee3e-4efb-b4e2-745f57d2b680", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686442117, "uuid": "a97e1bbb-9341-411f-9a10-efd5b930b4a8", "value": "12288:kMrKy90Hsvj1Z520YjN4f0ggFgcZH2i1IlnBTKIyYjLXX/tLMpviwEFmTi33X6RR:OyTb1ZM0YjN4fAiU7IGIyWLXVAnEFmTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686442117, "uuid": "85887a5e-95eb-48da-84fa-ca50fc574682", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686442117, "uuid": "d06ea837-af9f-49fd-86e8-eb2735ced389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686442117, "uuid": "c0363a67-b300-4f17-bd25-360fc288aa70", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5044ca7-0867-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686495308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495308, "uuid": "9ec818e7-e0c6-4545-9543-33855325011b", "comment": "Malware payload", "value": "97766321ced9ea9aef4ef8f997a0ef13", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495308, "uuid": "62332c03-39d5-4cb9-a581-e2b521a61e68", "comment": "Malware payload", "value": "766269938d1760e4ad0d6a3f4c1afd02b0b5c69d9d661f59ff4b6df0e22e0e54", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495308, "uuid": "57f9f377-f37d-4948-b367-f739a106fa71", "comment": "Malware payload", "value": "25970fe30da32ccde331e9e05bec1e6f02ebe219", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495308, "uuid": "abd776c2-de4a-4036-b773-27bb6a0f143d", "comment": "Malware payload", "value": "a8d60c8e46c1201d20cfee60396faeac084d912987cf454cbc92789ceaabb10bab93e84c38e5c4492058fef0d38ea767", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495308, "uuid": "319e8696-64f6-4724-baac-c79956f65e20", "value": "T1E8C401143F67CD909B7C66E878EB97078B2766B3E5CEDF070AA28534092A96347510CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495308, "uuid": "a6c3483b-3318-4b27-b321-f3cf8e976446", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495308, "uuid": "68479f95-3e6d-4ae3-b1ac-0008797f69f5", "value": "6144:yObXYHsxAnWMos+xIp4lkkL7BUjyNruN4mjZIu7UVKY8lfDei5RP2cPqYHTq8+dq:yKYHX/ozHL1UpNI+iRoDb5x2cPAdd6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495308, "uuid": "61af1010-a86f-4de5-a4be-70b21697aafe", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495308, "uuid": "c5c7a76f-c7f9-4c16-b90a-8db08d0044d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495308, "uuid": "4c305dbb-b346-4e3d-bb1c-d171ea303ab5", "value": "TABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZsUHNJ2UBF6n0LONizJBG1OiU97S2VzWjHPIGRNd9S4LJwRfDZIZAFFEli4FdHCTYMIMLBVEHpDK.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7672c902-0853-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686486505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486505, "uuid": "a86d5d10-8024-48fa-842a-85d7eeab5ffb", "comment": "Malware payload (Mirai)", "value": "92d01a5c4007dcd0fee6725d1c25d325", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486505, "uuid": "cf3e2a32-9259-48c8-bee2-918e8a0a59d6", "comment": "Malware payload (Mirai)", "value": "7745c1363b18ba8c0c4309a5ac7feb3438976a7bc6f0f80cdeb0edd2e809006a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486505, "uuid": "4b733896-faca-4963-8a30-602a2dd29832", "comment": "Malware payload (Mirai)", "value": "fe4943f51348e900f73d4db54bed444aeafbf0f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486505, "uuid": "ee216ea3-eecc-42ad-81af-2b5cc6c14a03", "comment": "Malware payload (Mirai)", "value": "99c3e8b38eab61e5fecdef6dba15f422b3ead900317feba8f3003a0a17683038d28929f4d8403d47fe42395cda821086", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486505, "uuid": "404dcaee-f5d8-4470-962a-4612179f6e5c", "value": "T192A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486505, "uuid": "eed4f955-eeb9-4052-9810-6703086afa94", "value": "3072:VSx+i6mqaObhNXnPNKV+qKmZuqQ4DPwXXtse:y6mRObnXnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486505, "uuid": "a708362f-8dd4-42b7-b1d8-c0ca3a9b940f", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486505, "uuid": "5751cbf3-fe57-40c1-8f56-3e03a85a108d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486505, "uuid": "f1be5b57-bb76-4903-b3fe-a53f79d7f7ea", "value": "92d01a5c4007dcd0fee6725d1c25d325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fcce71-07eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686441828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441828, "uuid": "22eb9e44-33bc-44fc-91be-84eb47cd6839", "comment": "Malware payload (RedLineStealer)", "value": "69e5de139eb3051d19465a47bc699e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441828, "uuid": "0616be7a-6f90-40cc-9a4c-541a44d5d498", "comment": "Malware payload (RedLineStealer)", "value": "781f1889127e41857210f858c8b4de1d17a25c40e35a9ee250ed17149e24b28f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441828, "uuid": "4842f546-b392-447a-89a6-69c9eb830e3e", "comment": "Malware payload (RedLineStealer)", "value": "369c5f40c18259bcd42cfdf58bcf307c4b9a2b9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441828, "uuid": "0cfce0df-5ce5-47b3-a1bb-9aa6b56b4806", "comment": "Malware payload (RedLineStealer)", "value": "6933b1682cb60cac09bda551b2be741ff5b54216c737dda232dbe403dbabf1fdbee6a18c7dff7b464f1ca19854d83096", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441828, "uuid": "836b9836-2d8a-4b7b-9906-5b859958b01d", "value": "T117F42316AFDC4432D97627B059FE82631A347CA14D78677F2689B91B28F2382D431377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441828, "uuid": "c1d63bf9-197a-4a83-8d7d-ee82bcdc2b3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441828, "uuid": "05b244e3-dac5-4c4e-89ab-973056a189df", "value": "12288:LMrYy90AgVeCzCmjk5suquy+8/4bR2AeMKrKF1FIrcc9tLunvuKkwnk:XyzgVeeCmBuBy+8rsKrKXFIrJumKkwnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686441828, "uuid": "819c5501-9504-4b38-966c-b7d16fc43a86", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686441828, "uuid": "afd113c4-2918-49e7-8acf-e5b1fd08a609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441828, "uuid": "97618e4e-2bff-40f0-bd0d-3c1808bbb5ac", "value": "69e5de139eb3051d19465a47bc699e12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fdfc60-07fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Babadeda)", "timestamp": 1686448469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448469, "uuid": "c76cf094-8100-41a1-a1bb-e7d45ff5f15a", "comment": "Malware payload (Babadeda)", "value": "bee39fe76d04c610256938a58ac5d660", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448469, "uuid": "2e55678b-14e6-429b-b545-96513c988385", "comment": "Malware payload (Babadeda)", "value": "79c6fdedbe965a9ebf8d80f13e27332b18cdb0b313c5bb9a7c2b6723b53d3335", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448469, "uuid": "83b33bbe-b839-4ec0-a1f2-2e9a88f8b6cc", "comment": "Malware payload (Babadeda)", "value": "007cea24cf45ba83d9992d76974598da5cc77017", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448469, "uuid": "99ad3052-4531-458e-86fa-ba90e57fb5cc", "comment": "Malware payload (Babadeda)", "value": "9714b1752cf50cd6feb51f7f9dd9ea7b0c6b61f5c74daf438e64d871d38b27bfe78534859fb7d230c1ae3b3dc99e8e28", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448469, "uuid": "267b06e1-7bfb-4e3b-a04f-4aca0b9bbb27", "value": "T131163841B3D742B6E6EE093200B6602B9535AA289714BDD7D37D38425972FD0AB3C3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448469, "uuid": "74b7cf5c-dcb6-4bb9-ab4c-2a69f9f8e0d2", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448469, "uuid": "99539764-051f-428b-afaf-f0ae0d9b79d8", "value": "1536:E7f9h0UPJP/CpICdikMLMLv5PFNg1qrX+VIOlnToIfegIxRvEGm:6liUPXC8k1nJrX+fNTBfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686448469, "uuid": "d86d71ae-d2fa-4164-a486-ded3eab64f91", "value": 4297728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686448469, "uuid": "47ad8f8a-ca51-4c37-86ec-465df38f7ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448469, "uuid": "bbd16a89-c024-4490-ac92-c9d3760f1594", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b6f48b-0807-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686453911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686453911, "uuid": "c4607db1-4238-4664-8c92-cfb26f7c1816", "comment": "Malware payload (DCRat)", "value": "a2ea8c0f0b809338bc212b9dce4169c6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686453911, "uuid": "2a51243d-c972-4d76-9c9a-2e78dc5e4eac", "comment": "Malware payload (DCRat)", "value": "7b1c20701d541771b5819005700826712f27970a335dda7cf150e2564802d515", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686453911, "uuid": "6a31e3ad-3e4a-44bb-b1ad-1e243852b938", "comment": "Malware payload (DCRat)", "value": "2055d655fdc1da4d9090871b90a12a7d6f749d7d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686453911, "uuid": "9b16a966-d74a-4ae2-937b-f015acffe286", "comment": "Malware payload (DCRat)", "value": "97d5320f02dea468aa80110077f69bb5cfa462433d2fe26ebe1be7a67086909d7a61ce00cacf56980b57c31cf272caf8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686453911, "uuid": "b402b6f4-bc4d-4ecc-ad50-a107b19186c1", "value": "T11B95127219C2FEEBA7790D60D95526440CC96DEB43D8A8A4FCC847FB62F0920DD65CB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686453911, "uuid": "a0d1cd60-16f7-4b61-93c9-fab3e230b5be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686453911, "uuid": "28a5f83d-dad2-4d84-8203-bcd4321c18c1", "value": "24576:26DZpO9y7b5UC4iSiLryeCB7sDmJEtQNUdvnCYjOjO45CT8xBVZHUnc9v8E99JG1:NDDHVHQNM1rcBUczNGHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686453911, "uuid": "37c7478e-432e-474e-b576-2b5b6da4f20f", "value": 1878792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686453911, "uuid": "d8ac72e7-e21d-4464-a12d-cd72eb81dd29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686453911, "uuid": "316ca052-be9f-46b2-8176-c96d3d140e3f", "value": "a2ea8c0f0b809338bc212b9dce4169c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b08da0b-0865-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686494163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494163, "uuid": "0de9ad73-9359-4d11-8f35-4cbe59441804", "comment": "Malware payload (GCleaner)", "value": "7000dac85e332203e473185260382422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494163, "uuid": "fcecadd2-0de8-443e-87f5-5f71e0dcca36", "comment": "Malware payload (GCleaner)", "value": "7b4daf50ce63113ae3c210306e044965265e4774b639539968978ccdcaa992c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494163, "uuid": "2ac3cd24-3b61-4089-b1cc-c52dc0200044", "comment": "Malware payload (GCleaner)", "value": "42eef4507c91ed483f4f56525675144081cf5833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494163, "uuid": "0349bc15-859e-4e81-8761-139cbf135119", "comment": "Malware payload (GCleaner)", "value": "151ffee0aa33829ffd05d28f8a69192bdd0f22a9dc78a17540c0aca0b94fc927044c4f53f712e5c4c6c2fc1aca38b486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494163, "uuid": "5099c03b-9115-4740-a1e0-946db2ebc688", "value": "T150B522529BBDFA24D2A948F3BF9168CC723C963537FB012B68F7D417C46A9407C1A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494163, "uuid": "146704b5-921f-4f27-889b-ff1dfe0c4664", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494163, "uuid": "3782acff-383f-47a7-b1ef-32069a123d26", "value": "49152:J6dJ6sPXX6LzkZ/hrUfw0dXU/xLT5ZjC75+uWXhwDBONEVbn3s1g7Ir86:cdMsf8E/hADdXC5Q75UXhwDBO83s1g7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686494163, "uuid": "c21ae628-6860-4414-9b62-eea91c5f6a5c", "value": 2380874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686494163, "uuid": "ddd9e804-f672-49b6-a973-61083af4840f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494163, "uuid": "5b11c87b-306b-4e67-84f5-8e0b93b51c2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832a0ab4-0867-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686495117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495117, "uuid": "99b33a73-14f8-47e4-b8c1-b81bd10a1def", "comment": "Malware payload (Amadey)", "value": "c8012f2ac5109f3e311208fad5fdb6d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495117, "uuid": "fe97d385-565c-4c2c-8ebd-f6aed4d09304", "comment": "Malware payload (Amadey)", "value": "7e6c24f0eb718e9a9684b91c8a95e07fd272b38aa3840eafb5b1223c2cc23aca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495117, "uuid": "78a6f05a-f3b7-4458-85b8-3e964389f68c", "comment": "Malware payload (Amadey)", "value": "019d71d04a08d9a8b4a072438c3468e254e675c2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495117, "uuid": "d95635ad-7f1d-4eb9-80e4-0ef3f7fad465", "comment": "Malware payload (Amadey)", "value": "de7d7951645027678905e536ac67381a04b4a1fee780633ec27e12a4a876c89ef214277ab9482d3d22448538e6fb5683", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495117, "uuid": "28e24cc9-25de-490e-8e9e-5e1565b12aa9", "value": "T177F4125BB7C88423E8F4277158F307830A36BCA1DDF9561F2685E98B0C726D0B475B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495117, "uuid": "0a48117a-9cb9-4f6d-9272-2a16b74b0ed2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495117, "uuid": "c63c2098-cad7-4670-9f62-5fb35851e2ba", "value": "12288:pMrry90bnhDsJHkozkkC7Aof2g2hTwOwLyScYt7QsZ7P8DoxSHv6yiWnEnF:qywsJHpbC0o+wOwLXcwZ7U6SsFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495117, "uuid": "1afbd718-500e-4b50-bc05-044e9167cfa5", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495117, "uuid": "39984d60-4845-409e-b855-fc1167745c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495117, "uuid": "a60cc30f-bfe6-4266-b9a6-d8354f16ef82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d101bf0-0854-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1686486812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486812, "uuid": "d46d15b0-a90c-4788-a578-13deeddd53e8", "comment": "Malware payload (LgoogLoader)", "value": "64611ca692664bc54b040e4b01c38ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486812, "uuid": "cd24e6ac-83da-4a95-ac67-b802e1057d3b", "comment": "Malware payload (LgoogLoader)", "value": "8080f28eb2c4e6406a8df0f3ed8c1f42f8bb038a35398e13d29c618ade13d06e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486812, "uuid": "7bd79caa-e000-4a2a-a11b-c19a849012fd", "comment": "Malware payload (LgoogLoader)", "value": "83c4893ea4e7bbe82cd5b9ad197e37462e9c43c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486812, "uuid": "5e08331e-5a17-4c5e-8db9-9dcd610859cf", "comment": "Malware payload (LgoogLoader)", "value": "4e6c50bf36d9312ed8a8530c97c793db896bdd03b39cced6a9150b1bfe436d35c57752609aa4e7adf85518ac31c6b4c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486812, "uuid": "626c2f5c-4392-43e6-ae5f-9c516be30b9d", "value": "T16394F8667B1044F3CC2916F5A83B89A0777B7D7EE578024922DCB3495FF72A64822783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486812, "uuid": "2fe857ef-20a0-48c2-8aa4-4518726e512d", "value": "3072:8mXHmM0YFSJrXx0ooARRMkAHFIxobrvZkJv6SjaFvVmuLyRpPS68urGh3Lzs/vqH:Z10YMmooARiXCFT2Fp6SQaofZAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486812, "uuid": "5dd3be32-2d87-4c49-97f4-5030c62f615b", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486812, "uuid": "7c22b579-97e5-4e20-a580-5b44d33ec425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486812, "uuid": "91033a3b-2936-47ee-a72e-477c7e1507b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc3b7f5-0867-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686495084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495084, "uuid": "22ad9c56-1fa0-423c-8516-ac0271e0c60a", "comment": "Malware payload", "value": "f854b55e32e2597e9c78671ec5c3afda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495084, "uuid": "a19af189-5e10-4cf0-88ad-a15f2744eef6", "comment": "Malware payload", "value": "80bb455d4477649e37d7b20127ba8415c19a197b1e1a3a73e2f59a3ba987c7c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495084, "uuid": "1ff6646f-b82c-4aa8-ace1-573f81ec838f", "comment": "Malware payload", "value": "ac08b36cba9f6437a8e35b10dd36ef3847bc116f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495084, "uuid": "44e3d2c8-0fe5-47bc-8524-84a9f492cc4a", "comment": "Malware payload", "value": "ec0bc2b0ee97eef6a88c138be531f6abacac960a07a552a5a843465f9b92fca37eed07c2ba9622b6ca87f0cd6ed0d534", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495084, "uuid": "165367a1-cc42-4ae0-9fe6-1b2f73d0e9de", "value": "T1AB735C456280D6F7D18316F1069BAFA8033AFD3A1ABBEE85F3587CF48B710847925719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495084, "uuid": "3a377b96-b6cb-4993-9384-97088fae5845", "value": "1536:8p4uw66yastO49zyje4MkJLwDnOD8J52rf3BstzWT/O/sKw2U59RLZ5:8pV6R+x9zyje4MkJLwDnOD8mrfRSzO/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495084, "uuid": "62110b3c-51e2-49c0-acca-bd134c2846f2", "value": 74492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495084, "uuid": "6491fb1a-3340-4b47-a0ec-55728f1951a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495084, "uuid": "95458af8-aad2-4948-ac96-76f1bdb556cf", "value": "f854b55e32e2597e9c78671ec5c3afda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6650ca9e-0853-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686486478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486478, "uuid": "1b9e6893-df3c-4c4e-91a8-f094b554543e", "comment": "Malware payload (Mirai)", "value": "d70a05ea87a76e3683e686345f348ee6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486478, "uuid": "d1660e2e-2be6-48a4-a734-a4adac1e307a", "comment": "Malware payload (Mirai)", "value": "81d6276940de1061640679686fb6ba21425f715b1136b6856faba9c2a31f0b98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486478, "uuid": "bc256157-ebbd-4337-af46-f69d818ef21c", "comment": "Malware payload (Mirai)", "value": "0b20f2100fb51584595488225b70c4777cd92c07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486478, "uuid": "55ede1b3-dac8-4291-bffd-027bf1f55b9f", "comment": "Malware payload (Mirai)", "value": "75803fac19bb1697ac8117e026b99fc6754ea03346dfc68ec666c6cac8f07fa59ca21fa411e73e47e51063b75e7e5bcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486478, "uuid": "689245b3-3cd3-499b-99b2-fdea0b1bddf6", "value": "T1D2933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486478, "uuid": "3818c765-4ba0-4fed-b506-062f9ac7c6f8", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Nl4umXxVqDrstKfz9e:Q97vk51RcG7ATl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486478, "uuid": "4ba48481-fb17-49ec-9bdd-4d7c053775e3", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486478, "uuid": "1ed43dfa-390c-45af-b654-a9b05dc2fb4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486478, "uuid": "89627904-a949-4d4f-a097-3e25e87c1da6", "value": "d70a05ea87a76e3683e686345f348ee6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12785de-0855-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686487543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487543, "uuid": "e8be3d16-4b28-4b96-9755-80d35d90cc34", "comment": "Malware payload (Amadey)", "value": "aaab03aaa58a41fa15714d4818fce273", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487543, "uuid": "ede3d824-ebd6-4b3b-8cee-3b641ad56e54", "comment": "Malware payload (Amadey)", "value": "892e30ac4fa125d635ceb44686a09cae9d2273b24bc879954241809b725c763d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487543, "uuid": "8e8236e9-ff17-4b18-bc8c-432a5f2017fa", "comment": "Malware payload (Amadey)", "value": "f58b7045ffb04b842c136c8790250a20db18c676", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487543, "uuid": "3d48a6fc-104e-4aa7-a830-1fe6993f250f", "comment": "Malware payload (Amadey)", "value": "e44aaccd4daa59b0682914cd4c632bb2764f987192a5e088ac7399305f202ff3d8dc378b45de887a2b44bbf1acccf8e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487543, "uuid": "0b95ae9e-30eb-4cdd-9631-d9fe8c213429", "value": "T1F8052212D7D98833DEB517B058F106832A77BCA19C38C7AB1791A85E0C729D4B9313AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487543, "uuid": "45e30766-ccde-4e96-b605-36343ba5ed6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487543, "uuid": "0f5120cd-160f-4e6b-989e-32e02ab89419", "value": "12288:0Mrxy90JY0yOGBUlt8RToZFE0rJRnJ6DItrYfGyAkpo66YiIiSZT:lyPdultJT3JDrYfUkl6VIJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686487543, "uuid": "bebfd6a8-7978-4923-ac65-141fb243de13", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686487543, "uuid": "c1c3e43a-92b2-4433-b621-73069f6715c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487543, "uuid": "42017611-5746-40ff-91af-4964f6100916", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f029719-0856-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686487862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487862, "uuid": "577056b8-4dd5-4a05-ac0d-bd4b9831e204", "comment": "Malware payload (RedLineStealer)", "value": "44801eb651fe20b3d37449b4860023f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487862, "uuid": "05822672-3b9a-404d-8c39-3feb77c7aaba", "comment": "Malware payload (RedLineStealer)", "value": "8e933b2d90245af4ffffdbc914dcdab6e9167e48ed41715e614546d2b37279f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487862, "uuid": "c538b4e7-3373-41e5-8900-2cfb91cda077", "comment": "Malware payload (RedLineStealer)", "value": "81ab2b974b8299acea07f48be4225cbe2ecc355c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487862, "uuid": "84bc281c-bd42-455f-a2d4-21425a95dbb6", "comment": "Malware payload (RedLineStealer)", "value": "379d5f0b6401ebfe3f00a528ed9114101f1d5605f761f28ee46ee293041807dfddd073e7425785e673b12e39f3e931a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487862, "uuid": "c56f6b90-b6a6-45b5-870f-1ae36bf9cd28", "value": "T12754D0587AF1D831D6B741344935F2E4797FBC726934858B3E442F1E2D32282AAA631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487862, "uuid": "7428f2b6-4e5b-439f-bee7-5a44105ae4a2", "value": "99f427a37c6c1a1f0f727259f833cfd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487862, "uuid": "d9c77c93-672e-473c-9484-20dc3a32a68e", "value": "6144:SUOySve9MN101YtUnRsRW2SoJFefyurIet:W1rNURXoJQ6urIet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686487862, "uuid": "8812e452-3199-4623-b53f-275cad901792", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686487862, "uuid": "329f9473-9240-46e0-925a-bb91a7a830f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487862, "uuid": "aaa6755f-3842-4882-afed-3067f5665062", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42002c17-07eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1686441750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441750, "uuid": "e26eb797-3e65-4254-b5c3-26c372170d1d", "comment": "Malware payload (LaplasClipper)", "value": "a4aab901f5f4662d75a66bdb08971148", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441750, "uuid": "ef37788d-36b3-4d06-aadb-dea5ce038ab1", "comment": "Malware payload (LaplasClipper)", "value": "8eb56a2f631dd8b6e3cf827e2022dd3714b805eb377d4e186a41384ec624376c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441750, "uuid": "7be72e1e-bb10-4f36-9922-3f4e8e2652df", "comment": "Malware payload (LaplasClipper)", "value": "9835bae8776e280b5a6bcf8e204d1bca5e05b0f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441750, "uuid": "c82d2563-3b7b-4b49-8944-1dbaf3a50221", "comment": "Malware payload (LaplasClipper)", "value": "93489e20088ba8594da10415784c5a11b471f5977c1acd448df17ae2798ff9433453f4184b3d7fe4d0a146ee6df5de82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441750, "uuid": "96ec8278-7fc4-4463-a82d-608d6061f2e1", "value": "T162857D13F3808932D47326399E6B46A856B5BE002E74E95A7BEC7D4C5FF624138193CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441750, "uuid": "6bc03523-64ab-452c-9e0b-653316bbb8cb", "value": "24576:YwJAcH22+6MA333QaUozWal46B7Owg/63wXByw/OK:bJAcH22KA3339UPaewgrByq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686441750, "uuid": "f1479708-8ff5-45c9-8d72-5397458ec9e7", "value": 1774080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686441750, "uuid": "be24df3e-079b-4509-90ff-bfd56fd2ee4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441750, "uuid": "a5fd14f0-9629-429d-a37c-398bd13b6061", "value": "a4aab901f5f4662d75a66bdb08971148.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a77d632-0867-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686495075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495075, "uuid": "ae98effd-fc00-4cf0-964b-45d53b97b415", "comment": "Malware payload (Gafgyt)", "value": "ffa9347141258fef66ad8b69a243aac3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495075, "uuid": "05601611-6159-4c3d-a330-53aafc9da2d4", "comment": "Malware payload (Gafgyt)", "value": "8fddbda6b40b0970b200169f8557439a3caf65b7e73827767d1b3b6417ee5f37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495075, "uuid": "f1c75994-5ac2-4185-81a3-30d4aa11aca7", "comment": "Malware payload (Gafgyt)", "value": "e720d16e0055fe5ec00d513c8bcffa94343854bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495075, "uuid": "0a0ee91a-b0f5-426f-8ace-83e5dacd8ba4", "comment": "Malware payload (Gafgyt)", "value": "9690559edb60214e73c99649cdbf5322b41983ff609ea78c353951efe0445d5a8cc2f708898975ac6f9902d24313f17f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495075, "uuid": "d2e279b3-b81f-4594-9f20-8fdb3ed9c0c8", "value": "T1E2A3E704ED505737C2D23BFAF79A42CE37351F986B97334195293AF42BE5B982A39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495075, "uuid": "dc9105ac-ce31-4009-98ca-61c814be30d8", "value": "3072:PwbRuW1i4sB9xQMOvA9dHB1WoAgq2hQgaHY8RwR4h7uTMqSMnMe:kw8RLh7uTRMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495075, "uuid": "0cb5820e-a1a2-4a65-a253-707b87b4b428", "value": 102051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495075, "uuid": "7d3d541d-3909-4add-b868-c99ff239cd59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495075, "uuid": "36d536d6-5d41-40c8-80ee-5b5fae2276a4", "value": "ffa9347141258fef66ad8b69a243aac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db41601d-0869-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686496123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686496123, "uuid": "d7c67e18-f681-47cb-a58f-abebad3bd9e4", "comment": "Malware payload (Smoke Loader)", "value": "31e6d2018b345fe69bbc2cf8f69215b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686496123, "uuid": "3219dfa2-40cf-4f99-bace-2e8b9bc60fa6", "comment": "Malware