{ "Event": { "published": true, "date": "2023-10-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-21", "timestamp": 1697932981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d0649641-8995-4df8-b3d2-824e808d24c9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f1a427-7031-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697907034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907034, "uuid": "f34762cd-d9ac-4493-91c8-2989723b867f", "comment": "Malware payload (Stealc)", "value": "f8e00fa69a93b6588428a01cd00005bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907034, "uuid": "be86032c-afe9-4582-9b44-da12a804e0e7", "comment": "Malware payload (Stealc)", "value": "01ebe0ac65c34114b00fc6ee059b2e4e8035efdadedc1f2987690f43f2ef392b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907034, "uuid": "d4815b9f-9fc8-475a-86f9-309f68619554", "comment": "Malware payload (Stealc)", "value": "36005d288a7819d0df6fcaee30a5f6a92b61688b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907034, "uuid": "52cb97bb-89a1-4190-9916-fae0644df522", "comment": "Malware payload (Stealc)", "value": "98f888e0f24b080bb8d3f6407449d08e8e00416f3cdd33f53202001cefc4ad3ac8466fdc0d2d3f6ff263173508e4fe85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907034, "uuid": "858535cd-c490-4a83-8f2d-05bc5e910351", "value": "T1B245231AD2EC9123E8B127705CF702830B353CB29E7445372753D14E6DB19A1BA7A7BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907034, "uuid": "3745c81f-8a90-4d69-afe6-ce89228cacac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907034, "uuid": "72798a92-6f50-48bd-9057-6c884bbaebcd", "value": "24576:Ky8E/0ssMGgUe0qWstdWplO/NfSaWhSikoU4Lkye12c+tg9:RncssMGgN0EUpcfWhSi7EyeOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697907034, "uuid": "75f4220c-2aba-4b2b-9951-a8e39afa4ed3", "value": 1235456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697907034, "uuid": "1d7768ff-10d6-4d15-8df9-688447f37e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907034, "uuid": "6eb1b0cb-6f81-4d91-8cf4-16150da8e4ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fd6d22-7032-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697907195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907195, "uuid": "3a312ae8-2fb1-476c-b25d-5324a192fee2", "comment": "Malware payload", "value": "57a52ff18ab1090f3f09d62d2bf2902e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907195, "uuid": "6309dcb6-2860-4aa6-8823-971a3aff0612", "comment": "Malware payload", "value": "05c0453f8d82ccd0d41cba4ee0f72217eb2dc6d054714d65686aed053b05da6e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907195, "uuid": "6669d781-b3e4-46e1-b933-48e2666b4892", "comment": "Malware payload", "value": "bf23d5a7ccaa4928308493325200452f54c6f60a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907195, "uuid": "36a6a0f4-60a1-4f21-bbce-2d51bf85a5ee", "comment": "Malware payload", "value": "f6d0e219234f86fbb39cfa5f40945d9f4d15f715e04f2aac79f72568d2d8c89dea00b150578c04844bf8051f5a0f3121", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907195, "uuid": "35f2558c-e9a9-4dbf-bfb0-3a3b2c0572cd", "value": "T198F2D822DFBB25DF1066CD55D7E301A3D264A41E1D9CE79A48C203DB4B9BD03885BE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907195, "uuid": "a0a60d5b-aff9-44a5-90de-669c52ce0e5c", "value": "192:ayVpVUbHmIb+V6Vx3M+UPCXnhjAb+2kNlzAdgoAwYLo5nQAzN:1LOswx8+8CXnlADkNlGYanB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697907195, "uuid": "cf357e33-dc92-4b3f-bcd2-d45ad649e3e8", "value": 36550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697907195, "uuid": "3821c64c-e3b6-445f-a34f-b5da06cfbce5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907195, "uuid": "b5335b67-ad40-403e-8392-7ed3f171f8e2", "value": "sample1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dad915-704e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697919083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697919083, "uuid": "0b00688a-f1b7-4586-a671-192e9dd0a0be", "comment": "Malware payload", "value": "1a895fb5106e2888e57acd979d152dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697919083, "uuid": "a33f81b1-5579-4628-87a5-7944b7435972", "comment": "Malware payload", "value": "065c379a33ef1539e8a68fd4b7638fe8a30ec19fc128642ed0c68539656374b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697919083, "uuid": "5746155a-a04c-4e23-8a34-54f3b85e17a4", "comment": "Malware payload", "value": "75bd82521197cec492fab4407b7c07347d06fabc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697919083, "uuid": "cfb9117b-4d3a-4121-bb65-8fbdca5c873a", "comment": "Malware payload", "value": "80edeb64bbda55169dc98740d723821ccc55e56f097f8ddf2416646e5d0f53c352bac26a752b9163bbf98bad0773b2bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697919083, "uuid": "29660b4e-6421-4025-9d60-484d19d013a8", "value": "T114D4C50177F98226F1F36B70DEF54255AA37BC916A35C28F120066CE2971A81DAB3737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697919083, "uuid": "39f98af0-3295-49b8-b29c-da5f9e59fced", "value": "ae30e7bff465b34645e413bf3c20e58d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697919083, "uuid": "e1655d3d-9a33-4610-83d1-413095f1b7bc", "value": "6144:xp861gYcM22HYpDW1Y5VQqxdprPW2CVEvOcYb:o62YX22HWC1dqfqVEvKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697919083, "uuid": "cbe2a1e9-218a-48d6-82cb-608ec77af921", "value": 630128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697919083, "uuid": "e6604651-b22c-4498-b562-b18fdcce0d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697919083, "uuid": "1f99cade-e49a-49a3-9330-094c4ad77277", "value": "7882332526271ec2fe2292f41574024cd69deb3b7a0230dfe85378fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e2b615-6ff4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697880430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697880430, "uuid": "e620b649-eb5e-4603-a94e-0f90a469f9da", "comment": "Malware payload", "value": "72f0d45c0000302756032bac0078996f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697880430, "uuid": "75f3d3ac-3787-4995-b6be-5c768aaff6b7", "comment": "Malware payload", "value": "070b8f94f3e279879203a4faa1e487100ced40b52b2806f8fa3fedf8e740da01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697880430, "uuid": "8a7242e2-8cb9-45ec-9c13-24dd9c164aa2", "comment": "Malware payload", "value": "4aedd986adf55e9e920546c80fdafc449b3fcaec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697880430, "uuid": "642cd881-38b3-48aa-abb9-c9a5670e2f05", "comment": "Malware payload", "value": "ebe9acc209dbf7f6bb69be8ebd025415377b252bc490874f41cef13c97b8a700126b5ad34119a2388a4f067fb6d5e0d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697880430, "uuid": "e2b5fbcd-ae58-4c4a-b4f1-4be0d3063933", "value": "T17F452303D7F89422C6FA5B3094F717831536BCB64E34C3172366A4886AB2E45A87677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697880430, "uuid": "eac05199-54a9-43b4-a5c1-6a40e254f1ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697880430, "uuid": "3ad77398-7786-4cec-9d9a-e1154c87e835", "value": "24576:IyAKrh0tp271Q2x/jv1hkhAUsqHTyjJd+qDEUmxeGsv7ww7g+t0bbYxL2jwz:PAK4p6Qo/8CUsqzyJ1DTFZ7L/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697880430, "uuid": "67f412ac-e56d-4d52-90d8-9311f5d5a3d1", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697880430, "uuid": "ca2b7132-497c-49bd-abf2-8915c5fccb69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697880430, "uuid": "99403c81-a4c2-4f3a-8551-898ad953f3ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de797a7-7029-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697903400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903400, "uuid": "1bf41f06-f3bb-4f27-8cdf-d0b675b86049", "comment": "Malware payload (Mirai)", "value": "60caca36e4980c8879c7a983876a63a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903400, "uuid": "b9474d97-0ab2-425f-8ab6-f261ce1a74dc", "comment": "Malware payload (Mirai)", "value": "0862ecd7e614cc463128e830af631b2fc30a86b62b0a12c012dfe8fe45a8361c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903400, "uuid": "ef26ad7b-7a29-405b-8387-91282b7a51cf", "comment": "Malware payload (Mirai)", "value": "7c2b46ddf12c59f8a1d2b3ccdff8489e757e5478", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903400, "uuid": "f48eaf22-5843-45d8-8246-5bfd23697e0d", "comment": "Malware payload (Mirai)", "value": "344e2609e838fca812a0a7bc63828ce1aae92593877cdf196094962c14e07b7ec27c170b04e14cfc539d19fd9af0d9ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903400, "uuid": "66556b81-bf9d-4c23-8120-5a2b805a7a2f", "value": "T14C042A46EA408B13C0962BB9FA9F424533239B54D7EB73059528AFB43F8779E4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903400, "uuid": "cedc0893-cd9a-4bb9-ac17-2a7acd82f55e", "value": "3072:1PkTrBwTcGIjbaOVfi9QNnrQUSABLtut+hJUoNM/RxKn4G2Di:1P2wTjgbaOVfi9QNrWAZtut+/ZNM/Rkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697903400, "uuid": "19e413ec-f2b8-4480-b4a4-101288fb3a9e", "value": 