payload (Smoke Loader)", "value": "90e12268c6886da75cf395936df7635c52dfcd3bcf074396dd9c97fa55c9eb5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686496123, "uuid": "76cc52df-f07a-4694-97bf-492d088e2eb5", "comment": "Malware payload (Smoke Loader)", "value": "7bd30d865386c349f3c29c9d85fda0a7ad76111d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686496123, "uuid": "97cdb211-f313-490a-9a25-61d10907f637", "comment": "Malware payload (Smoke Loader)", "value": "2b27658007f6a17099618e2922b377a7cd4dec9ed20777eda1b5c369d7c770d3e9a66dce7249df0edbc862038d1fcb2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686496123, "uuid": "ad8739f5-1136-400d-9b22-9813a7c04087", "value": "T11324BF1176E1D032E6B745345934D2E36A3BF8B3AA75844B72443B6F3D322836A66F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686496123, "uuid": "4696f0c4-abc7-4210-bcf1-3ea006092083", "value": "1b96bbe7f35030dff720bfd4a2e62f20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686496123, "uuid": "43266b30-4775-4521-8873-75e809b10ce5", "value": "3072:VYTKEKvZSP65OLdxg8PGmAqjGyhetUsyOhyZaRtIRdo5tDaX:a2BQP65odxVPEzn6Zan8o5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686496123, "uuid": "cb946fef-191a-4540-8bbb-69af2b699be1", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686496123, "uuid": "c7654bf5-2067-4df2-bafe-f44460ec011e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686496123, "uuid": "5024dbed-48f3-498f-bae6-a6dcabdf8853", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7918e708-0870-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686498965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498965, "uuid": "e1e7da16-32e1-45f2-b122-4b005846eb78", "comment": "Malware payload", "value": "3743e876b9e75065d06b84a03a38763d", "object_relation": "md5", "Tag": [ { "name": "AresLoader", "colour": "#CA747B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498965, "uuid": "befacf4f-990a-4bf4-8486-f350282644cf", "comment": "Malware payload", "value": "96ed9ee02439a8dbf2d342b1c62cf6e457526a20bd46796b32f77c62ddc140e1", "object_relation": "sha256", "Tag": [ { "name": "AresLoader", "colour": "#CA747B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498965, "uuid": "535962a8-ab23-49e2-b8b9-14755a2679ab", "comment": "Malware payload", "value": "a94c7dc4c4234b22b23b5228a7894ff1632359c6", "object_relation": "sha1", "Tag": [ { "name": "AresLoader", "colour": "#CA747B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686498965, "uuid": "9cea091c-73cc-44e9-b692-7f32cba6a11d", "comment": "Malware payload", "value": "c87e5dcbe89089f5b746e963f8c0557bf633b9b61b04582424758e868b4808699bb1ec663b23e21cf8bd30eacedb906f", "object_relation": "sha3-384", "Tag": [ { "name": "AresLoader", "colour": "#CA747B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498965, "uuid": "8d7741db-d74e-4bb7-a68b-d74cee0c7423", "value": "T1EDD359722E002472EBEECA3624999913413AAD5DE95C31B608F4B6651FF7F7B131780E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498965, "uuid": "c44dffbc-d4ad-4185-a5bf-b0297251260f", "value": "039032eedb13fb00811bf4343043c31c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498965, "uuid": "bb4e2524-73d3-4b08-ba4e-4afb4e615327", "value": "1536:jrqvmmmmmuRbSb+xtAzA940ojleuppKDoW1+jwCUG7ixQUG7ixksO:fqfR1IzAW0oj0uppqT+jwCUG7DUG7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686498965, "uuid": "d23b1ba6-469c-41ba-afb9-9f9a32e764dc", "value": 134952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686498965, "uuid": "784db76f-457e-414d-88af-49e3e833bf3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686498965, "uuid": "c953553e-801e-4b34-9c54-5e43955b01f6", "value": "CopyrightReport.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3fc6c6-0811-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686458111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686458111, "uuid": "89fb33ed-c84b-4caa-95f8-fab44b5fc020", "comment": "Malware payload (RedLineStealer)", "value": "b55e041ecd53625a27acc8117eb16846", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686458111, "uuid": "e2c0ea10-4dad-4834-9ebd-a9ed50851fd9", "comment": "Malware payload (RedLineStealer)", "value": "97d2a24b20b54c9c6922df9264bc6775e95a04482bfac6a7bfe82372129c596f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686458111, "uuid": "94c9ca09-386f-403f-89bc-570ec53b7ae8", "comment": "Malware payload (RedLineStealer)", "value": "5d4b6a32502e8aab40ecc023f66decad818f0359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686458111, "uuid": "24ad3fbb-fc3f-4a69-afd1-ead2d0179dd5", "comment": "Malware payload (RedLineStealer)", "value": "b1944140157cce2963cd8429b40e8b29ed4cee475c9addf0560ed241a7769f10086cd35663099970a2ed2269a581ac54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686458111, "uuid": "19b4e6f3-0568-4f1d-87fe-6099fc385765", "value": "T180C41202EBEC4032E8B51B7158F702832B377C659E74429B2B85995F4D72684BA35B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686458111, "uuid": "93714d4c-f2cd-43da-b62d-d03cfe4d63b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686458111, "uuid": "e6f8a70e-fc2c-4e18-a0ee-cb69b0ae2e4a", "value": "12288:WMr8y90w990WwE6HevOCBHzVgI3Own0a/lITy39HP:uyF6Wn7BFOa/lx3VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686458111, "uuid": "61bfb04f-0f49-4d19-8887-435a2443f6c0", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686458111, "uuid": "6eeb5db2-2370-447e-8457-91db5cacb1ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686458111, "uuid": "d546dd67-8135-4d0e-bc5e-48e99cea0e68", "value": "b55e041ecd53625a27acc8117eb16846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fc5afc-0853-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1686486503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486503, "uuid": "b9fa4d89-585f-4c99-9920-d9c3306be51a", "comment": "Malware payload (Adware.Neoreklami)", "value": "9b675d1d9c5cfe65796c42e9bd54978c", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486503, "uuid": "6f407fda-99e2-4012-a809-5b707e1c1522", "comment": "Malware payload (Adware.Neoreklami)", "value": "9b52553c9948dcd4e063c4ca27f312c491e77a398b79d59ca52200d0fdd30626", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486503, "uuid": "6f7ea6f7-7836-47f7-91df-86090d6df9f3", "comment": "Malware payload (Adware.Neoreklami)", "value": "23d18608cdbf5ea58a868e67d3d2400abf03e5a3", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486503, "uuid": "a1dd9db6-47d4-4d8d-92e7-24428c88b439", "comment": "Malware payload (Adware.Neoreklami)", "value": "a88d1aa92da1cd619bd90eeecbf040191e7b431e65599ee05a2718224c62b8afc5eb8d5ec3bace18787305c5ef088cec", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486503, "uuid": "81a7b595-4ca6-460a-bee9-9e5899d50839", "value": "T11B7633F635DA887EE0056437D9B57A8B6087E2E0453855EB23EDC50ABFEC958CC8D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486503, "uuid": "2d9df4db-b84c-4c88-9c39-b4e6354fe627", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486503, "uuid": "f7087e57-2a49-4ce5-bc1d-2de3951fd2cc", "value": "196608:91OLz35d/kk+OGKr/f1n1bvHb8lonDUgzopEIFe:3OLryO5Fn1DwDg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486503, "uuid": "169de0cf-5ef5-4e8f-ad9e-1092a0d0102d", "value": 7588232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486503, "uuid": "b710b968-4608-4c41-85f2-21f4c309aacc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486503, "uuid": "ade57a4e-c0c2-4f36-9cd7-1e422ea3e7ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ff5df4-0853-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686486501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486501, "uuid": "8a0b1f73-860f-41ff-bf2a-ee103fc335a2", "comment": "Malware payload (Mirai)", "value": "c4f0bed8e8f28a628a71058fb5a39724", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486501, "uuid": "a0ccb6b6-f59f-45f4-9173-e5de7af08aa0", "comment": "Malware payload (Mirai)", "value": "9bb382471ddd364472b86999d79ad31cfc20b0e1df98d641d30852dcf9e983c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486501, "uuid": "8fc0ff08-7c40-449d-9902-dc5dba2b8165", "comment": "Malware payload (Mirai)", "value": "8cdc58c6292f4b5d78231d7470a95f867bdfc6ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486501, "uuid": "5a688c9d-a32e-484b-a407-121811b01631", "comment": "Malware payload (Mirai)", "value": "90a19d87b76a000018ae7db20008b56a3b7181c6cd22ce5bac7628668cb78545ac4ba53f28ffbfdc774fe8f4bc3352ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486501, "uuid": "981dcd14-c30f-4440-a6c6-317439cdfa96", "value": "T114833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486501, "uuid": "19ff502b-9b1d-4fa9-93b1-a71a471ca0bd", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJChdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3J+BQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486501, "uuid": "261d784d-e423-4a81-bc1e-20c02ea6b659", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486501, "uuid": "b6ddc877-0010-41da-8f95-b4f5f4a79628", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486501, "uuid": "18acf0c0-2544-4cf5-9d11-4ccfb41768d6", "value": "c4f0bed8e8f28a628a71058fb5a39724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc89f97b-082c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686469926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686469926, "uuid": "ce68733e-d0c6-41a3-8a0b-eb1cc97b02e9", "comment": "Malware payload (GCleaner)", "value": "2c10b8d0799b7dd91ee4cf228a01ae86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686469926, "uuid": "f716a3e7-9b11-44e9-b48d-6d3107782de7", "comment": "Malware payload (GCleaner)", "value": "9bd63ebc98e80be154e87035bbe6675b6ea1a720d3465173802b26d521efa15e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686469926, "uuid": "1f76b555-99c0-4e46-8f06-bbf224202533", "comment": "Malware payload (GCleaner)", "value": "de5203940412852bdfe0d5579bcde5ed8740e3a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686469926, "uuid": "01846bf2-0981-43e1-b101-0ce18ff297bc", "comment": "Malware payload (GCleaner)", "value": "b8ca6f2aeb14737c7abc5ab97cdffd259166026086d95b2da13f85c6cd73bf8f6c48c42e5c14b37a3f706a5e7e96b17e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686469926, "uuid": "a9de623d-5363-4140-bef1-215309944f54", "value": "T1F3C522145FBEBE10C2A848F3AF9220CD723D9630B7FB4227ACB7D55794696547D2E208", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686469926, "uuid": "9675d026-9b87-48a7-bf7b-5a9874da33ec", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686469926, "uuid": "26621b8b-357e-44ef-bcff-d3cff4a7edc7", "value": "49152:J6dJ6sPMMpWRzLf37PihJoJvMXZ1qPafpLBPL7+gjZvcEjO5ndtGKAgpKqHp1g7O:cdMsO/739OgPopsgjx3OrMKAgprJ1g7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686469926, "uuid": "cdb8db7e-aa54-489e-b405-280d6ee28a60", "value": 2547444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686469926, "uuid": "ec734ca9-5527-4a76-a537-ccb67a9b7cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686469926, "uuid": "b1ecc5f3-e9e6-4f27-8499-c67a997a2eb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15564b3-0852-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686486228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486228, "uuid": "d5cbc7d7-0fa6-444f-ad11-367e0d130792", "comment": "Malware payload (Mirai)", "value": "2fbdce5623bf6ff34811d8e6aa6953d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486228, "uuid": "fb6538cd-e31f-4b19-8dfe-8ce797e3108c", "comment": "Malware payload (Mirai)", "value": "9e54877c21acb33f164964c54cfb10a0485e700a22812472b05493f1e31e2c75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486228, "uuid": "e09610a5-6c2c-4141-b803-9e653aba9f23", "comment": "Malware payload (Mirai)", "value": "eabd8c2a487ebeb9eb3dacd99dd1c76d010e84e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486228, "uuid": "8f10c3f1-2bfa-481d-b49a-eef9769bd4c9", "comment": "Malware payload (Mirai)", "value": "fb5f8f9b7c1aa4049207d18509b910edf0728311be0b338d1b32c30fb1e53bc3dfe28529404d2b0471264f039344b718", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486228, "uuid": "52bfe628-201b-49c1-bd60-3c09617aa860", "value": "T1F3C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486228, "uuid": "fac93b8e-2f23-4060-8fbb-af18a9299fdd", "value": "3072:ekYPUfsgnsb0J2ag/Vf+kDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0+kDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486228, "uuid": "028363cf-a294-425e-8af7-3cc26fe2e3e6", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486228, "uuid": "7f96cf0b-2804-49c5-891a-160cba6bd39b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486228, "uuid": "82250097-c336-4eab-95ec-a26b64c97a5e", "value": "2fbdce5623bf6ff34811d8e6aa6953d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e4655d-0853-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686486509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486509, "uuid": "c16a1c83-4011-4f89-9990-5e506ec02849", "comment": "Malware payload (Mirai)", "value": "b370144e0802c827c5b9fa5ad8cd7e64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486509, "uuid": "ddc6e7af-ba8b-495f-83c4-a8d95dc4f39c", "comment": "Malware payload (Mirai)", "value": "a30ead54eab2365926088290fb64f6144dcdc97d981faf4d0319565e225dddeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486509, "uuid": "07eca732-5d0d-486e-9ab3-6ad87085d2ff", "comment": "Malware payload (Mirai)", "value": "e014d319caed1adfc23fb92d6d06c4692e8ee239", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486509, "uuid": "02544d86-e3ff-4e68-819e-2315e3111c51", "comment": "Malware payload (Mirai)", "value": "aa60c14163a622b5b6a323a68a2ed2345cda60b0be4293f9b5f4f0b92a2fc2b87a6ac45acd598bd5523136df46589c9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486509, "uuid": "eb9c3018-7206-42ff-9035-1ec5d219a3b6", "value": "T108F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486509, "uuid": "4877b954-e6bb-43f5-bc48-db92f8bbd99e", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBFYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/TYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486509, "uuid": "6d1d0bc7-80ef-44d3-b734-c19d938e2c65", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486509, "uuid": "b6e301d3-0d5a-4a6e-a5b3-5e759b5c26ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486509, "uuid": "db605d43-27dd-4351-b21f-7d291825db82", "value": "b370144e0802c827c5b9fa5ad8cd7e64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d93ce7-0862-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686492834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686492834, "uuid": "ca5416e6-4362-4830-b856-03ddbb686a85", "comment": "Malware payload", "value": "935db3b2ee74ed346aa7421a2ec13376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686492834, "uuid": "99701f05-c67a-4313-addd-4f6a866b3a23", "comment": "Malware payload", "value": "a37fe8546e019950a76f4fe3507487c3ff9526751157bd95c23ccc7f2ec2d8fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686492834, "uuid": "0e38bfa6-2eec-437e-b38f-9946ef5bc3ac", "comment": "Malware payload", "value": "ced88126199aedb7758a1809e88597ddd85b6b18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686492834, "uuid": "63d4facb-8c02-4ed2-aefc-b1aa071ae361", "comment": "Malware payload", "value": "0874c46261c0de27929eb6b166f11ac668d0251b765091a9003ed5b9dad80421ae02ee0c946d532be296bec440856e5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686492834, "uuid": "117b19e4-ffe6-41b4-8f2d-a02279400933", "value": "T16C731A49E552C6F7C4821BB1039BBAEE0766FD394E7A9E48F7083CB49B724D43929311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686492834, "uuid": "3dd588d0-1e25-4759-89b7-3cea819ea9b0", "value": "1536:xVVI3lguLYiPvoVjRWSbXJ0rWlC/kPstVkYFaw2bQW83LZ5:a3KwYiPvoVjRWSbLQ/kPstVkLw2kN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686492834, "uuid": "ffbe55bd-9e67-4908-8d0a-daa2fe4dfee9", "value": 75580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686492834, "uuid": "f41f8dbc-5ac8-47ec-ba9e-f524addd207b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686492834, "uuid": "74eef3a7-e8b1-4616-a36b-f00b594d989f", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816f420d-07f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686446151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446151, "uuid": "8604b6a0-acee-491a-89cd-8759a7b8d49d", "comment": "Malware payload (GCleaner)", "value": "7ee972cabe7e023c161f5ba13fcaf3ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446151, "uuid": "c662cc24-f718-465f-a2ce-f8b6de8cfcae", "comment": "Malware payload (GCleaner)", "value": "a97cfa2eb3f1f7ae4b7221a2c605438690ad7e469a3673cbf74998424ae740b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446151, "uuid": "7d705391-e6fd-4fb3-9fb3-81956408afeb", "comment": "Malware payload (GCleaner)", "value": "490220cc5799ac00f9b898988c2db232e0f2d416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686446151, "uuid": "27f5fb51-fbd7-44bd-84a3-bfee3cb4513c", "comment": "Malware payload (GCleaner)", "value": "7d39c99c0760268c783965fc080f8d326035b64180078f7b03c469a08e27b76d4c1f0971cf19ec6f46c320a3802d4c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446151, "uuid": "6efece0e-d460-4cf1-9a51-e185dc26d040", "value": "T1329512515BBDFB21C4EC88F7AFA140DDB638A23577EF092A68F7D447C0699443D2A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446151, "uuid": "b6acd5b5-9cda-4ea8-b86b-16e2c9197f40", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446151, "uuid": "9892d329-e0f3-411d-9912-fd4d9d484e43", "value": "49152:Z6dd6sPul2QRbD6mSocufgrWPGx8bOkJhlaUZ1SMu2vIqZJ1g7Ir86:sdYs2l2QRbFSoiroG0Oohd1ZvIqZJ1ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686446151, "uuid": "5cde08ee-25d6-4575-9715-3095b7575c87", "value": 1997619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686446151, "uuid": "63ce57e9-10d5-4a81-bf3c-8d40bb89144b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686446151, "uuid": "99691d27-80a3-431c-bf52-8514322b9cd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44484784-088a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1686510043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686510043, "uuid": "1073c5e3-7201-4970-9fa3-347c1cd47016", "comment": "Malware payload (RustyStealer)", "value": "87de6941e31d28ca3c54b040a9d64e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686510043, "uuid": "98646fb2-efe1-493e-86f6-30cbe23c2ca0", "comment": "Malware payload (RustyStealer)", "value": "a9c3593523b32193ad56090708f0b6fd5e2babdd7d04abe055ef86ccab7b4247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686510043, "uuid": "27c88409-92ec-4067-baa1-3094d4b018f8", "comment": "Malware payload (RustyStealer)", "value": "e917f8387e828e0b966759260a82413957098597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686510043, "uuid": "c1cce430-f55e-4c01-bbd6-2567dd712f90", "comment": "Malware payload (RustyStealer)", "value": "52f868c21151a362c76b2b83ef5bceca47d4011bb7cb98c41ad875ca57afcb166db60c43a07b0748813063092cd025c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686510043, "uuid": "80717009-3a84-4825-a2df-3a981dd98a94", "value": "T10766C51AA76D60D9C07FC078D2839F22B9213499073977F7899096692F24EF8BD3D364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686510043, "uuid": "609c5183-323a-41e3-9c0e-e79efc8ad3bf", "value": "eb74391ccdeccd1a290ccb380e0221e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686510043, "uuid": "31656bd5-77ca-4815-ade4-da4d082a57a0", "value": "49152:Hv2Bnc1mhyvBvnkxjdlxJxM1mxtNM3fXbq4RntOCO3E4/Y1m+c/uuE626h4BJc8S:9nBsQkxo2tFnp5PUqS74W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686510043, "uuid": "115b5893-8175-4171-a1a1-cdccacdda2f5", "value": 6933272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686510043, "uuid": "2ae10af5-3e38-4bba-a94f-81a9ec3d39dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686510043, "uuid": "aa67fa92-6b28-4d64-be68-ff1a38565115", "value": "python-3.11.3-amd64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25d7ab6-07f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686447119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447119, "uuid": "afe12780-2658-45ad-bed4-08cc614f54b2", "comment": "Malware payload (Amadey)", "value": "0555c16109ef730082bd1fc0088c1202", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447119, "uuid": "cbd4d4a4-87aa-4567-9c19-6e90c73b9b37", "comment": "Malware payload (Amadey)", "value": "aa78765931cd9ed76d8d21176870f37a8af88d707462c3be4325964e0042591e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447119, "uuid": "c38e3f83-9106-4013-88e8-8137ecd31be4", "comment": "Malware payload (Amadey)", "value": "b02506d2d21d6527ddaec7b2388e85fe8769b5e8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686447119, "uuid": "407c2e6e-5b74-4c63-9fb2-6f37f0ba0755", "comment": "Malware payload (Amadey)", "value": "97c9c1206b8a33ad477094aa8fd73d92cc83d391d58745aaca51fe7573f7b187adabf7161094481c85d3d220de59b769", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447119, "uuid": "adf7ca75-4de5-45ed-89d0-1e4dc370cb66", "value": "T170052213E3D86432E9B567B048FB43532A797D726CB8425F73C0A94B5CB27849879B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447119, "uuid": "c9114868-8dc7-4fc1-b759-1d4bad79996d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447119, "uuid": "bf77f7fe-cf5d-4e9e-a399-ac2e574c9800", "value": "12288:CMrUy9050o+gHASFo811npyWuAgmhLSKdBh8/689delWvU5y1XqsS6vIkgb:Kyev+o3lUWrHdbQ/lU5wXZS6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686447119, "uuid": "720aa94d-89aa-43f2-bf70-6fff5611fc24", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686447119, "uuid": "527ab7ab-9542-480e-b1d5-a495aeb9f3ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686447119, "uuid": "14e534a4-dfa1-4304-95e0-5f0a725da007", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb1a2b1-07eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686442065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686442065, "uuid": "ad14358f-cdc4-4b96-bd73-c222e79d3c1f", "comment": "Malware payload (Amadey)", "value": "5e3330f0743827b34b76d55266feb2ce", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686442065, "uuid": "b8c2fd0f-b00c-468d-8a38-cda33568839e", "comment": "Malware payload (Amadey)", "value": "b012e928287eba5de20415c534ca1250349ded0f5ac77f8ccb1f28aa62af4766", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686442065, "uuid": "421d26c7-0999-4cb7-8f50-3b39e1c85e6f", "comment": "Malware payload (Amadey)", "value": "48f0ddc136d4035b4f0ad6d214ccb113157e3ffe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686442065, "uuid": "cf0ab5eb-4d6f-42fc-941e-7a73fe52419c", "comment": "Malware payload (Amadey)", "value": "35808c1130f85d92fd2b4a8f9ffa3907d85e62551dc65c0ec0be72de5c0d288835b0816553ce501010785b7f0d88ea58", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686442065, "uuid": "f4cf0044-6d8a-48fd-bc83-c282ac2d74b5", "value": "T14BD41211A3D99176D9F12B705CFB03831A3ABCA14DB8829B67826C5A5CB37C0D53637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686442065, "uuid": "f17411a3-b19b-4afb-8ea1-db301444a686", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686442065, "uuid": "e272e7b4-0e59-4e9e-a4ed-0645400cbe5c", "value": "12288:CMrFy90asDkdDMfCfZQQqrz2aCsO+bMeRAdDoD5qjHKTBdsB2W:3yiD7CfZkzJZO+46M0WHKLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686442065, "uuid": "93b1defb-8c37-42ef-b76f-290d4fe1772e", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686442065, "uuid": "6f385af3-548f-4ed5-a0b6-49ab9b82f396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686442065, "uuid": "6df8875a-5f34-415d-af0b-de365903e2a2", "value": "5e3330f0743827b34b76d55266feb2ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed99fb8-08a9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686523456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686523456, "uuid": "1e7ef494-b9e2-40bf-87d2-db89ee2543c1", "comment": "Malware payload (Loki)", "value": "0744eccf5d93cf89589d70ea7a164506", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686523456, "uuid": "dcf6dc10-4270-40ab-aba6-a556ce06c16e", "comment": "Malware payload (Loki)", "value": "b0fd06eb989e91464f06adbe44109286942dd3fff9b8a20b627a4e2294e25e42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686523456, "uuid": "c95f498c-71f6-4677-8285-88742ea1a1f3", "comment": "Malware payload (Loki)", "value": "0aa8c63b584f83ddd58b490915a60bf085c67528", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686523456, "uuid": "2e62e17c-3f81-4396-8144-40efb3d6df76", "comment": "Malware payload (Loki)", "value": "d705723eb9a7c0f8ef4e50551efd5d4c42886acee8bd1c12939450b8cbf62f62e588c5abfc5a0b991a34bef6a87ce71f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686523456, "uuid": "5787cd9a-a5d7-411b-bf8f-33b0465fe90e", "value": "T1EBE4127E17B3896EC8C73FBC8C112EB2D1E856867527D6478FA3FD99DD80A080C915A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686523456, "uuid": "0c243e03-4783-4e42-b8a3-b4e62fc9262c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686523456, "uuid": "28aaadfc-54ba-48b6-ad63-0177e356a964", "value": "12288:VxPWR28Le0cY+Yg9fb9Ton+K6euQMhCfh4ooWWl3XrEnk:V1+xL9Rk9en+Kzu7AZ4oilQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686523456, "uuid": "af9c9bcb-0479-415e-8c26-e030cd98753b", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686523456, "uuid": "848bb65a-0e06-48f0-af50-54aec2e655fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686523456, "uuid": "e2634096-06bb-424a-a236-8a59e77e4989", "value": "0744eccf5d93cf89589d70ea7a164506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f090a1ca-08a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686520211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686520211, "uuid": "28a8b79f-a18d-4fb5-a12f-8dec6e8cb3c9", "comment": "Malware payload (RedLineStealer)", "value": "bc023937d9608797a84e64d9bf4dfd86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686520211, "uuid": "a6eac1a7-9218-4480-8603-57b6161e60bb", "comment": "Malware payload (RedLineStealer)", "value": "b28d0fe10b239ce201001185b899dc71f6d2c211283b11b66252e529b4d2dc7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686520211, "uuid": "ad08b885-2e12-4fb2-b51e-fdfdb0befa27", "comment": "Malware payload (RedLineStealer)", "value": "daf0a0993de9d432c1b2fe6b464070aef1fe87b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686520211, "uuid": "57ec3d68-cbd5-44e5-b52d-5928d4d1c126", "comment": "Malware