180483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697903400, "uuid": "1b433d09-464d-47d0-a70e-d5d16b73720d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903400, "uuid": "838fe815-913e-4cb3-8dc8-ba1f8c5bf61f", "value": "60caca36e4980c8879c7a983876a63a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd533fe-6fd2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697865899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697865899, "uuid": "059c11cf-7acc-462d-bf07-117c049d59ed", "comment": "Malware payload (RedLineStealer)", "value": "4ae5addc04904fba5da846306e404a70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697865899, "uuid": "12f4146f-b9ce-42d3-858c-cb556b8bd2e3", "comment": "Malware payload (RedLineStealer)", "value": "0a4cc7f02c09e2538412683168e408534442d21f35a5903b4220cd844be146b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697865899, "uuid": "720daccb-0664-4dea-85b8-93fccd75bca9", "comment": "Malware payload (RedLineStealer)", "value": "ee0e210a0ed9084206d54235427a56ee252637db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697865899, "uuid": "91f60352-55a0-4587-a9c0-af42f12409e7", "comment": "Malware payload (RedLineStealer)", "value": "e947c5a715cc65bc0d6d92cf9d177c00345b99ac7e4322a1844aae6670066adea72964bc3d29914f926784650ab51f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697865899, "uuid": "5e0a9209-3d86-4e9b-9801-8d97e0753bb2", "value": "T1F7652317F79450B1E8F53BF09DF313836A74BC61D87C8722738668A84973A8921747AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697865899, "uuid": "3e3e5923-795d-42a2-bc74-df08b617bd81", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697865899, "uuid": "e0bb7b5d-9775-48df-bd31-b8066e1b776b", "value": "24576:ryRyTaPVDf143olEneVh1RAUoshNjxjTZ44MCW3L9z0zTK6gQe0eExsCsz/BTQHA:eRyTcDf1plEnG1yUoshJxB4RC8o3K6g+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697865899, "uuid": "ac7624b5-57be-4b3f-88c3-6428dbc8e7bd", "value": 1515008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697865899, "uuid": "ee4be6b7-118e-4246-a914-ce63b1fac39f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697865899, "uuid": "c2d9dc54-f44c-48d2-b580-98a2dbfc64ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48daf33c-7066-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1697929510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929510, "uuid": "e2d6c7cf-6d73-463f-805d-accc64aeb231", "comment": "Malware payload (DCRat)", "value": "2b18f286e5983f9fadde8eb63df7251b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929510, "uuid": "bbf9d26c-6888-40f7-8b01-45d7b1d9bde3", "comment": "Malware payload (DCRat)", "value": "0a7906ac80f2e3dec90365b47e62e57d77f4c389c55ce21ae0908d087ae2e662", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929510, "uuid": "c6eaad35-357b-4dba-84b4-0c2da6511176", "comment": "Malware payload (DCRat)", "value": "e2e7cfa5b61c80173d1e9dd2c8b28b6fb96fb1c7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929510, "uuid": "c58cd039-3121-4e16-8538-6f726705e359", "comment": "Malware payload (DCRat)", "value": "47d49b5be8ea996f7d16fc99fce116f92b854bdc660b56ae6653b57da534e716df7a15a89502cfb54eef12050e5f43df", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929510, "uuid": "65ab6b87-d857-4f28-b53b-17295707c302", "value": "T1FB06F0027E858E52F0195273C2FF850447F09D91A6A6E32B7CBA33AD55163A33C5DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929510, "uuid": "b598efcb-4593-4c14-9697-08f5b73e347d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929510, "uuid": "671d6cb4-b13c-4869-bdf4-bee5a26bcf35", "value": "98304:LqfrPDgC+3dOf83rECUVoVzJ6JT3U8Av9hE:LYP83dOf2Y9VoVN6VE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697929510, "uuid": "a08efe86-8779-41b8-b395-6a7061cd6c3a", "value": 3842560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697929510, "uuid": "d0eea729-4d77-4515-9822-b5c5f7181a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929510, "uuid": "c8476c62-ce8d-4ad1-a883-6e6ccfab0303", "value": "0A7906AC80F2E3DEC90365B47E62E57D77F4C389C55CE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882d9ab7-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697884519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884519, "uuid": "5385e86f-4eb4-45da-be70-ec9ec2918ecd", "comment": "Malware payload (RedLineStealer)", "value": "0424a2014aa6a760ff7f33851af1ef5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884519, "uuid": "f7ccf609-b9ee-4ff4-874c-b643de7d1a54", "comment": "Malware payload (RedLineStealer)", "value": "0d5b3870b364273d78939b4e6e0207d8fb111ede747db6da4cca33b9649999dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884519, "uuid": "4fc771dd-1ddd-4ac2-bbaa-946d4c437dea", "comment": "Malware payload (RedLineStealer)", "value": "cf9215ea01c4a8aec650a4cd66f07d8229573e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884519, "uuid": "1ada0ff1-1f5c-4dcd-9384-b0a09cf48589", "comment": "Malware payload (RedLineStealer)", "value": "26a53b616949c7d3beda13ddd77ab0d8260cf471a522f87ab8ac2c43c8e070a933ff02b88f2cbc36504f5ce6dd096a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884519, "uuid": "9f23216e-f1a3-44b4-9a57-dfbb179d16e0", "value": "T1CB157D2139C18132EDF320BB87ECBA3986ADD4B0071952DB26D857EED7506D27F32592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884519, "uuid": "a382a2aa-5dda-47cf-b8d8-d93327f40a1c", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884519, "uuid": "60464a5c-aebb-4225-8bac-52997b145792", "value": "12288:RdxAfZPOHiJMRxxcZ541BYlLckufEjWky8ot1QyuG/yuD3rCB03yIJ:QPOHiJMRxxcZ54bGcNfEjXU1K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884519, "uuid": "9562540d-96a5-4c18-9033-8041e8aa6319", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884519, "uuid": "fc04d102-a0af-48b2-a09e-28c67c9178d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884519, "uuid": "28d9e4ab-06ae-4377-86ba-173353534395", "value": "0424a2014aa6a760ff7f33851af1ef5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9258d643-7000-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697885825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697885825, "uuid": "e75641e6-e44d-4fe8-b7e0-06160d68a573", "comment": "Malware payload (RedLineStealer)", "value": "6078b4db5070b4d06e79de10d65de523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697885825, "uuid": "51251ca0-4d00-4d15-9c4e-ac850cb9ecbd", "comment": "Malware payload (RedLineStealer)", "value": "0f99677095ca8199a4988003afe3eb753de31f6137225ff3c90bbe6ecc9c2dbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697885825, "uuid": "8c9c3941-6788-4b46-ab34-687396543687", "comment": "Malware payload (RedLineStealer)", "value": "397079a2289d4eb87532bc3fc619850a001b20d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697885825, "uuid": "121a4b8f-96cb-4d88-9838-7cc12ab5bac1", "comment": "Malware payload (RedLineStealer)", "value": "b1f0ae5788786d8179fa535767ddb3402b6ecfd7e433eb3b968d289496af6f227c8c306fac05c22368f6605aabbedf61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697885825, "uuid": "0a4178f0-9226-411c-beff-fac3209bc332", "value": "T16D356C217BBC9472EEE2137A97FCBA2D425FA0B4072D0DCB469406FE87503D16A355CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697885825, "uuid": "26cb6749-0a7c-44a7-bd3a-c546f6b1e483", "value": "7104476aa32cf4b45f58ce5b636dd82a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697885825, "uuid": "bc11c767-1a62-4684-8de4-ab438aa69504", "value": "12288:OZ7x7QahWaZec5v5A9iH9LKe3iSbTtXFd+mKe5OLfaY2X1s2ZQ0c/CEulolZq0Vt:yVQSWaZeQ5A9iH9dJXSaYosn/Cesu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697885825, "uuid": "4812ac61-7374-4f1d-874d-00ce9291a489", "value": 1058720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697885825, "uuid": "482e8458-692e-4688-9259-a5952161665e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697885825, "uuid": "62f151ce-f7b7-4c8a-9a0a-e1c73e21ef99", "value": "1redline.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43098a7f-6fc0-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697858204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697858204, "uuid": "bf36e259-8d97-43ad-a021-a319e0ea0c88", "comment": "Malware payload (Stealc)", "value": "985467386eeb8c8bb14a22c3c9bdb5d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697858204, "uuid": "39bdef56-fddc-425f-b291-99ef763eb2c7", "comment": "Malware payload (Stealc)", "value": "0ff936d7dd5a0320c144169ca98662091610a619e3a11d08fb826e85fc115e56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697858204, "uuid": "ce4b4d08-b32c-4d11-9046-96d4522ba9bf", "comment": "Malware payload (Stealc)", "value": "bf33b33103a63767baf558919879042f22c2b3b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697858204, "uuid": "5f96746e-821e-4786-b2a6-7b101a2104ca", "comment": "Malware payload (Stealc)", "value": "444487002ea14c3716c125cd53b4979ee3756bbad1095ea4707c25bc7483ff61b05d6ee72b22ce320bc16834941b62c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697858204, "uuid": "e09dfb62-1baa-4185-a6a5-2254a7ce5b89", "value": "T12965238BFBD42212C4B9233050EB056317377CD19C3466E613A66C9E6EB368CD5B6B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697858204, "uuid": "e70a8ae8-3fca-4ae0-a37a-ace13efc21e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697858204, "uuid": "5866be55-b0cf-4220-b8fe-779358cf1541", "value": "24576:YyG/yq/ZNCp4YbHlYPhjxJzqRq25AR4rd1bNQODNqhTC1X6QVP:fy/jOZqVx+q25W4R1bOOB+ON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697858204, "uuid": "fc0e4b5c-17cb-4b8a-bd3d-bcbb011d70f6", "value": 1500160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697858204, "uuid": "d57a8e85-0f83-456a-86d4-811eefc0b9aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697858204, "uuid": "2ca38777-362d-45d3-b89d-a40fe3e8b93b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6b4940-702b-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1697904444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697904444, "uuid": "11517350-6af5-46d6-b115-1fa252455f6b", "comment": "Malware payload (Tofsee)", "value": "7b17845fcb90f8edca364cb8b5fa8416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697904444, "uuid": "406c2adb-f118-4e4b-bfc2-3e15c362f381", "comment": "Malware payload (Tofsee)", "value": "116fb7f320730fc107d315ce12c63885ad52a93e67e56c9475748efe5d471e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697904444, "uuid": "16e9664f-275f-46b1-b119-b9297a0eb0f1", "comment": "Malware payload (Tofsee)", "value": "26e88806f29c4cfe9317c25f03a6f3123d4a7083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697904444, "uuid": "74bdee2a-0927-4baa-9565-41498aaa14b6", "comment": "Malware payload (Tofsee)", "value": "9749f2b07390d928b389db5e70b79e09b6b29ef2e2520e3b5c1da3fa54501ae9b177d29fc924b53361b959817cab3d7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697904444, "uuid": "06bc2555-695d-44b8-a1b3-b500d70d0544", "value": "T13B44BF117AA1D432E0A669354870CA955A3BFCF2DA3481CF33943E2EAD317D19AB5F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697904444, "uuid": "f5393ece-0ef8-472c-96f1-05c6f594c49f", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697904444, "uuid": "401acf62-8a6d-4395-9f97-1190b8b77525", "value": "3072:NyBNAbd0xAhziy83tsDiSv3Y3n2Kp+iHyGZHK9XjJ:YadiAhuy89TSvmoGwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697904444, "uuid": "5cb5ef5b-0589-428c-9326-028c0730e970", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697904444, "uuid": "6e2006c1-0e35-4329-afe8-cc4e6e818540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697904444, "uuid": "0cbac625-4a84-4cf5-aa45-5a90f009f397", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea1c6af-7022-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697900395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900395, "uuid": "3951fd01-a4e1-4a30-b7b8-cfa313ee4ca1", "comment": "Malware payload (RedLineStealer)", "value": "f7d078a3369602da422690fb9c0621d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900395, "uuid": "a10b73eb-684d-4727-8025-8f8ebb77a439", "comment": "Malware payload (RedLineStealer)", "value": "11af2332573aa1e811c2d680dc8d23c2e0322516e3559937503938dfff170115", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900395, "uuid": "dce1745f-53af-439f-8d4a-85fd99663e6a", "comment": "Malware payload (RedLineStealer)", "value": "a5e79f46bc120ab63cf44b5f9b32d3f0708b9fa3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900395, "uuid": "27178d86-55c2-4cce-8a52-e9c523ba22f0", "comment": "Malware payload (RedLineStealer)", "value": "1c665cbdfb5140b3f002aac6a7964154fdd23c9cf723d2cb0f8a61b5403714a03229626729b7a552353a3955776c9f5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900395, "uuid": "ed1617f7-18ef-4356-96c3-e516527cad70", "value": "T1CB452303A7DD8473DCB0377068F242C30A36FC668D7C4A9A73829D995E633A1667537A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900395, "uuid": "e2774a3c-1e2a-4ccb-a44e-b8877bd21f75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900395, "uuid": "b84d7020-8005-49ec-8959-4f65b5dd2af2", "value": "24576:TyPzAaFraCPOCYXqUBsBmaNZG5uNduUz4wKJwosR3RenP1i:mcaFra6YXqOsBmaNZauW3wxosR3Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697900395, "uuid": "24d58fe4-c919-4d0a-a9ff-854dd0ea721b", "value": 1227264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697900395, "uuid": "0c205047-2b41-4c2a-918e-1ca65aa9e498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900395, "uuid": "f9467a6d-25e1-4ce5-9d1a-aa44ddb58b1a", "value": "f7d078a3369602da422690fb9c0621d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8995c6ea-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697884522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884522, "uuid": "2d657524-a9fd-45be-8705-00b28ee781e7", "comment": "Malware payload (RedLineStealer)", "value": "20c368b4fbacb55174d8ab4354cc7afc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884522, "uuid": "5b4bf51b-5e80-4c7f-b3d1-6a67d5f1a22d", "comment": "Malware payload (RedLineStealer)", "value": "1215bb847f20382a6326d3db6f797c41091c7703fc87bd037d1a3479b2a8a33b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884522, "uuid": "f85e4c57-92e3-4c8f-8e7d-6ad80d34a691", "comment": "Malware payload (RedLineStealer)", "value": "a31bcefdc0c58662e355fcceed118732b4db829b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884522, "uuid": "d6696b5f-5656-4717-b318-f2a54b9deb79", "comment": "Malware payload (RedLineStealer)", "value": "73fb2a5650cb71a8ba58e5f98ce58df824b01f95919ae93e6d92ee6210ffae1b184ce1ead8c86da858f84c1b68e31587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884522, "uuid": "4e24fc8d-23c3-4fd1-b35e-e05e41f9b49d", "value": "T144157C213DC18136EDF310BA87EDBA3A86ADD4B0031912DB16D896EED7506D27F32592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884522, "uuid": "b463eeee-7b2f-4cae-b734-eba9deecdb50", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884522, "uuid": "140de584-1278-4b0e-bfb9-2205e9831f87", "value": "12288:/9xLfiPOHiJMRxxcZ541h4VLcFufEjG0i8otVxSd2/iuD3OYCzT6GJ:ePOHiJMRxxcZ54bWcsfEjnUVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884522, "uuid": "c0281159-fb32-4bf9-9494-d187a3c8a652", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884522, "uuid": "9cbf3578-0d0c-474c-94b8-aafab702585f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884522, "uuid": "01a8dcf6-58a5-4562-a36d-4955b42db38a", "value": "20c368b4fbacb55174d8ab4354cc7afc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9156d5-7022-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697900416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900416, "uuid": "acfc5979-217c-4bfe-a2a0-9b6abd06691e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0711e23d2902f70311f03cc4a658362a", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900416, "uuid": "3ce34cb3-f1e1-47b6-a8c9-6ba6953c7d9e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "129fc7deea5ab9985c016ed6882e2c5c1f4ef971580862b68fafb0cfe387ee47", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900416, "uuid": "5d78e89b-885d-49c6-be6a-50f805f35625", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "801d9c530001ccbb756b09976d2e53ee103deb5a", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900416, "uuid": "c0a043d3-5448-4243-9db4-27cd501302ae", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "cca41b66ef76fd945e51d5e127224b270344f7b11f4a2cf25fffda69e8e5fbf0317e28cac306080b09d337893cb45dd1", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900416, "uuid": "8e3128fb-b56e-41ec-905a-88a066e7aae9", "value": "T10BF41266E2E8A236DDB5277009F617D30F3BBCE28C78435B3755584A4CB36889839727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900416, "uuid": "214ad36b-3aba-43b2-aca4-38fe201d66c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900416, "uuid": "fb9defe7-4bea-459d-b11d-530a609ba64b", "value": "12288:8Mrly90l3AxD1OdMC1kLGed/X/uuAfmVK9WOMJF5E8G6JItDuTuAVhwR7+yi:BycED1On1G3X/rAfBvC5HmWu1R7+yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697900416, "uuid": "1cc85c67-5025-4e00-b3b5-bfb42fcd62ed", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697900416, "uuid": "6963ad22-d392-462d-98f5-b7c5641535a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900416, "uuid": "5d56e255-ab7e-4e69-a7a6-d23915f5c4fd", "value": "0711e23d2902f70311f03cc4a658362a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076de3ac-7023-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697900624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900624, "uuid": "30d70e31-5aed-4c97-84b8-cb0094e429a1", "comment": "Malware payload (RedLineStealer)", "value": "1ae5434a7d1dd6526271f7ac55040d65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900624, "uuid": "3fcc7c8e-0104-400a-b285-996786d69021", "comment": "Malware payload (RedLineStealer)", "value": "158be3cf22938150dea1dc5800fd1c49b23afdbc58b084f89b815b4a6bce5623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900624, "uuid": "8bfaaa69-31f8-42b6-b230-4459bac18107", "comment": "Malware payload (RedLineStealer)", "value": "94166c23b8f4d7d47819f31502b8222d36beba8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900624, "uuid": "15709f80-e997-459e-a26c-26913585f972", "comment": "Malware payload (RedLineStealer)", "value": "650160e61bbe1b5d94805b83b344dddc841dfbb1d9f46ac3b17c011eaac0d39583304b2b960bf8e5f83f14c82c3c3c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900624, "uuid": "146a9154-ea63-4ff9-b47d-5fc26d2d38e1", "value": "T1EB452357B7E6C472D9F42B7068F711E70B347DC198385B0A6785A8C91C732E8A1B272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900624, "uuid": "db3a0cd7-7330-48c0-850c-37ac325ed353", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900624, "uuid": "cf20ce5b-acab-4711-a3d6-57fa279e69df", "value": "24576:hyNNvQUqHkUmOB4YVOT5SReJGfvfe5Njw4WjnabOm4Uk7k7:UNNvZVcjOIRyGfe70HUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697900624, "uuid": "a67cd92c-77af-485f-ba80-a3abf3bacbb4", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697900624, "uuid": "a560cca7-edef-4a58-b6db-b768beea21bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900624, "uuid": "8406ccff-058c-43e0-8708-897fc63de565", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6e8967-6fc9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697862246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862246, "uuid": "8084b5a9-8014-4143-a428-53e282e7b5b1", "comment": "Malware payload (Mirai)", "value": "732c1d415abb94f2eca1edad6f5c7869", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862246, "uuid": "9eb8672a-b231-4b5d-a43d-32549e4d686e", "comment": "Malware payload (Mirai)", "value": "173c13df79cbf1828e3ad521deb287e51a9b5969d65a26ca8fe7f39809c5d86a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862246, "uuid": "76425a62-ae4e-4732-a4a0-86b862f84aea", "comment": "Malware payload (Mirai)", "value": "4a77bc19bad01bd22bd5aa62a99acf3dbb20b644", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862246, "uuid": "c8e27fc0-6d37-452b-a413-6c28f8b58aac", "comment": "Malware payload (Mirai)", "value": "cb8ab7fdaf806b3a10b763a23e3a6d0d339872b01cb2fc66fa481477109c29d51ef6204aef9054171e3ea0aceb5e8c4b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862246, "uuid": "06529a09-4a08-4e20-a1b5-9959477a38a4", "value": "T1FE04885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862246, "uuid": "c4d9ec2c-4ed5-4d63-8ea7-29b16ef222fd", "value": "1536:Cl2JvnXPQLqQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zst/Y:Cgv/tcwZsCK9VRhAX+bShFSP0HbbslY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697862246, "uuid": "0ccdec24-d403-4433-85fd-75397b2f5247", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697862246, "uuid": "c3f0f916-ad97-4927-857c-85a33feca891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862246, "uuid": "d61957d2-8da7-4c6a-8d2a-51ffe6591a0c", "value": "bot.mips-20231021-0423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b98ff4-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697884534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884534, "uuid": "57951752-1441-4964-8a0b-bfb0131bef63", "comment": "Malware payload (LummaStealer)", "value": "01c7a42caa15a3013c13d91fea297c91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884534, "uuid": "5409fb56-0c37-4825-b96c-5735d592eed7", "comment": "Malware payload (LummaStealer)", "value": "1801cf3c943d27c77fbb390ad2cf592d823e76151b3890721909111e96d2bc1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884534, "uuid": "301eec9f-5089-4855-aeaa-38245d069165", "comment": "Malware payload (LummaStealer)", "value": "b44d68b2b64c7caed7bda6269c0ef8ff710793b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884534, "uuid": "659d40ef-1394-41a2-8a1c-388132e9ea7e", "comment": "Malware payload (LummaStealer)", "value": "44f2ce17a57843015deb7e1b9454a845eeb901a153828d78ac2be2a1c2a4d1c3ae6db0373591ee1851d40594e7440ec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884534, "uuid": "b8337148-1fc2-4e7e-ad8f-99d3cfd677ed", "value": "T1CA65235767E81271F8B117B024F69683063178D5367CC2A73A41E9C84EB2FAC65B63B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884534, "uuid": "95d45791-e832-4eb5-b447-83d1cf8af988", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884534, "uuid": "3aefbcef-27d9-4c4f-8daf-a793843444e8", "value": "24576:MyJQ+hUz7d11vWSJDtaWjYRaCx+75OE/lrTuYDs++B07UxTC6G2zWKZ9b:7icew4taOYtIMQTuYDsSUxSaWI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884534, "uuid": "485d490f-b15f-4eda-8b76-41493b0a82c2", "value": 1515520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884534, "uuid": "3ac77bde-9f1b-4d2b-8a43-5c853a9e716a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884534, "uuid": "a898f4f6-4df2-40b6-8d6b-b73ae1aec387", "value": "01c7a42caa15a3013c13d91fea297c91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c0e385-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697884535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884535, "uuid": "d88fb396-21d1-4fa8-ade0-4b5d8b8367d9", "comment": "Malware payload (LummaStealer)", "value": "124cfda04dc8fafbc37257a6e32d00cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884535, "uuid": "2e407b01-7b09-4f62-8fad-3954a6070f03", "comment": "Malware payload (LummaStealer)", "value": "18d009129c238cfbcdf4ac537589cccc49a2c6ac63e2109cb34be28befe02096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884535, "uuid": "5486d372-77e9-4991-8286-9b0720262490", "comment": "Malware payload (LummaStealer)", "value": "ccfabeaeeca9431355a9dd89bc207b87db636873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884535, "uuid": "98a50d4a-2cb5-4b85-90ab-4516caf30fdf", "comment": "Malware payload (LummaStealer)", "value": "196a407dd97003887685d8c5a40a9f90e4fd4c300b55c201c33dafeb1bdd0cfe797d62342713c07676111c96efebee25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884535, "uuid": "2e42fc67-19e9-4154-aa39-308164de6598", "value": "T140258D2138C08176EEF710B646ECFA3A86ADD0B0072912DF16E857EEE7106D17F36596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884535, "uuid": "4c1dcc42-b409-41ea-8a68-9757bcce8fb1", "value": "66025e7bb3415added2b8177bf9bcfbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884535, "uuid": "a844616d-4bf8-4beb-b6e4-96cbd3bba72c", "value": "12288:eiSFWAVpsx7UgJCSkZZ7gFMRfIByCZeEAQ+ni5SZYzu99DGTRnI:Z2psxIgJCSkjwwCyCse+nc3nI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884535, "uuid": "d4c5b5d9-14ae-420f-b5da-2b3fa639fe97", "value": 988936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884535, "uuid": "67c4d87f-52d9-4b9a-b266-9a87eaa83ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884535, "uuid": "d3b9c2d4-d88d-4f43-87bd-975067eb68eb", "value": "124cfda04dc8fafbc37257a6e32d00cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15bee77-7056-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697922894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922894, "uuid": "6a1ab74c-2e5d-477d-bbb8-b268e84ebde0", "comment": "Malware payload", "value": "d3da151925093b70e73fdf3ea92847e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922894, "uuid": "b8b69453-e542-45e9-9422-4419952865e1", "comment": "Malware payload", "value": "198aac12263c1553bfac864105b5076ab1bb61820f8fcb0e0dfffdbcee59c5b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922894, "uuid": "3790cb84-e2c7-4d4c-a4d0-324f2c195006", "comment": "Malware payload", "value": "e3dec221c37c507fa1d485c0e743e1b8121154c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922894, "uuid": "2ad48f2b-8cdd-44be-b67b-769514359831", "comment": "Malware payload", "value": "5cceec800adc0e6b8bc2f302c3a5dfe56bebf5a2913273926926fbf36929e9309e5dd814112bd762e4b0cfa3c2633ccf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922894, "uuid": "0bd148e1-5068-4e40-ada3-1473c31bedbd", "value": "T1EA752303B2FD5133DDB9037089F752932E327DA0A83287A7275E68561DB2A50E53672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922894, "uuid": "2ca5cf12-9496-4507-bf2b-db77ed4b5fa6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922894, "uuid": "eee76717-f521-44a9-9381-ed6578e7e537", "value": "24576:myFebeVrlWDU18eqSp+ebqfR8GBcCWS4jYK4hcgaY0T5yv9RzgLnCrKF4iG+z8:19xWDU1kSAfRXTl4jYK+3wTw1tFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697922894, "uuid": "6126b2e4-0e6e-48d6-9efa-96cf17df7f10", "value": 1607680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697922894, "uuid": "366477a5-a569-45ef-bd4e-d8dfc3911ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922894, "uuid": "7183dfdd-f054-42fa-91b5-7695b7e5a89d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0f1686-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697884556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884556, "uuid": "4f1e6605-5820-4fda-967f-91a6cea98ddc", "comment": "Malware payload (LummaStealer)", "value": "fd93276e02ece594aff2e6a9682d0e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884556, "uuid": "efa24e29-869c-49a2-8ea7-cd4589aa23a3", "comment": "Malware payload (LummaStealer)", "value": "1a6d98c00c3293b9734833c30ac2f90b007bf2db4a7a3aa0dd45e35bc6b26777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884556, "uuid": "54cd424c-2c8b-47d2-9716-69bcbd5de181", "comment": "Malware payload (LummaStealer)", "value": "fff4e0a61a7ea36e1a9bf9ad6acddc2a2aeac085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884556, "uuid": "74370597-7efc-4ccf-96cb-b935143727e1", "comment": "Malware payload (LummaStealer)", "value": "ed65d79173aa56e8122f91d006a849d5c9b55610df1e2c1a5cbba7aac92519143173c1a5d7b797aa404822bc0a3c4f51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884556, "uuid": "b581f90d-1eb6-4e36-ba71-cc68dbd3d9e7", "value": "T136956C0B1130CF6EC7455135DAD7E82627F0F23BA639EB8F074C2D149589A24D8BA7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884556, "uuid": "aeb526e2-cbc1-4389-8704-a7bf4b21ba3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884556, "uuid": "772b54d9-56e4-442d-9f87-3e470426a974", "value": "24576:BL4TlKbuBqki/g9kJBnfkzg8IfXOSQvoRMAbST9mZ3OsuBgVFV2R4mGCyW00YfZI:2TlKb4ziWsP5zReeQBgVGa8yW00QQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884556, "uuid": "a57b75a3-50f5-4337-b58f-0796a30fc7c6", "value": 2035448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884556, "uuid": "2116228d-6b74-4312-87f3-28deb6694648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884556, "uuid": "e3c4c1f7-f2f2-4342-8b68-6970256aecbb", "value": "FD93276E02ECE594AFF2E6A9682D0E86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60f476f-700e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697891978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891978, "uuid": "f63e2a84-9daa-4384-b695-d8d91c126e69", "comment": "Malware payload (RedLineStealer)", "value": "ddbbb1f4332e199646cde3fe09c33c8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891978, "uuid": "d90e3ed7-2056-44bb-ae5a-0255e3505eb4", "comment": "Malware payload (RedLineStealer)", "value": "1ac66c5d03a4f6a2bcb3a50ddd04e9920c0df3c9edcd07ba6f5d137344cd1cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891978, "uuid": "9abbffa9-b942-4e31-98a2-9b94ac2d88d9", "comment": "Malware payload (RedLineStealer)", "value": "25f4fef09da034212b3a6055408d4e2bd4c25aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891978, "uuid": "067c1f12-1215-4b29-8a8c-a398104fe063", "comment": "Malware payload (RedLineStealer)", "value": "9697491b93bcef010a720288537d4c9c32ed77e1f6da8faed856f6e9cc56736011e3795bf1a23e5e9a54ebaf77f59b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891978, "uuid": "117e5c09-5525-446c-b649-bde9a47b60ee", "value": "T1B7452323A7D841A6D8751770A8F303871F327CE18974870BAB97E84D4C726D1A6B67B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891978, "uuid": "ae054787-2fef-4cd9-84f4-408c6f66cc0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891978, "uuid": "1b3ffb9e-4ac9-49f1-845e-e625fefb3206", "value": "24576:DyUrA1OlOYWQXi8nHw3YuoQ7+wqez+LKyEPmlYxTu+o87:WUrAYkYWQXiOw3KQywPyKyEkYhui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697891978, "uuid": "80788527-6118-49d6-b784-b435772cc177", "value": 1230848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697891978, "uuid": "887b9dcd-12cd-48f4-85cc-d22869e4dc8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891978, "uuid": "0ebfecf3-a2f7-416b-a3ba-77b2fae46455", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4279f2-7011-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697893282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697893282, "uuid": "daea97d4-3c2c-4815-a0b1-bf6df9af8723", "comment": "Malware payload (Stealc)", "value": "8dad56a476651cada8fc0c03434e1787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697893282, "uuid": "35eb9c1e-520e-491d-9840-1d5a34d3b8e5", "comment": "Malware payload (Stealc)", "value": "1d9ae562e502248d16291201495a68309e2a2f8379994df23eecc750505cc811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697893282, "uuid": "746cfeb8-50f9-4e10-b5e2-18c779169700", "comment": "Malware payload (Stealc)", "value": "768e1c1169b5d6492fa7353a3950f87c3b4ab641", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697893282, "uuid": "cd9784d4-acd1-4163-8023-1a6d0de6966b", "comment": "Malware payload (Stealc)", "value": "bf75265af5064f50819da75ae3563ad5e594751f8d9536c7142a5d8114aeb74081a9f7821dc4a28a026c187a3eccd1fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697893282, "uuid": "ac982fab-7201-4e55-bc43-61c61fe87527", "value": "T18145239BB7ED8077C93153309DFA74930A38BC51AC74A69B2281E8982D735E0B57173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697893282, "uuid": "83e79e0c-6c65-4402-ba70-121202a64703", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697893282, "uuid": "b12dbffb-7858-4506-8829-c9ab1aaa5b97", "value": "24576:9yi7Pg5b/ShdUjowqrgKDzHJHRuR7G020Od3LZo:Yi7rd8oNdzpx+K0x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697893282, "uuid": "693b4057-d457-49d7-b235-5b4b35c4d3b5", "value": 1233920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697893282, "uuid": "9df8d00a-ad00-48cb-882a-7bf550a66ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697893282, "uuid": "4273487a-524a-4d51-b126-cbd98580c0b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526f4472-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906333, "uuid": "ea545cde-d9a8-437c-8204-5c36b0bd24dd", "comment": "Malware payload", "value": "6048ab1217b1ae56b6488b5bb1266bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906333, "uuid": "d7f0731d-ae0f-4d65-a2ca-bb29cc182997", "comment": "Malware payload", "value": "1f86c31172987b55306aa3bf8dcfdf1791f2ca2731343556ab7c37f30106beb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906333, "uuid": "f3425a00-df5a-4195-b7c2-ec5457bfbed7", "comment": "Malware payload", "value": "ba7ffe0e0680dcae4f16aaf48efd5a7dfe2d47a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906333, "uuid": "8ef98522-6689-460a-b9a6-bc2c22534019", "comment": "Malware payload", "value": "1e9b9add14193eee3af0031da2ea06f5cce59ea20aacf220598e9ed8ed3131877df498b6a4ec1af649120c0ecad54f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906333, "uuid": "5bb4e9ed-b64d-4b0b-9ada-4b4819fe75ef", "value": "T1EC43F862A4D14DB5C5050ABC2D478438A635A6202EFCBB827F5C4B0DCCF529F4D6D9BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906333, "uuid": "ba44a1ac-1540-483a-941a-f5ee1fa12ea6", "value": "96:nPPnZ7fTtzWDgkc6AVnkbg9E4WSY3vNhAuqA4rhtRI+Mg9efBQUCyENUs:nnxfRq8HebguHSGlhWrhtqDg94ANh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906333, "uuid": "d572f60c-96b2-40ea-810e-762338f0631a", "value": 59119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906333, "uuid": "f09d050d-bb90-4c7c-ac77-b93a7ff2966d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906333, "uuid": "e39bf127-e305-41e3-9e9e-13ee6b7906f3", "value": "SecuriteInfo.com.Trojan.BAT.Qhost.7108.15630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f3ff39-704a-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697917661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917661, "uuid": "553e3049-f13f-487b-b32a-32f230fab025", "comment": "Malware payload (Smoke Loader)", "value": "f57d15582630c9c012f642972a364c46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917661, "uuid": "a30b0aac-444b-483a-a017-725d352f6456", "comment": "Malware payload (Smoke Loader)", "value": "212f3f74cd96e2e08855fabc350bd0e96af86c025eebfcec8a9b78d153b70985", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917661, "uuid": "f3895792-8af3-46b2-b00d-c18696b44f58", "comment": "Malware payload (Smoke Loader)", "value": "17936b2dfab617ac662ba5a03aaada3f7c620ef0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917661, "uuid": "6357fde5-564b-4bc1-8227-94b673674d20", "comment": "Malware payload (Smoke Loader)", "value": "571fbb0b9eff6a8cb6d4b383454e1b10a37854ef5b9576a64ce8518e42bd602d423b8db107dbdd568c3b16c98f6fc6ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917661, "uuid": "e9f4e48c-5c5c-4c49-b97c-02165a3f1a14", "value": "T16A44BF22B7A0D831D46369354930C6951A3ABCA3EA7081CF77583E3EAE313D19B65F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917661, "uuid": "56794db7-d845-44ac-856f-c7790cab4332", "value": "e917b644331755ce8f3ab54716b5cd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917661, "uuid": "37923e9e-aea2-4c24-976a-8a1b7007d40c", "value": "3072:byBNpAHKlA9HKSX39+3b/hReJYjxqmiK5wtLbVrAh3TKsw9J:qWQA9qSXtU5RziKqb2deJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697917661, "uuid": "f5348a09-d2fe-4fad-bda0-08a858860f72", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697917661, "uuid": "18abff81-98d2-4d78-ad68-ef407bbe5e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917661, "uuid": "8bb414aa-3f9d-4a6d-b14e-5cda6890062e", "value": "f57d15582630c9c012f642972a364c46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4320a7c-7060-11ee-8907-42010a9c0042", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1697927113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927113, "uuid": "94c45720-9f52-45ef-8bcf-ceddcc618f1d", "comment": "Malware payload (Gh0stRAT)", "value": "561b145d9f8ebd81a4f097ecb8ea2ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927113, "uuid": "927c1f3a-4eac-4239-a9f4-fc3dea8637a5", "comment": "Malware payload (Gh0stRAT)", "value": "24cd8e15e68a854a6ffc410669107b082c6d9a192cf671e51ee15735ec149287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927113, "uuid": "eecfade7-a496-4811-91ef-818d8a69e5e8", "comment": "Malware payload (Gh0stRAT)", "value": "1a3e85e9018a06f260980487ed92849574d6e4e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927113, "uuid": "995e8508-ba15-443c-b184-b4ca63824f68", "comment": "Malware payload (Gh0stRAT)", "value": "d74d3120a7ea08398835129a42c2dcb76f242b39e17a75953a75b6300121d35c81824e77ae15bb69b520428fa9b5b136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927113, "uuid": "b2f00592-c805-4184-a61e-df1e1d54983c", "value": "T114E46D43F3B7C0F6D44D00354469D3BA7A38A3216356CAD772D49A7BAFA53E15E3028A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927113, "uuid": "04aa9b83-8454-411f-a445-a0d351cb4491", "value": "e2b4a22dd01bac62ec948d04cee8e739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927113, "uuid": "bf5244a3-4142-4542-89af-1d62db382811", "value": "12288:SaejG/5NwYkK19iOCr+TMoO30mYn0YaAsGhQHxM5DKTrH5eZQ2m:2jGAK19iOCr+TMoO30mYn0YaAstHxM5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697927113, "uuid": "1c651a03-f3ae-4e5d-9c9b-8d3c183368c1", "value": 674272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697927113, "uuid": "3a7e6da4-3c5f-4641-9e15-53ee0ae632cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927113, "uuid": "4aa8721f-9900-4838-a84e-71c7c50359b4", "value": "561B145D9F8EBD81A4F097ECB8EA2EE8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5516a54e-7051-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1697920511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697920511, "uuid": "ea130f5d-e2bb-4619-9a0b-1c78d6ae921b", "comment": "Malware payload (RecordBreaker)", "value": "2128003c07b0ed1e597f1a393a549419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697920511, "uuid": "077e60d3-1659-4da5-b7d7-8d083871ea22", "comment": "Malware payload (RecordBreaker)", "value": "279920d9a47f105109d944756691daab21f7170b35fcca67e352b128e194bfbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697920511, "uuid": "95bc8b15-ed9a-4659-8b98-293193104f69", "comment": "Malware payload (RecordBreaker)", "value": "4faf21058a5be51d472daf29cf68d9aebb0ddd12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697920511, "uuid": "e851f292-2633-4e08-91fe-3708b735ac28", "comment": "Malware payload (RecordBreaker)", "value": "e5e25f92c3ef09ab1f03353a14a85c31c17ebde3f93cc2b0232fe7f6fbbbb64f8794c75881d0006ce1c6e89cf9cb3025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697920511, "uuid": "a4965082-1fad-4194-9ced-2b02e3122a85", "value": "T1B0343813D2E17D41E9368F728F2EC6E87A0EF6518E497B69661CFA2F04B1072D663710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697920511, "uuid": "edc89cb4-278d-448c-a3f3-a3bc3db1bb57", "value": "8b3011ba53b7e84f6ea65a7d8a93362f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697920511, "uuid": "d8a56d27-875d-4bde-8f5b-57bba2c8f6d9", "value": "3072:q/bAZ+uAYqld2+Fe+aHZbrVllsVAsPwH/5XXKo:qbAZ+NntbW/lsVJ2pX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697920511, "uuid": "7b7484c7-0d93-4a03-ba9d-177c94ef6fac", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697920511, "uuid": "188c57c3-eefd-4b68-86ae-56c2b9e70dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697920511, "uuid": "0f9b833a-7733-4c5a-a0a2-b477ac33ac83", "value": "2128003C07B0ED1E597F1A393A549419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fb02a4-7062-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697927712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927712, "uuid": "b569d5a4-4b31-496b-a8a0-5a4a55cdaebe", "comment": "Malware payload (LummaStealer)", "value": "db1e49911dac49b32baf567695ec8460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927712, "uuid": "2a9e58bf-7b06-457c-9a57-4469be6f7680", "comment": "Malware payload (LummaStealer)", "value": "2813b7547c4fc0db16cb4aa2e7603515d376c4c0ab0400fc6ab7c0a02735048d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927712, "uuid": "b17567a9-17ef-4bf6-b529-6d34ee4142fa", "comment": "Malware payload (LummaStealer)", "value": "f129f94e6de08d3a851cfb3dc5c6fd9c1efc2f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927712, "uuid": "fd6b3b87-67e7-44eb-8546-fb8aac4e722f", "comment": "Malware payload (LummaStealer)", "value": "181d0a29378057c6039f3e4caef24187e4e635880089edcc26ae766e602d962a82dbe083773186d0968d9973ff3e9239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927712, "uuid": "10c5c8f1-cfad-4bcb-bc35-baada7b63517", "value": "T136158D2138C09136EEF320B787ECBA2542ADE0B0071915DF56E85BEED7606D17F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927712, "uuid": "06b75e73-7bf3-4812-85d9-d9b01b818fe9", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927712, "uuid": "a90e7a94-5ad3-43e6-ad12-0d1b5a42f28d", "value": "24576:7jmtwk+VoLIYWIHHHHHHHHHHHmGVDArjcvm1Ty:7++VoLIYfHHHHHHHHHHH1AX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697927712, "uuid": "e8692373-8b8f-47d4-8647-133bab2a39ab", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697927712, "uuid": "fbe10782-a2b4-4cf2-96a1-6551575d6967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927712, "uuid": "00fe38ed-c5bd-4c73-bcdf-85547e21f2ed", "value": "db1e49911dac49b32baf567695ec8460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3a4531-700e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697891641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891641, "uuid": "bea80b3e-7670-41dd-9296-df386ed86dfa", "comment": "Malware payload", "value": "44a6e6022fcd0fe194356934024af83f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891641, "uuid": "fe415b5e-7034-4aa3-b955-6d6832346dea", "comment": "Malware payload", "value": "2818587c59cdb62d2a68f1a5a4dd739d8e09497c28c590fa3d45662f8b76b1d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891641, "uuid": "eeb6f069-90df-47d4-9250-64066684a7e3", "comment": "Malware payload", "value": "a7c0f467f7d8d0edd506e2c536fde3947d3c3f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891641, "uuid": "3a7e9428-3ea2-43e9-9992-3e5a0d507322", "comment": "Malware payload", "value": "acb16763418799f80922d03779733c5136a56df34b62d32ebb773c911ac941529057d8623fd02c62ae270ea6300666c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891641, "uuid": "9f2102d8-ff1f-466c-afed-be476068cdb8", "value": "T17345234B67D85071DC7123F078F603831B327CAA7D38D79B279398990672A9162B673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891641, "uuid": "f93e2b9d-1410-413b-a929-5480975eced4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891641, "uuid": "714201a4-ec7f-4b24-bf6a-e25b51fd6688", "value": "24576:tyrq9KZrIDzV9ZssClvZbIjp/A0+ZgfnsWy6GQMKxES4yzH+kL7XSaXPO:Ir2KN4V9ZssmvhIpDQgO6GQM84yzRC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697891641, "uuid": "d8deb61e-c695-49ac-bfe7-b8573f26d7ea", "value": 1233920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697891641, "uuid": "3c6cc2da-c65c-47b5-a147-c68ff98e3d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891641, "uuid": "fe83b610-6212-4726-8465-8f28be7aa3d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d86a3aa-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906325, "uuid": "931a6757-076d-4a7f-9fe7-3dfe9e20c38d", "comment": "Malware payload", "value": "08ef99cbc21f5c147223038ee096745c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906325, "uuid": "2eed0fbe-fd9e-404e-8db5-c554e8c8e98b", "comment": "Malware payload", "value": "281fb080962f4f2016c8e4097f2ce2cd9ee7d0b066a7951409095150d55bc763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906325, "uuid": "4417011f-b5be-484b-ad9d-231bac87c860", "comment": "Malware payload", "value": "0ff8da868ab214c2796446d2fdcb533b2b467a3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906325, "uuid": "c9864fdd-61aa-4935-bc72-58e1df776eec", "comment": "Malware payload", "value": "ab364d31b3390a165386b55e8a55bb6c8886790b0ab8db6b6b0d10e05b060cdd1ab8eba83b1807a87b0b11d79a449e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906325, "uuid": "42264a78-2137-4ea0-9b44-b04cd7494f1a", "value": "T1B3E26D26E8C38872D12E59BD5D0ED538D83E2A313F2971C3EBAF1D5DCE251C60A192B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906325, "uuid": "cdd2f2b5-2007-4938-a4af-b610ee8d3703", "value": "384:Z3HqsREnZX3Qt02g2D9ZgNEVXR3fEyugibF8YLEwLEXpDsmCq33sjP3GHvNMGVuX:BKSmX3MVD4GXZEyuhhq5Db3QHGVkK/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906325, "uuid": "c0046b37-e0b0-431a-a8f9-1aaa9c6d1984", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906325, "uuid": "87109208-bfbc-4339-b641-9a9e346ebf04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906325, "uuid": "ad641734-a43b-433d-8c0c-a55b5e4735fb", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.20377.12476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec58c56d-7025-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697901867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697901867, "uuid": "896e94e2-79cd-4514-8124-b8b2bcbcdd0b", "comment": "Malware payload (RedLineStealer)", "value": "73a8a29514b79f1f760bd40e1b164e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697901867, "uuid": "be4f03bf-d624-4384-bc45-8d1d8ebc33c0", "comment": "Malware payload (RedLineStealer)", "value": "2b7ef6e04c3bf2603ed41f48ab872fa909f452eb96cac5e7dabc5ad6b92b9445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697901867, "uuid": "4e65881d-1cec-4498-a61a-8d194ee67532", "comment": "Malware payload (RedLineStealer)", "value": "4c9d21a958123ee1cf8b11dda6baa915b28fa2ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697901867, "uuid": "663528d9-0506-446a-80a5-9ed8c8fc82ea", "comment": "Malware payload (RedLineStealer)", "value": "9ce7ce4d4c0d6e9a848432d14be8d50c72ddf5b460f850cd6d8419da2b549446e36961019ac043c87a9c430777deccbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697901867, "uuid": "0623af44-0eb3-4323-8577-8abd019675d7", "value": "T19E45230396D48491ECF20B746CF257970B39BCA2CE3CC66F1A41969D0E72954A77237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697901867, "uuid": "8ec5b682-6947-4d74-a90d-319aa59b46a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697901867, "uuid": "d9d7266f-49c3-410c-9834-01dd18fba78c", "value": "24576:Oy1yCkQ3KVwtJdB+cNfYoPiYBvcg5MFs3KbxlyjfwLHn7I:d1Fk6xtJ/+cNJXB73KtlEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697901867, "uuid": "8e7560a7-de89-4ad0-8628-313e4f186e29", "value": 1234432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697901867, "uuid": "9cc72c37-84ca-48c9-a3f4-cbc9374b9d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697901867, "uuid": "a1e8b1ba-aca0-4d0c-939e-92b7e9e2ee61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f82bdc3-7007-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697888773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888773, "uuid": "bb8a258d-ec12-40ca-879c-8512f94e5d23", "comment": "Malware payload", "value": "6245024bd7965b1bb284f757884f12bb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888773, "uuid": "9a15a390-bdd1-4aff-afd8-df39819ee1e7", "comment": "Malware payload", "value": "2d3770870c1b3116a047d960707cbf07de97957908ec82ca6e3b6519ca1ede85", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888773, "uuid": "850fb51d-729d-4bc1-ac4c-7bda61dcd2f3", "comment": "Malware payload", "value": "00ee4ce63997cf724ba0548f84723b58cdab7d4c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888773, "uuid": "8d78dfee-4c1c-45bb-be1d-13937335efab", "comment": "Malware payload", "value": "3a96c09cb3e0ec391ebed95969b487350b7a57ab8d5939c82a134f8e63d232ddfd88c459067ee94d14d045876a474102", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888773, "uuid": "be00a464-e3a2-44ba-83ae-c4d50a53dae4", "value": "T10F735B0137E88D2AF2AE47B97DF251070EF4D5676512CE5E2CC800DE5A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888773, "uuid": "0f892e39-f48c-4663-b4c6-40e6f07b048a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888773, "uuid": "d6aa70c6-5cd2-4dcd-8a15-978d0803113e", "value": "1536:pUhgcxnj3CuWPMVjYOUqiWyIJH1b8/VIM72QzcGLVclN:pU+cxnL1WPMVjYOUqL1H1b89f2QfBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697888773, "uuid": "1a8afc85-afc1-4591-b211-628d84b961c9", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697888773, "uuid": "22076723-cee6-4ae6-96c9-74a8334b37a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888773, "uuid": "147a405f-4ce4-4711-bb4a-38234839f738", "value": "ClientAny.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fddb32-7032-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697907252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907252, "uuid": "7d77d1c5-751b-4fde-aded-45d5ea7d6455", "comment": "Malware payload", "value": "7fd62741fc8ae44ef164eac9c0205722", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907252, "uuid": "0a94c705-ebcf-4f6a-800d-d81663ba3242", "comment": "Malware payload", "value": "2e6f6602926ed48888a54e51672e75c77257767dfead4f0c3d8279bd04b89ba3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907252, "uuid": "60fe13a9-c781-4201-8bfd-f7454781e24a", "comment": "Malware payload", "value": "ed1d26877f0f1d02e305fb24f36320970916ea8a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907252, "uuid": "33ae986c-ee70-448e-b00e-c4ed053d28f3", "comment": "Malware payload", "value": "5b344251ab65a6e4c29809fac8d207242754abbaa5194d1264e48e20c3bbd5d6473268dfb61b4259b4993d0adc354cea", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907252, "uuid": "bb665b72-1829-4a96-a921-89b059c7a4fe", "value": "T16EF2FA22DFBB25DF1066CD55D7E301A3D264A41E1D9CE79A48C203DB4B9BD03885BE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907252, "uuid": "92df094b-cc65-4999-86a4-f54b3bd4325f", "value": "192:KUVpVgbHmObdV6VxpKSM+H4ucd917QIps7HAdgwAwYLo5u9Azk:bLqtwxAT+Yucd917QIu7aYau3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697907252, "uuid": "23184be7-2994-412f-b904-3fd0a2b2d3fd", "value": 37174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697907252, "uuid": "ba55f46a-1711-4c21-bdf2-f942a3344ce8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907252, "uuid": "bc5e5d02-4bca-4fbd-9a28-3b2aa5a14005", "value": "sample2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92dfab67-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697884537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884537, "uuid": "ffdb6f7d-e187-488d-9f10-18e8a2a22cc6", "comment": "Malware payload (Amadey)", "value": "9443ee398819351486152eff580edc8e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884537, "uuid": "3384ddec-6c63-41ac-92a3-a03d693be839", "comment": "Malware payload (Amadey)", "value": "2ed58a0da5ba0957055ff0f0fd5088bbac709f4c33854553a3bcb8f4c3b40eee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884537, "uuid": "34783f0a-9489-4f2c-9754-434fb94081c5", "comment": "Malware payload (Amadey)", "value": "d36796b4672b2b93bb77c731dcce6622b873737b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884537, "uuid": "6580c485-2ea3-4fbc-8e10-6cfdf6e3b64a", "comment": "Malware payload (Amadey)", "value": "878d6932f19fc39994574b461a52a27d2d01e1e30cfd50b0439f84f4676a0afda10d1e9daaef51b0dd702d8e37f2f3cf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884537, "uuid": "0b1a3b5e-b74d-4fe9-9f2e-ebb3713c7a8e", "value": "T164157D2139C18136EDF310BB87ECBA3A86ADD4B0071912DB16D857EED7606D27F32592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884537, "uuid": "397f5299-6b0b-45d9-9439-2bd22bdce992", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884537, "uuid": "133f1094-6947-41de-bfb7-a763643ee97b", "value": "12288:iNxYn1POHiJMRxxcZ541RgNLccufEjusq8otFIidO/auD3BCXrB8tWaJ:ZPOHiJMRxxcZ54rWclfEjvUFNrB8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884537, "uuid": "7272d0f1-abf2-4b2d-96bc-3f0fcf9d9236", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884537, "uuid": "eb70bd1a-2f42-4aa7-b326-98f0e252b4de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884537, "uuid": "baf7424a-8368-42f9-b5af-adcd30a080d9", "value": "9443ee398819351486152eff580edc8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f497b7-6fea-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697876194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876194, "uuid": "d225ed31-d486-4171-ba32-51d2323fcf80", "comment": "Malware payload (IRATA)", "value": "07886fb56be52aa4823a2b116d548a62", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876194, "uuid": "a349156f-bc99-40f5-bb88-c14885d318d2", "comment": "Malware payload (IRATA)", "value": "3013e0a1ee874ef71c6f36fc20b147377f1fe87c8453c0742f7cd47e85101511", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876194, "uuid": "ac3bf1be-46ee-4358-a928-dd269f2f386d", "comment": "Malware payload (IRATA)", "value": "884793479f280ae26cdb7bdafd8bf0b50f017205", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876194, "uuid": "07376d6b-0045-442a-b5bb-723f260c4d59", "comment": "Malware payload (IRATA)", "value": "0c4f118b9b57fd991bd1a5576108a83e6305cc7f1b77982660b05f8f639137e933546533530405eb8c1adff0ba421dd3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697876194, "uuid": "c594f33a-0ce9-4349-9017-039a8eda19ff", "value": "T1C5A533ABE0037563FA3ED2F2118721C151561F04CC9B984A7A3F372C567BADEA35B4A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697876194, "uuid": "7373d80e-a9a2-4010-9a50-abf0b41d47a1", "value": "49152:ZEIKhcjgEwWH/z7t/DZrVpejkB7pnjaLiC6V4TlCQnL:ZRDUDW/vfBFnjjVWtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697876194, "uuid": "5f289811-528f-4fbe-b50d-4694d9f93081", "value": 2206939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697876194, "uuid": "4ac11d22-6965-4baf-8092-589c125f8774", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697876194, "uuid": "a522f596-cc25-4f4a-bc78-ecaf5eebf8e1", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e4d9c4-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697884539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884539, "uuid": "eb975187-a716-474c-9259-5b2a38bda06e", "comment": "Malware payload (LummaStealer)", "value": "6b8342617f9204499b4ec1dd344b3069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884539, "uuid": "86a5decb-7a40-4a69-bd52-76ae26c8c479", "comment": "Malware payload (LummaStealer)", "value": "322fe44daddef197d93b3768e2abb247ced7b7e16eae156f103ed0b5730fb49d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884539, "uuid": "e8e10721-32e2-4e45-81df-a09d9101d3cb", "comment": "Malware payload (LummaStealer)", "value": "9b35e9b9e75abf2621ccb6fda908c15779f37ac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884539, "uuid": "20954925-b8f2-4eac-8c6e-6a38f2bf6cee", "comment": "Malware payload (LummaStealer)", "value": "0146dad3497e271c66422502acca9311784a27e58462d8054477f673575bfcbb58d1faeb01378e5ba1c8164375f6dd79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884539, "uuid": "16a3e9f1-8457-4e9d-a42a-115c84ef97af", "value": "T1F8157C2139C18132EDF320FB87ECBA3986ADD4B0071952DB16D856EED7606D27F32592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884539, "uuid": "2288afc3-51d2-4425-ab42-1cb2b089cbe1", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884539, "uuid": "29c39b7f-a9fa-4a33-814f-92d5c6b97c3e", "value": "12288:XdxtJ5POHiJMRxxcZ541BYlLckufEjWky8ot1QyuG/yuD3rCDQ6qZEUJ:hPOHiJMRxxcZ54bGcNfEjXU1kQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884539, "uuid": "daa539fd-ddef-46d0-a99c-13f77712d22f", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884539, "uuid": "7200cdee-6bd9-4815-8800-b93cb33eaf77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884539, "uuid": "b07757f9-cf0e-4793-8cb9-57e11376d4b0", "value": "6b8342617f9204499b4ec1dd344b3069.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18d01e4-7017-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697895809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895809, "uuid": "c1a47fdc-b0a5-4a4d-8dec-0e5176df3068", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b086189007b4e0cf08063542a96a8aee", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895809, "uuid": "9578f7d2-a1b3-43d9-afd0-2aab9d804436", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "326288e784f015e92b191f5a9f0fa00874531b544f691f677417e5eee658033c", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895809, "uuid": "660435d8-578d-4014-a73e-b0099cf3b427", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4c40dde0e25fc2ea893a54334649eff267f3186b", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895809, "uuid": "69aa3c4f-6396-45ff-a0e6-5d311ed7b336", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9e8a8175403f2ddb993892776c5ff5e464e477dbc3f1245e3a98503860145b8b6133e1d41f96503a33febabb91e0a13a", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895809, "uuid": "bf9fc931-bacb-45a5-8e6a-bd441dd37aac", "value": "T135452383A5E19132DAB62BB0ADF346C70A3DFC111C74868723C7A48D5AB369452F1B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895809, "uuid": "46d650f2-8606-4e67-a20c-9907a61ece73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895809, "uuid": "433a7926-90c2-426d-a958-b24b189b3c90", "value": "24576:kyFXCc8RaNMhF4dPyoYp+VdSsjndO4FgOy+Tql7+4fbMi17IxD:zFR8RaehQyFp+bS0njl+lq4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697895809, "uuid": "d8b4c3ee-01e7-4b09-979e-9f8932b67844", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697895809, "uuid": "96582ac0-a710-4672-8fdc-d33d16d96870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895809, "uuid": "9ea71286-d3b6-4ba9-a822-1d1678c8a654", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0802a2ba-7015-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697894612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697894612, "uuid": "4727c9b7-bd1d-4daa-9b78-8b2bc85822f6", "comment": "Malware payload", "value": "a1fad1d8d9de9bc964c891fd23851fd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697894612, "uuid": "edcdebd1-616a-46b5-980b-e5c36885b1c2", "comment": "Malware payload", "value": "326e0bd3367521783636a4a744307ceff89c873ecf1fda76826cbd8febdcbe14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697894612, "uuid": "fbc59571-56ae-47d3-8282-e280d3b5ce27", "comment": "Malware payload", "value": "781a035173120dcca747c3d843116ebbce77d1b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697894612, "uuid": "af1c3ed9-638f-4a4a-a807-75c26d6a325b", "comment": "Malware payload", "value": "00b4ef1002cc79a53899d2b39b2e6c294d05d2b14d40a87ab0b82085617862ca51dde4fdcc05862b24b73dcf98856a6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697894612, "uuid": "70f09317-d35d-4a55-9a64-fbcf1d0b50a9", "value": "T133452303B3D9A463C9B52BB058FB16430A34BCCA987CC7675785B5D50C73D94A2B273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697894612, "uuid": "937684b1-cc76-4558-816c-62edb9e22a9c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697894612, "uuid": "125eec56-309d-4aba-a5fd-b333d76f8e20", "value": "24576:Qy41l29LwUVAoX+5k/iBE3n/NjxAnwO2CTxGKHgoMm2yk+cNW:X2Ii0n/R/JxVwxGKHgod2sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697894612, "uuid": "03fd283d-f79e-4da1-a783-2447e3f2a263", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697894612, "uuid": "39633199-a631-43fa-9f1d-8710a3a5230c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697894612, "uuid": "0ecc79e8-167b-46ac-8567-9532780fcb1c", "value": "a1fad1d8d9de9bc964c891fd23851fd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3878d1a9-705e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697926047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926047, "uuid": "b91a737e-baef-4897-841b-4034553d4adb", "comment": "Malware payload", "value": "94f72fb0dd8cccb47991ae035ff81bfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926047, "uuid": "4d83fc7e-0ad5-4b23-a7d6-2fbc3e082c98", "comment": "Malware payload", "value": "359c7a9295f5c54a78cde6981f6637e134fc7a23819e80f928ea805bcf98430f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926047, "uuid": "28ae627c-5fca-43b8-85e8-e65cab6b72c7", "comment": "Malware payload", "value": "61e53f5fa97f3698574ac943ad65222230d894fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926047, "uuid": "d3198857-5c25-4317-8c14-a7b2cdeba84b", "comment": "Malware payload", "value": "53505ffd9df595c49c1a95d73c39a35719cb325bed3436d035d0fe2a89b9662b2b65570efe5187d82797d9147622889b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926047, "uuid": "2db82502-9e55-470f-a8ac-e3de90ec838e", "value": "T14244C011B6D0D472E1A329355870C6961A37FCB2AA3446CB37983E3EAE316C08B65F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926047, "uuid": "fe99f888-031d-4570-9c33-8ffdf4d4046b", "value": "1a993c5a381c8e12968253c74a42dfae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926047, "uuid": "674c0bcf-a298-40a8-8e1f-23b076d49090", "value": "3072:Hx1BNhcJA/mq9OPKGLstg6yDBW1FozitpmqIoVDuedV4KBwn0J:VjCA/h9OCGstzyD0XRM6Tun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697926047, "uuid": "a561687c-ef80-43e6-94d1-5c316c8677ca", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697926047, "uuid": "1c3dde0f-7739-4ee4-83aa-56defb47343f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926047, "uuid": "d4c37909-6ccf-4df6-b34b-a419a89a5443", "value": "94f72fb0dd8cccb47991ae035ff81bfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76240e8-7027-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697902691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697902691, "uuid": "3c427c13-f7f7-4769-8823-0cab298080ec", "comment": "Malware payload (RedLineStealer)", "value": "7393e8d9cbd060da9aa94337ed89a81c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697902691, "uuid": "0625b240-5ec5-45e8-9018-2ac3e9d38a64", "