payload (RedLineStealer)", "value": "a9c0ee0e9d6d03abd6eb33057d49cf8d548ae505e4218045b7068fed18158d56832684f287cb357b110b839fa99baa81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686520211, "uuid": "cc6aae86-474e-488d-a020-6360c780a329", "value": "T13AE3F728279F9934D6BB4D3DACB15CD076BCAC12A542D74A4ECCF0593A73B80EB116B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686520211, "uuid": "174a6400-977e-4fc4-9890-5c44073cdf97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686520211, "uuid": "f609c147-a7ce-4d50-a4d3-5cfb7bfd7441", "value": "3072:VV+m5cVQmRSxy4ej5Xvebx2VDhcZG8e8hh:Vj4t52b2Dhcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686520211, "uuid": "e867fa5b-3b9e-4772-8345-ef7f1c56ab78", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686520211, "uuid": "54a3cfe6-f0c3-467b-b0ed-bf5aa0c531ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686520211, "uuid": "a756f2bc-2e18-4217-a655-c256f2611543", "value": "bc023937d9608797a84e64d9bf4dfd86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b234a0f5-0852-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686486176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486176, "uuid": "81b7164d-cb52-402c-9157-a06b76af8577", "comment": "Malware payload (CoinMiner)", "value": "982eda3c1e90c4d2531451eeb8730ba3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486176, "uuid": "ed467ab2-780a-4501-a532-9bb75fb3df0f", "comment": "Malware payload (CoinMiner)", "value": "b5ab9b79a5f5b9b2d94942173223bb4aec4e9fc321b8a245ce8f5b654e65ff35", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486176, "uuid": "35e6b32d-77b7-4dc3-9f13-5ec2f6bb3448", "comment": "Malware payload (CoinMiner)", "value": "9965657a4ea9f3a2f5c8b99fcea554f185cfcaf1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486176, "uuid": "d2e617fd-d8f9-4193-866b-89f8bf25f0a9", "comment": "Malware payload (CoinMiner)", "value": "c8c0ca4df6e9b47dea3c187696b068f09e07e964a8f847105cfd88a1b86fa9361d502827e5288ba9d058346811e8b984", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486176, "uuid": "a1885fce-9b11-4978-a096-f9632c2d8eee", "value": "T188A5090B7E020CE1DC8D02F3D5E71AB89A20FDA64F14A4AB21D1B7DD6BFE1C6584D256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486176, "uuid": "ba0f9fa1-8ee1-42ab-8b11-f9a180e5f87b", "value": "24576:DjBnPazBt1nzHq07s9CQw4z19o/3Ms98wI7hj5wPtS/hZY:pPiRzK07arz1aEs9UR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486176, "uuid": "0b195628-2666-4db4-842d-9e577abe2462", "value": 2124800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486176, "uuid": "ade13760-a974-4937-b10c-7aa44e1db6ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486176, "uuid": "35376d78-4493-4e46-82df-9f0e6f536871", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228c220f-085b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489800, "uuid": "9fc82458-2203-4da0-b23e-93f74592e540", "comment": "Malware payload (Mirai)", "value": "5e421865d29a43d254d915abb7a3a17c", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489800, "uuid": "b7323657-88c0-451f-90f2-0cf268988339", "comment": "Malware payload (Mirai)", "value": "b79489f6344ca40137293f79c5ebf08b015c3e3b8f5dcad3cf55107fec305d0d", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489800, "uuid": "e92ecd86-88f2-4846-b2c4-51dd615f4e75", "comment": "Malware payload (Mirai)", "value": "9c618dcf9d736031564cb7749dee7e0792b37e12", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489800, "uuid": "4d6de6d9-02f0-4af3-871c-9f3514e0dd93", "comment": "Malware payload (Mirai)", "value": "5683cbd46f54eb0d0e50ec22a1125eee8326af601e6c4024ee15c6cecf0a5b7b617058b572a1e2fbd8bbce615530935c", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489800, "uuid": "eb3a91aa-e810-4960-91c9-437ca63127ff", "value": "T15F21CBA6A7D3AD1ACC440233DD9B5714E322AF44899EB503E35112250C7E31A1F22189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489800, "uuid": "e9525a4c-6a0b-4322-bc28-e24ac1d11b97", "value": "24:Ji2tVsgP9qD0at6EoNGbCrUlFSy40VzLCkIdsgHcQIdpMlpNfe:JltVFFqDPtorkFSy4CzLo1IdSlpNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489800, "uuid": "c959f7e7-02d6-4fbb-a2e2-c909540edcd8", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489800, "uuid": "58752827-93a2-4040-99a1-f54144f6bf05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489800, "uuid": "7b4e9b46-338a-41b2-a8eb-eefde544b33b", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349004b3-085b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489831, "uuid": "740b37ee-09a7-4d46-87cb-33d072ecd636", "comment": "Malware payload (Mirai)", "value": "7941a93cbda77ed00615e74ac3aafc7c", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489831, "uuid": "b50627b7-6433-499f-a0bd-6913eece6873", "comment": "Malware payload (Mirai)", "value": "b85357f6e4a3c46e11dcb92cf2a0ebab3062c37b50cfc6fd290fd0754f90399b", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489831, "uuid": "43eba085-6a15-4026-87ac-49002fc3374e", "comment": "Malware payload (Mirai)", "value": "da2897c2a93f313249f293a7feb32026eb79df38", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489831, "uuid": "0bc59d17-dff3-46cb-a24c-69df6d97870e", "comment": "Malware payload (Mirai)", "value": "7e680dd9cb914d0e0c81a3a5c594c2c5e6bbe66feb5f047868451a93a45f061bf49a8dbe895e50c8e6d36e5dea5af3e7", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489831, "uuid": "6b3d5e60-c802-4956-9f6b-8adc5bc13d6d", "value": "T18F31CDD1A7D05DADC8E451BEAE47031473689F80E0C67123820C63A86D2AE799D26486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489831, "uuid": "df4a04ab-6fd7-460d-808b-999eb99608ca", "value": "24:uTAJqoKGpa7Urz/jlfojXK1hH9Vev3gRGH9iZBBuLlx/BX9gZgS:uTAJqoKGpa7UrLZ3IzqBuD/BXcgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489831, "uuid": "2ce8b56d-42df-489f-be70-1978b2ac7643", "value": 1496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489831, "uuid": "ec8500bb-fe5a-4231-bc16-1b24d79b5884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489831, "uuid": "fef27458-647a-40a6-aa70-87cadc546533", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1452627-085a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489610, "uuid": "006d41ad-888b-4881-85e4-994a01e1081d", "comment": "Malware payload (Mirai)", "value": "4d6119fc6a6da53c3a9e7fad4e1e63bb", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489610, "uuid": "430850ef-e8da-4292-ae63-5c4e612c286c", "comment": "Malware payload (Mirai)", "value": "b9545923f5fb7eb4f11e9f46c91705352c427c5f96f1d47fa20eb1ef8e445390", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489610, "uuid": "f1a7ccaf-88df-488b-bf1d-435c76d51eb9", "comment": "Malware payload (Mirai)", "value": "357422aed94fcb12d07bebd01110793f4075464f", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489610, "uuid": "39d771cc-0cd6-422e-9cac-c1eefcf1e10a", "comment": "Malware payload (Mirai)", "value": "bdf5add5f6dc63e05031b46c5148c70aece66ed7abd48bce1cd1fe6b9059799ee7e4bc6acd636bec8be2b9cd881ed741", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489610, "uuid": "56586c28-b562-4692-8a79-6a3ee7e1ca5e", "value": "T18C2102E292D8E932D72200F66686AF5B1725CD91385AFF0B8E414411ED3D1C0D132325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489610, "uuid": "5db143eb-8459-4f5d-82ad-d5d30045eedc", "value": "24:Fl8MoJFHxgxk2ZO4l2ZW8E7CrwvMMythGu92/4U6ruQfgCNf3:f8xL5wOewW8EWrwkMythh2/4tHfgCN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489610, "uuid": "f3b8c1d5-0822-47db-a93a-2edf4a1d497b", "value": 1180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489610, "uuid": "df1db99f-e7ee-4c55-b48e-7d960d34ea5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489610, "uuid": "55c30c3e-544d-48ed-ae85-85bfe0480c23", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c41042-080b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686455424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455424, "uuid": "cb9714d5-c6b8-43a0-a1c1-9370a48166cc", "comment": "Malware payload (Loki)", "value": "ef5538a4f8523b8087a46a4f0319a2ff", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Locki", "colour": "#CB38EE", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455424, "uuid": "8e0f1339-e3ce-46bb-8de9-e145127a61a4", "comment": "Malware payload (Loki)", "value": "bd2bb76d2426ff52e316859b830fcdf7a55d78b789345f27834422266866f98d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Locki", "colour": "#CB38EE", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455424, "uuid": "762778c7-4f4a-4ec6-b89a-133b6596b9e6", "comment": "Malware payload (Loki)", "value": "aab2a3d4b1de0e0f800d9a1648fcb409bb1c8e5e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Locki", "colour": "#CB38EE", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455424, "uuid": "87d1d248-8161-41ba-98e2-a942217985d5", "comment": "Malware payload (Loki)", "value": "b28bad214652f50f445e3b6f7bc754add4a2e6ade86b42771955d7a793511b0d2da638b2f98cbefe143807033b306480", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Locki", "colour": "#CB38EE", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455424, "uuid": "1ff8e8c4-6c08-4a50-88d7-c6e321d6e843", "value": "T1BEC2E4655B8C4C71E26AE8B7825EA00E18BCF63630C355C4BD9DE2747B7D10E4B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455424, "uuid": "3f9eb89b-beb1-40eb-b322-ef0e3c16859b", "value": "768:CZCT9Idu6OcUH5cj6eahCDZpEE+mwyWhzzdikn7Cj7Liy2K1V:CQ9IdfWU6eaoFR+8WHEb7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686455424, "uuid": "67fd2b27-0fce-4f39-bfb0-dd44075e8764", "value": 27044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686455424, "uuid": "dd8bc802-c5b0-4851-b739-1e218ba4f04d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455424, "uuid": "7918dfb3-d20b-414e-b74b-4ddc3d7d27ce", "value": "ef5538a4f8523b8087a46a4f0319a2ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d0b360-0851-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686485857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686485857, "uuid": "71c3efcf-fca6-433b-ae80-616eca6248c7", "comment": "Malware payload (GCleaner)", "value": "15f7afaacde0ad19992e41c867cf0e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686485857, "uuid": "a5216025-f5e9-4126-b2e6-b7ca3bef5ca6", "comment": "Malware payload (GCleaner)", "value": "c3c372d8f8bb81cf47aa95b668db4ec994acb075a3f6c5b1d2ec04593dc05442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686485857, "uuid": "ad78f7d7-1251-4d79-a746-a3672f4f650a", "comment": "Malware payload (GCleaner)", "value": "b8fcd6b953a8b42fb535f6c436d3f09fd0139d0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686485857, "uuid": "6f60be9d-914d-4008-bffe-5d1fdad56952", "comment": "Malware payload (GCleaner)", "value": "07ef6e5eb83c95317e017962c1b1e7cd109368a7889e1d9ff194895d04cc6bddb786aa7651abbb57d18f7f493674aefe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686485857, "uuid": "5b53b60b-1be2-4deb-a303-f29e2e115b7c", "value": "T1D4B523425BBEFA24C5D848F2BF5044CCB239A221BBFB151B6CF3E91BD4698457D1A60C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686485857, "uuid": "6a4fe55f-1ad6-4a47-a6db-dcb308a4c66b", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686485857, "uuid": "03981983-890c-41cb-9b89-1ae39bf8f63d", "value": "49152:J6dJ6sPlszWm+02k3fx/nAdXkYH/C8S4pSGr1tqWK1lCirZ+/TnL8Z6duee1g7I9:cdMstkNJ/rYH/v3pjr1tqWK1lC0+TnLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686485857, "uuid": "e9816a42-9cb4-4456-bd99-f06727cfd216", "value": 2383718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686485857, "uuid": "fab307a1-e962-4ce3-b569-de34f479b201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686485857, "uuid": "4a5169c0-5213-490b-ad46-d7ee23ab74d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f9e968-089a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686516910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686516910, "uuid": "1a6c2277-db12-44f9-bf83-9c65cd9e8516", "comment": "Malware payload (AveMariaRAT)", "value": "bab041bf5fff388863e4b8095f8533e7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686516910, "uuid": "8fae6c3a-04e7-474d-a438-c3e9d51a0e5d", "comment": "Malware payload (AveMariaRAT)", "value": "c3f542433ab84fdb5f250ed72c621573e896344c341d56556c84d5ef874e6960", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686516910, "uuid": "5b87606a-b3d8-4a34-85e8-5b01423265d2", "comment": "Malware payload (AveMariaRAT)", "value": "213f4312ad39d88d15700c94a5babd01d5ab3120", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686516910, "uuid": "ce62c363-f729-4d75-9676-c29d6568ba03", "comment": "Malware payload (AveMariaRAT)", "value": "292380f0e1e74d89f24425ac087db6a5a99a76ebc2949b4ad3373a8c120e160c78afe4d52cd9e40c87c84e484fdfbeeb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686516910, "uuid": "cff3f119-5abd-4d8e-bc56-9993af0d00f7", "value": "T1E0D38D13BBE64436E6F202B02DB97E7597BCF9341A25C68BA3945446AC32C44FE36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686516910, "uuid": "44fa428c-0974-4f60-b636-f093e2793db2", "value": "56fc94e02d7bc310030753938e49a91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686516910, "uuid": "123a5b64-cd47-421c-8fe7-5751f930c84d", "value": "3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686516910, "uuid": "e44b2244-5c55-4058-8783-2620a567f9dd", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686516910, "uuid": "660d2e8a-a15d-4435-b69f-ae554fe38862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686516910, "uuid": "3e8fb33f-88e1-4386-b820-20e8f4c3adc0", "value": "bab041bf5fff388863e4b8095f8533e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7146752d-0853-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686486497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486497, "uuid": "c73ac288-8c13-4f03-af90-6e8b187581dd", "comment": "Malware payload (Mirai)", "value": "f1ecafe9f46e71368b0436efd84a7f88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486497, "uuid": "eb424053-8811-4ccd-b426-819c728ef571", "comment": "Malware payload (Mirai)", "value": "c43ea6f88ae9492a27e4a42d380af43b75393ddce1fd1a0615d55a8844cb72ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486497, "uuid": "8cfa7dc6-11db-4bca-b47b-6158c43907e9", "comment": "Malware payload (Mirai)", "value": "94de7640ea93bf58312608cbc280751086cab95b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486497, "uuid": "5859c5f6-1306-41b3-b052-9863cb378d39", "comment": "Malware payload (Mirai)", "value": "00342794aa69a61950651d8d958b1a20466a0dbe697dd6b6d066f17c95fa5c1fb9395d658cbd3cde1125d873b3146ef5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486497, "uuid": "e7c9a944-fc67-4d86-a1c6-b1cee7d87579", "value": "T199C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486497, "uuid": "597c3feb-1861-4fa8-8f6d-ac12ff4d81b9", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpH+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8E9+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486497, "uuid": "1446ed8a-0f51-4029-b93e-5c3dce4bb8fd", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486497, "uuid": "1c2f6d10-a052-4a9a-ad0c-122563f20cba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486497, "uuid": "16ec6067-6d5a-4f8c-8f90-1fee74729233", "value": "f1ecafe9f46e71368b0436efd84a7f88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53f3ff0-0824-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686466532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686466532, "uuid": "a1d4127f-8533-41f3-9fdb-fcae3bbc34b8", "comment": "Malware payload", "value": "da4ee80c1cd71008a199b216b4f7dda3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686466532, "uuid": "5d152946-1267-42b1-a2e7-8e487b1de050", "comment": "Malware payload", "value": "c78350432da5e7f2f82243d367ae873020102a6c5aa1859fddf1e8ce7b418d21", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686466532, "uuid": "58a93d0a-0d47-4395-ba94-f3984d57f474", "comment": "Malware payload", "value": "af768a05faf58c990f32588177fad6d8c81a2021", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686466532, "uuid": "44a22034-7a01-434f-9dc1-aa36fa8c62fa", "comment": "Malware payload", "value": "3eaf0512b1c2b511bf1ac5265c5e396e96d7ea826011026ddb594de7afea2d67e1232e1e133e91598c9b294359295320", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686466532, "uuid": "0ba46309-0a1c-46e0-9a0d-9333a60c37be", "value": "T1A3B2475A5B8C4C51F26AE87B478EE00E59BCF22230C255C5BC9CE3747B6D10E4B6B1B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686466532, "uuid": "be9bb195-1152-4e57-b234-728bff68c07d", "value": "768:okgeHKeGdm3w2jKWq/OIIEFKDJ/zNY+yEdsQEFQxf9/FtAMw:obeHK1s1jKLmoKjY+yEdjEKf9/Fxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686466532, "uuid": "3fd4760d-22e1-4368-a99c-1b8376908249", "value": 25044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686466532, "uuid": "697be72c-70f6-4dec-a157-840a74557562", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686466532, "uuid": "717c8163-e9b4-4107-a4f8-0f3284d2fbf3", "value": "da4ee80c1cd71008a199b216b4f7dda3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a7287b-07eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686441811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441811, "uuid": "e4cba663-f738-4257-9808-5f99f37fa04d", "comment": "Malware payload (Amadey)", "value": "99bb91c77cc6e42ab6bcbcfe050a0cbc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441811, "uuid": "d1d956ce-5dc6-4f99-a3d1-c3e57b9f6521", "comment": "Malware payload (Amadey)", "value": "c78b25e7b2dfb79c1d4cdbfa1bbe7389a4f14144d9ec7f0ad06c9ca6beda38f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441811, "uuid": "42101646-e048-4cc5-aae7-a6650bb14353", "comment": "Malware payload (Amadey)", "value": "92ecc0d3692f81b08ffdb7078d3da6688c78e546", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441811, "uuid": "b455f5a6-c42b-49e2-9037-f76749888655", "comment": "Malware payload (Amadey)", "value": "ed5c2c655791d28ca4b8dfd55244a5aa60e1fbfdc686f308e4fbc57e590a1c80ce5d21f9e49f8bfbaf7bc4ca93b224aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441811, "uuid": "765da9d1-76f7-4b82-ad11-545d8a1a7ab3", "value": "T167D41203E7D89937C8752BB058FB03D30B7ABCA04D78579A2681A91E1C726C1E535B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441811, "uuid": "d7be3e50-7ffa-4e57-bdaf-55bbb0339952", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441811, "uuid": "88499028-b3e9-4e4f-ae9e-c179d2628b00", "value": "12288:YMrFy90g9Q4/KbqE4VmOpYn10QvzH8vAaJey8t:dyO4Kbq3cp8YaJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686441811, "uuid": "87816fad-ecf3-476f-bd91-2e8469c62451", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686441811, "uuid": "0536f91a-fed8-4854-8b9d-6521b3b66a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441811, "uuid": "fd001406-17b3-4abe-a440-d5d29f763281", "value": "99bb91c77cc6e42ab6bcbcfe050a0cbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47123f0f-085b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489862, "uuid": "13cc31a1-7f9f-4e69-8392-e4f735b58a0b", "comment": "Malware payload (Mirai)", "value": "005051b85e4c7edb367f63421fe7eb06", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489862, "uuid": "bab75d1e-f7fa-42f5-89c2-1f3ee5971b88", "comment": "Malware payload (Mirai)", "value": "c9713b3ad8be12b1d3bc6ae795deb5a572eee118787be2b97284355dcbdfb7bd", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489862, "uuid": "883a0605-0083-4527-92a1-aaea1340fad3", "comment": "Malware payload (Mirai)", "value": "37a60107c503872038ff28f73cb8cb4286657563", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489862, "uuid": "7118918f-3b39-4e83-8b32-dc7479595a96", "comment": "Malware payload (Mirai)", "value": "cf3460f65c1eb9f5ebd2ef289b9f09e67a126bd28aa46ed52b99672fc52d28eae1e422281fc2f22c145537c9a43c18cf", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489862, "uuid": "68d656f2-39e8-4da9-9ebb-fb26f8bcfb18", "value": "T19821FE00F21E1863F9E13EB473372B41976A8F0366195908AB9FE79DDCB8C30494D09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489862, "uuid": "408ac263-44f7-40db-8760-22b6823f13ba", "value": "24:3eAxpWS9nSWZ6S4/KSwISBd6oTKP5tAFl0+oNsqzktqKcvy5jaaTo0YOSMSHp6hB:u/gZVbXGANoXz2qKcvy5jltOp+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489862, "uuid": "11651bdb-377f-4c73-b301-74c02743b452", "value": 1404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489862, "uuid": "e7303219-d157-48a5-a977-884cef08ece9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489862, "uuid": "accd49c7-f547-49be-be4c-a0effb27d120", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de79e6e-080a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686455165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455165, "uuid": "1a6e6dc1-ffae-4617-ba73-0c44cd2a175e", "comment": "Malware payload (RedLineStealer)", "value": "2d624c7f085397f0872e01bdf813bdc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455165, "uuid": "aa5adc29-ff2d-4524-878f-d91c5c160965", "comment": "Malware payload (RedLineStealer)", "value": "ca447331085e7af73e68978ee559f0ed7f9559d96ea3a70513550768144d0818", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455165, "uuid": "2eea6bb3-348e-4e2c-8447-18705a5a62e1", "comment": "Malware payload (RedLineStealer)", "value": "6d52e786b02aea507f4f17427b62a232a3ab46d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686455165, "uuid": "a8097500-4c71-4223-b865-413f733fdb70", "comment": "Malware payload (RedLineStealer)", "value": "d0ae2332e98e3d1b9f1d5e050bc6848c46078307c95beb049aa166f21214c00b13a36c0d15808f3930704a4bb7e2f1e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455165, "uuid": "33177a77-0f76-469f-b222-fbda381fd644", "value": "T1A4C41203A7D84972CC76A77068FA12D31B37BDB04E3C939E2745985B5CB2284A47277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455165, "uuid": "41a31702-5f8f-4e5d-9f6e-cc9bcd079484", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455165, "uuid": "0467ed8a-e369-4421-a20a-0f2ef082d2ae", "value": "12288:7MrOy90keOMcK7P4y3Us2Zox7gQd8cYCtlM4GBrD:pyZIrdUnFQSjCDM4krD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686455165, "uuid": "d3a7e3da-c8b0-41ef-acda-324cbb32ee10", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686455165, "uuid": "79f145c3-855d-4baf-b6bd-40e59292909c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686455165, "uuid": "d3bd062d-b71a-4ba6-8da4-9e7e6416051b", "value": "2d624c7f085397f0872e01bdf813bdc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06264454-0868-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686495336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495336, "uuid": "fc443b37-3ef9-49bb-b6a6-95ff60bb9831", "comment": "Malware payload", "value": "e103d04bbd058354fe415391b05b1bd0", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495336, "uuid": "5fbf8c34-f5bf-41b8-832b-1ff3ef7d36af", "comment": "Malware payload", "value": "d20444b063f7143a5596eecf9bf13147988546ccaaa7a205d54c0b6385d5bcba", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495336, "uuid": "cdef80f3-baec-4a59-9b89-6bbb5816b015", "comment": "Malware payload", "value": "7672ad337ec869df53a42654093aa8ec9097ae6e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495336, "uuid": "648392d2-524b-4d77-84fe-f16820130b01", "comment": "Malware payload", "value": "2c20073259ad767b7b4156711dfc5f2e6e598f87f4c36da9b3d46998110ec62bbf46c364eb58d779bc986e98c2c5bb44", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495336, "uuid": "52556f8b-309f-4083-8107-addd7236e05b", "value": "T1BD8533FE48BA5E7F44DE1330887E0A64F2B69BDF227B06AC0B35065D0EE294D413D529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495336, "uuid": "1ac1e8cb-3c20-42a6-85cb-3272dbb92405", "value": "49152:pgxOvET9TYlvScDWzhOifdDxrWsSNLnrBHPg:qxQKklvStIifxxqFtnrBvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495336, "uuid": "f5abaefe-d152-49e1-b910-a474cbdab9d8", "value": 1756784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495336, "uuid": "9db5a599-c2d2-4224-a4f3-49650fc0a350", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495336, "uuid": "10bb9696-f31c-408e-a0dd-3a2401f5845f", "value": "Module-5--Statement-of-comprehensive-income-and-income-statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f24bf7-085b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489808, "uuid": "c0acd355-2b83-4754-8abb-efd239784d1b", "comment": "Malware payload (Mirai)", "value": "eebcaca79435ef756b8986e347210529", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489808, "uuid": "2617ba41-41dc-4ac3-896c-ae306f588959", "comment": "Malware payload (Mirai)", "value": "d22b1a488829d7eba4e0555d05a8ad8ae846c1443340ca3e8a28680ce75d44f9", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489808, "uuid": "a5ed2e92-2296-4390-83c9-d773dfe731ff", "comment": "Malware payload (Mirai)", "value": "b3bd5f1f6db1e8462479490cb44d6bcbc3e24364", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489808, "uuid": "de984110-caf9-4253-925e-23f545e1aa1b", "comment": "Malware payload (Mirai)", "value": "9b6db6ef84dc07c8c0682840b766091c48e9975df65897a07056499a5a9ddf68b1a5c03e1130c1d6d3ad6411c0a8c036", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489808, "uuid": "61243bf7-ac5f-4314-95f6-a67198479a53", "value": "T15D21CBD6A7E3AD1BCC540237DC9B6710E322BF80868EB513F35112160C3E31A0F2104A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489808, "uuid": "db119400-9920-41b9-80ed-f1e19b3d08f3", "value": "24:JJJ/0gP9qD0at6EoNGbCrUlFSy40VzLCkIdsx2H0QIDApNfC:JJJVFqDPtorkFSy4CzLGIDApN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489808, "uuid": "a002a49c-8434-4397-a570-c2e07d5467e8", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489808, "uuid": "649de935-62df-4be3-81bf-de642f6a04a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489808, "uuid": "116191bc-1494-403e-8d35-352907e0d570", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab8cec7-085b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489868, "uuid": "da0e0c4c-3739-4520-873b-fbfc92ebbdb9", "comment": "Malware payload (Mirai)", "value": "20e7a4986fed7313540c44217825ea55", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489868, "uuid": "5ec2d0dc-9eb7-4fb1-bca6-8dc3d5ec5d72", "comment": "Malware payload (Mirai)", "value": "d6d302929438b932f26ab06d0af4f4150cd266d544a9f05367357cbc95416705", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489868, "uuid": "a710c04f-6b31-46cc-affb-fd56df02ee17", "comment": "Malware payload (Mirai)", "value": "78a65831368ee22134532ebb2b09ac10ad76d1a0", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489868, "uuid": "c464f9d0-04f9-4098-935d-54bafe82e073", "comment": "Malware payload (Mirai)", "value": "71629c8f9a2b3de7e9fc635c97437ca64158c0e2b5a1cfa91322a9be1e63027da15fcb39223085a3a897eefbacb6de41", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489868, "uuid": "88b32acf-c816-4690-95a2-88d34d50e02a", "value": "T1042172CAB2C55C94CF24D9384E300321BB4AD979CC0FE3CF4F0892A82D3328C57940A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489868, "uuid": "5454460f-362f-4f63-8990-dcd5cd7bd305", "value": "24:jVm4llns9wdGtlH4rUpTXtWpG8Mta7ktmEyomKC1FGgkC7m1eapNfeB:5l/sOdIH4rUpTXtWpGltIEyomn1Ag773", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489868, "uuid": "6ac6a8eb-0dad-423b-9a57-f645fd369cd8", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489868, "uuid": "6b50340b-8f02-4c32-8a4b-3bce6e81dfb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489868, "uuid": "7ffe33b0-ddfb-49e6-bc97-554fa2649ac6", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3d4135-085b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686489847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489847, "uuid": "702818b2-c87c-486b-a154-804c7b0e4aee", "comment": "Malware payload (Mirai)", "value": "f12fe34c4babfa4fa08174d3cc622106", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489847, "uuid": "88c0d9cf-8053-41c0-b412-884bfc263c3a", "comment": "Malware payload (Mirai)", "value": "db01f632880749e874dab9ff45f4b7b53b193c9ce423cdfc25633cf952614a9a", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489847, "uuid": "2125f5fe-d95e-40e9-9b70-3fa144ca4508", "comment": "Malware payload (Mirai)", "value": "17578b554c6b9a7a47dfc1d8b20a80d63c9ae111", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686489847, "uuid": "196e3f40-bd2f-4af4-9ae8-981d05818601", "comment": "Malware payload (Mirai)", "value": "21718226908377f779f2b298d995a92b1a98e1ecb6ee9b492c521180fb40690333763d9ba33f3e731ac9003806b00580", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489847, "uuid": "d3e57b0b-f510-4183-8507-de000f014f1a", "value": "T1AF4102CA1F714EF5F556D53847370B3937AA514843C04289E1ACDA005EC430D89DE7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489847, "uuid": "f7c5d0af-5cad-4cdb-86fb-e0586c7f5cc0", "value": "24:3+iLdb5jl8AmslI3t8AmypR/z2H6llPOqtWB4u37I8paXDdz3N9l5zBkEp7i1liQ:Oip5E4GYg2Hyo1EXD/9LuEp9n3muSBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686489847, "uuid": "db1a453e-38d9-4cad-8b15-8ed03e80149b", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686489847, "uuid": "79807b47-7097-4ccc-9e3c-f66fa579a950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686489847, "uuid": "c3f36097-1689-4a19-9e10-23f0723b2a58", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7567558-07f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686448040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448040, "uuid": "5bfb2918-70a7-43be-990e-5b31ea5a1dea", "comment": "Malware payload", "value": "974385631874e63055137f1b0e441eb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448040, "uuid": "4bf154a2-a5ff-47d5-a944-2e2f963e1c6b", "comment": "Malware payload", "value": "dc94a603e996002fac39bcff717525d3d442ccaf78ab97be26b588275e8f2a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448040, "uuid": "28902d4d-412b-4184-addd-49d358554a1e", "comment": "Malware payload", "value": "67d7cde0fde6bc8b39b242713d403b82079470c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686448040, "uuid": "bc51127f-a785-430b-9650-f4b9890a3215", "comment": "Malware payload", "value": "3d1375814e348b2a5b4b6f41c4cfcf1df9691d0a08ba05a24046fd4c4622dcbfb0be47c42fd7c909eaaa253354a4e92d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448040, "uuid": "20edfadd-e7c6-4b43-bb8f-757c0ae3ce13", "value": "T155D42923771045A7CC2912B6683786A0276BBF7AD378424526EFB74E6BF73749412383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448040, "uuid": "2462cd48-984f-4595-b089-8328648eaac0", "value": "6144:PGpx9dauOriOU3R/ssEQueTqlJ+h2aBqMjR7u/QzmooARiXCFT2Fp6SQaofZAX:cdVDTqlJAy+RrFT2Fp6SPyZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686448040, "uuid": "639b42a1-4096-44b6-9738-b41e5a8830bb", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686448040, "uuid": "5472f868-e7b0-495d-bd0f-ea86b6f55142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686448040, "uuid": "443ebf7a-d929-4edc-81dd-669256916fc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db11f378-0809-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686454891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686454891, "uuid": "e05283fc-53cf-420b-8d5e-07fbd4cd2018", "comment": "Malware payload (Amadey)", "value": "3902a9e7e0c84e8f3554cee142e8478f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686454891, "uuid": "f71b1da3-97b1-4205-9a92-5ff1f394fab7", "comment": "Malware payload (Amadey)", "value": "dc9800714729a51a4d877748ad4b6a689db0603e0a21b389270b02fc0afede56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686454891, "uuid": "d5cd1c6e-13ed-4d0d-9eb3-32df774b76a1", "comment": "Malware payload (Amadey)", "value": "5c1e9d48cef42c7655a2c197cd85bef983977498", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686454891, "uuid": "2cba9f18-0b57-4143-90e9-4b2fb7083197", "comment": "Malware payload (Amadey)", "value": "06491efa5351f634e6ad71663282ab4063f81a20650584cea1bb576c909c46fa2dbc2d4d85c996f2559af7e341b88d9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686454891, "uuid": "fcf7521e-8d66-4f45-97d3-fbc0f95a2e56", "value": "T176C41243EED84427E9F41B7458FA03830B353CA19D749B7F2696A85E0DB32946A7037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686454891, "uuid": "ff044e90-e1e4-4bcc-8a8e-5d64042943df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686454891, "uuid": "9090c67b-e4bd-4aa8-899c-da343e259db8", "value": "12288:5Mr7y90fqfizHQWRygf6/PcuY6FTajC+qFIdkRRn:eymqfFWRyg+jTb+qOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686454891, "uuid": "cc872632-49fe-4b72-884e-badbdbb40d29", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686454891, "uuid": "67ede09a-8535-4055-8bfc-62ce13be3344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686454891, "uuid": "e9160e7d-9b21-451e-968b-1ae8fb0fc5e5", "value": "3902a9e7e0c84e8f3554cee142e8478f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06aa9803-0834-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686473003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686473003, "uuid": "ae47f8d7-f0bd-4ab4-bf32-adb2bdd0bbbd", "comment": "Malware payload (Amadey)", "value": "790dd983469f13b704557755bda6f6f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686473003, "uuid": "09ed80e6-8f31-44c4-bbc3-ab2ade95267c", "comment": "Malware payload (Amadey)", "value": "dd93e9773416f5352ab452a1e5c41bd3ca3e2eb79f3f486d410be4dbd9e1c13e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686473003, "uuid": "4daaaab8-c1a0-47a8-8e4e-23d9dcf68903", "comment": "Malware payload (Amadey)", "value": "de25f5d922c2c5ee88f8af964aa982e85259e739", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686473003, "uuid": "42fe0530-541f-4141-a4d5-df4f260cf914", "comment": "Malware payload (Amadey)", "value": "29bd26dc3cceedb0876c9ec16d1497b87b09db9f9bf31e0e9de4f070b39db9e1ccbbd628168db23f92897a54ff8f1872", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686473003, "uuid": "f409a96b-5c19-4a56-ac24-e388a744bc43", "value": "T1080523027BD94133E8712BB04CFB07D72A397E579970465B13566C4A0CB3A8AB436B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686473003, "uuid": "5a124b0a-9d42-455f-9fd6-ece650a395e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686473003, "uuid": "8bfd393c-82e3-4c84-b545-f1110c422887", "value": "24576:Sy9bb/w1b7NqOuu6S7Ajocdz+11rrkrJxkQU0v5:59b7knNXR7AjYbrrbQU0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686473003, "uuid": "97bd02b2-916c-4b2c-bbb9-2e40626eef94", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686473003, "uuid": "67ef0d24-eec0-4f0e-b50a-d6676f847524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686473003, "uuid": "09423347-2fd2-487f-b4b3-a596bc428f61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a498a48-0852-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686485921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686485921, "uuid": "8f0f832b-e621-4083-b220-39a289d9079a", "comment": "Malware payload (Mirai)", "value": "8e031cb56a82f8072ef8ec6b33df6334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686485921, "uuid": "bc2a08ad-981c-4fe3-b6cc-7e8a6cd7a723", "comment": "Malware payload (Mirai)", "value": "ddcd6597887d10885d055ab2c0693d1a089f1ae546c547ba0a467a3e7c355b9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686485921, "uuid": "53db7e0a-b46b-4d36-8232-2114e6c40f2b", "comment": "Malware payload (Mirai)", "value": "75448d643910380dab03acf8ddab6f22ddc21f6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686485921, "uuid": "36be4729-74c7-4acc-9c4c-642fa9c8d0cc", "comment": "Malware payload (Mirai)", "value": "8f288d0e84e36764b208c58b64f0dc086770c427517bb5ee6c48d76d721b758d48f7251db6a5f640b6877b1a04323eca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686485921, "uuid": "f13696b4-a391-4ebc-b6ef-02ac7e042cef", "value": "T150935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686485921, "uuid": "4214a877-3cd0-4d03-940f-8ea815851e5e", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3ryPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjK7ifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686485921, "uuid": "ad347391-e54d-47c1-b625-430fdbbd8163", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686485921, "uuid": "7cc137a0-49e5-4ac3-b9d9-1eb30c982da9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686485921, "uuid": "d85b33ae-afd7-4de4-87c1-765381a787a1", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73428333-0867-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686495090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495090, "uuid": "52bef540-ef41-4d80-844b-02ce7d005f0a", "comment": "Malware payload", "value": "6ee6f5909b5ff64e6c5624e567d65172", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495090, "uuid": "b763e897-e971-40f1-b980-867828ed3a6d", "comment": "Malware payload", "value": "de20267e7fca4f4b588fd6f00d8491a3813af4e2693c762acc42e8e53b0a79e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495090, "uuid": "7ecab1d4-7ad3-4a57-8e8e-9a41fbbe1004", "comment": "Malware payload", "value": "f086192dba4bcad12c243b10fa10a31e4efba130", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495090, "uuid": "abdfbb51-242e-4834-8e02-d5dd2ffe3d4e", "comment": "Malware payload", "value": "6c7cadcc2cd78c09c4ab27bbacd3a3f52666e6f57d5b6a3ef35f570d94423d6ea6aa47f0e4108e31ade77bb64fc2252c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495090, "uuid": "c90ea0b2-8849-4a22-93e0-5956cef05071", "value": "T1119318A2FD01EF66F00A8A3A45C707346630FF660B931E7172577A669A723C47427F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495090, "uuid": "b1359983-acdf-4b4b-a1ed-277b708c139c", "value": "1536:tkkfhBv27sG5Qai8GDN0hcb8g6UDuYAXibCw7y3kiO3IHUIN:tkkJBuMayccIgbNbCw7y0ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495090, "uuid": "25f135af-1f03-4293-a5c2-4c4deffb1870", "value": 89373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495090, "uuid": "9869faa7-3b81-4f0d-8f74-2e54c72b5f4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495090, "uuid": "b30cb049-75ca-4402-8ff4-8e11d9b65466", "value": "6ee6f5909b5ff64e6c5624e567d65172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a208c64e-07fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686449642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449642, "uuid": "328438ce-3433-4e62-a2b7-8bf381841951", "comment": "Malware payload (RedLineStealer)", "value": "07a75263f8c5db0e489cb14b86a3e20e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449642, "uuid": "263907ff-db52-45f1-9963-8f2acc24c341", "comment": "Malware payload (RedLineStealer)", "value": "e0286db278fd9987f11e9aa495968c1faad9ab389d15387d1b678d7172b0977e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449642, "uuid": "37edb679-2de9-4d39-bf7d-d910c3a02d68", "comment": "Malware payload (RedLineStealer)", "value": "4a4161a5821f9f1eff6f7ef47535ac8263d78fc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686449642, "uuid": "700cfa5f-50d8-453a-a3bd-bd0e4428f262", "comment": "Malware payload (RedLineStealer)", "value": "6fc2c884d2f13a645a34547272a62f252213fea981fa510cc7ac3a5b8cf6b54fc580466b39bc9b095187558607230cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449642, "uuid": "08b9539e-2090-4907-8ade-dc1c0ef3090f", "value": "T1D8052342E7D88166E5B42B7054F703DB1F32BC82DA70821A27D9985F0DB3A867531B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449642, "uuid": "e54588fb-e9eb-4a79-85a6-1dfa69600e20", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449642, "uuid": "826d206c-b356-4c03-85b8-b0c78c881c62", "value": "12288:+MrUy90LXv3p2It8/zDogh2BNs/klJeTYMUowtxc12MagNZVyqaW7aQCQ06aqU3l:ey+Q08bEpXhGJUowE1VamZHb7g93l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686449642, "uuid": "699294be-3ed2-4045-9271-cd63cdb9d66a", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686449642, "uuid": "719ae2a6-a506-4a33-a74c-d3ecfae0a0d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686449642, "uuid": "57d818bf-562c-404c-baee-3395fa2a8cf0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d425a126-0852-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686486233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486233, "uuid": "f597082e-220f-4399-b09b-015abcc29a8f", "comment": "Malware payload (Mirai)", "value": "b34c38d932fa44fd7ba203b0c8abd2d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486233, "uuid": "763b6cc1-8dd1-418d-90de-5a0bafa403bb", "comment": "Malware payload (Mirai)", "value": "e04eacb23d3b484d3cf2e7534fb792bafcefb59befa16f73a6587685b6463a50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486233, "uuid": "fa12684f-bdc0-4210-b814-b6f6952dc747", "comment": "Malware payload (Mirai)", "value": "b2073c93844d6066c8299e7e3c8b157b42bf96ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686486233, "uuid": "eca060be-6604-4daa-933f-20218ec57a8f", "comment": "Malware payload (Mirai)", "value": "5adaf0e5046dbf14e771818eecaf89329ad84792d6ce127ce2502a941509e223624aaa7693e7033b80042a20baafc0c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486233, "uuid": "1c9a7f96-9fce-446d-9cac-56ce0ebc0356", "value": "T192833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486233, "uuid": "c3d158d1-78c9-40e2-ab4a-a93515402038", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LYWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Y02oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686486233, "uuid": "7ebf7a59-461c-4538-a676-3cbb7f632dd3", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686486233, "uuid": "59d0537a-29a7-4a93-a07a-a45317cede57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686486233, "uuid": "4fd49e48-6a71-4a46-ad04-65715943ce40", "value": "b34c38d932fa44fd7ba203b0c8abd2d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5da459-0867-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686495080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495080, "uuid": "93ed3409-d49a-4b6d-a6fb-3d71d0554917", "comment": "Malware payload", "value": "1a9d867433f35bbc448b9aea44320694", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495080, "uuid": "d497d7fc-ced7-4af0-abda-7bd7b81bd0d7", "comment": "Malware payload", "value": "e6486b9f31a7004887e1e36b627f69844b944795784e2bf108e9cc8d1eaf4321", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495080, "uuid": "f4f13c78-1dd7-4c19-acc6-90440317a008", "comment": "Malware payload", "value": "49cc3cad220d7e18ac708faeea1938ff4bc61a03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495080, "uuid": "dc7837dd-7826-47de-8387-41539f430da1", "comment": "Malware payload", "value": "dcb3a09548bebaffc97dade3e6dbddd19c0278ffc981979d3dc34a04210f5dd5a928b1b643042a549ab3ed868ef9c8f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495080, "uuid": "2446075e-3d7e-4735-8db4-87b4d15e534a", "value": "T140C3766A3E51BBBEE5A8873107F35F70C399299226A1D781E26CFA185F7128C1C5F350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495080, "uuid": "7e559890-e408-40e8-8f80-9356f41ae169", "value": "1536:fVNy7K4v/V5KnaVIAsV/NdtkxGTYQH32rKAPtXG/uYe7ealuUD/sNO5e+vg8:KjtSToW/uYePuMhI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495080, "uuid": "3eea51c3-358a-4884-b019-5b418eb7a3af", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495080, "uuid": "91b7c814-f024-473e-a12e-4c97724b0c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495080, "uuid": "9866221c-7246-4afa-861b-4e15bc7c1862", "value": "1a9d867433f35bbc448b9aea44320694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d43c71-0866-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686494802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494802, "uuid": "346740ef-43fb-4d8b-bdf7-22831c4d5a08", "comment": "Malware payload (ArkeiStealer)", "value": "883f31e2b928f6d5a7123dcd84d696c6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494802, "uuid": "43be0bae-769e-43b0-9de9-8b757b2a5206", "comment": "Malware payload (ArkeiStealer)", "value": "e779097dea4435849f4c626ecd943bbfed6c74dbf01d138613c8490708e87c62", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494802, "uuid": "4f81262e-2fa6-446a-9e7d-e33c38c54dde", "comment": "Malware payload (ArkeiStealer)", "value": "d3077361c775db9741247331ab1f1586110dbe18", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686494802, "uuid": "41a05f2d-3401-4a0e-8d64-06e090a8dd6c", "comment": "Malware payload (ArkeiStealer)", "value": "1850839e4afe6d2db878cd3a32508104a17701dd99dd9ec3509ea1cf77376c637c8f88e858f0b52f0b92ea748f8da8e0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494802, "uuid": "336f32e3-8541-41bd-922c-020fb1e67945", "value": "T1BED4E02339008B91F26D12F2539A852D03ED5D7B39F3FA07ABE8737851B77B1188558A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494802, "uuid": "ff48921a-4372-4d2a-bf1d-9426ccd223ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494802, "uuid": "261727d4-5e1a-419f-a5c4-b561c8634030", "value": "12288:iLAQrnTCvlXfUaks2peBR3zfftaoKxh5/2xeHJyJlrDF64fzBKGyEh4hoABv:vcSlXfUaks2peBRjfM5l2xaEbh64rBDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686494802, "uuid": "96fba7f0-f098-4366-8513-206f4b926ab4", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686494802, "uuid": "2f5fed52-85e9-48fd-ace2-17070b656931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686494802, "uuid": "e0beb9b3-6628-4159-9be0-9ef51e64aafd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c2bc8b-082d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686470234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686470234, "uuid": "09e15c31-3e65-4a42-9112-f434ebcbc477", "comment": "Malware payload (RedLineStealer)", "value": "e112cd636936ca66c0307742cdca1386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686470234, "uuid": "6fd42e37-773f-43dd-93b7-91a708ba1ff0", "comment": "Malware payload (RedLineStealer)", "value": "e784defa774c379f5c7c4ba2991088b7d832491954e4b03d403b95f35557c018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686470234, "uuid": "513515dc-98c6-422e-8ebc-039ddf5553c6", "comment": "Malware payload (RedLineStealer)", "value": "feeb5d1165ff5c2a411326ba93602b83f3334dc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686470234, "uuid": "4fe3f785-c671-4d61-aa98-e2eafd758ce5", "comment": "Malware payload (RedLineStealer)", "value": "4d2e4bef62b0ded2932382b83453b389870f2b943bf794c7a294441c3b81497da740ef560e7de4cd7f23193fdc29f7e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686470234, "uuid": "3f42ad96-49bc-4c99-96c8-0e678ed3c6f0", "value": "T1E754D0617AE0D833D7628534993CD6E06D3FB8B25561888B72543FDF2B336816A6D332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686470234, "uuid": "070432f2-8aed-493e-939a-cd1db9d62f01", "value": "5affbd003e86f6425e6f5983fd37fec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686470234, "uuid": "ef4c00d2-71e6-49bb-a95e-bab34bb46241", "value": "6144:hf7oaK7ttHokY9/N3h1YybQofFqAqV936Et:9707fIJ9LuGQofFqwEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686470234, "uuid": "7180df0f-5bee-4c28-9a4e-4e32c29b22a1", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686470234, "uuid": "c3c23928-b935-4e41-ac5e-9bf903ec0276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686470234, "uuid": "87c114a8-a4ea-413c-b4e6-92fae8647261", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f6df1d-0855-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686487197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487197, "uuid": "19009c82-ebe0-45eb-91be-dc22ba407b92", "comment": "Malware payload (RedLineStealer)", "value": "f786be79b391f36352f91798e5ffec52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487197, "uuid": "432c3696-3f50-4a02-885c-48ee241f6bcc", "comment": "Malware payload (RedLineStealer)", "value": "f0c35e0f33dcf7167075c6f79b19aa0c99fd0cabe0c6f669d7454108de5122b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487197, "uuid": "5a0184a4-912e-48ae-868b-e4195400d9e2", "comment": "Malware payload (RedLineStealer)", "value": "770486035bfafe0c0bfa65ee837494fa3a3d84c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686487197, "uuid": "1bcb2088-3780-41f5-a917-06bfe8d87232", "comment": "Malware payload (RedLineStealer)", "value": "e0cf0bbc776b502777e81a63b62eaac508ccc7e597e04285c541435ed2273bf0b4478bdd89d2f3c7f289d4817c300e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487197, "uuid": "f52e724c-b8eb-4dfb-b0a2-14feb1769749", "value": "T1E354D0013AA1D436E6F345348938D2E5663BF8736975888B7244FFFF6C322819A66353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487197, "uuid": "b2adc875-c518-4817-ac47-4afec7fd545a", "value": "99f427a37c6c1a1f0f727259f833cfd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487197, "uuid": "8c71f19d-2e69-46ab-8e34-164b1f640cbb", "value": "3072:CNCk2zFRvgpg/W0BBMDAdSFYSpuK7f2jdy09o2lXecd/fzhZooqZtEdSGRk6ltDa:kCk8RvgpY7BBZd2Y47+v95rh2tEdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686487197, "uuid": "ce720691-1b0c-43f9-9e8c-c2f96410ec88", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686487197, "uuid": "8c7f2cb1-1b41-42bd-95ac-a5f433ca571a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686487197, "uuid": "f65f8f2b-bf70-4d69-8dd2-27d8f614b809", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f109887-0867-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686495056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495056, "uuid": "5d56683f-1a1d-4122-ba97-4258d9d08c43", "comment": "Malware payload (Gafgyt)", "value": "232bd423592812293e567822f03c4a67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495056, "uuid": "a01b5b28-32f8-416a-bfd8-de4ae5ebd4c0", "comment": "Malware payload (Gafgyt)", "value": "f9b4d0aa926b74ddd408433a30f19376b5d8844d011eb832ef8abb4fde8d1015", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495056, "uuid": "131fc06d-eebf-42e7-96d0-34175f35e540", "comment": "Malware payload (Gafgyt)", "value": "6de0f1d2caa26bf53bb980885727aeb4a0836a9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686495056, "uuid": "181ce359-d499-4645-ba60-58b37014e5d4", "comment": "Malware payload (Gafgyt)", "value": "9ec1fb2591743d7b43bf505b3fd24c6d5fe447e51493445b77d2104f7f997ce61ca986d4d3bff44dfec16a03452abdf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495056, "uuid": "be9c0bc0-10c2-4823-8cbb-583d1569efee", "value": "T1E2B3F805D9905737C2D23BBEF79A82CE73221F989797331186287AF41BE5B9D1E39020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495056, "uuid": "a54c06fd-1527-4021-8882-8f7cae908ba3", "value": "3072:o6z1WqLgV4ZQGBcD3i/lMpaLhmVAQ/iz1Ta3ErUxglryYl0g+JGfsJ2W:DhTa3ErU40g+asJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686495056, "uuid": "5fce315a-cd63-432e-b81d-4459dc411d97", "value": 117425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686495056, "uuid": "7ad51567-a163-4e50-891f-c8c83d077211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686495056, "uuid": "bd885fc5-4c6b-43a9-8398-473045caaeab", "value": "232bd423592812293e567822f03c4a67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e6ccbb-07eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686441733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441733, "uuid": "b10776f3-4369-48cc-8831-7206ce425c5a", "comment": "Malware payload (Amadey)", "value": "ff00d6b0dbc192ace7b8501bc296f70c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441733, "uuid": "825458c3-3c5b-44bd-b5b5-bfc6579fc888", "comment": "Malware payload (Amadey)", "value": "fdca79085867f759f16f8452a86fe82f0e2710d07d3b4aad3908524ba3fead0b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441733, "uuid": "d0c25879-8adc-4003-bcf8-8de1d206f8cb", "comment": "Malware payload (Amadey)", "value": "4c1fcc6e153add978819da0425354a9c070cf0a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686441733, "uuid": "9c379941-3286-4179-b03f-e5589a159f25", "comment": "Malware payload (Amadey)", "value": "0284fe5df30b1c9a6dc70ea46a4bcf254b08a1608fd1448f003ea9c27444b7ff350928efc49bedfbd6888c139652eb27", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441733, "uuid": "c0416180-b383-4244-ac72-4b0c9da26400", "value": "T1A2F41247E7E88063E9B207B068F613D30B3A7CA58974939F27956C5E0C72AD4643277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441733, "uuid": "73eaee80-d0e9-4adb-b51f-d522c882b424", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441733, "uuid": "8dc3c4d6-3879-49fa-84a4-cf491b87dc91", "value": "12288:TMrqy90db041cEM2/PGvRPNZT8LjrGi7A36nm5cu9zNbKtPjBkhh39:pyYb51vM2/mPHojhE3/h9zd4439", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686441733, "uuid": "b498ea58-ca12-4a5a-931d-fa4c47a50ed0", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686441733, "uuid": "cb4bb185-dee7-4cd6-8f4a-d1cd6229fdbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686441733, "uuid": "f1ab889a-8598-4d1c-8a5b-4d27787a7762", "value": "ff00d6b0dbc192ace7b8501bc296f70c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }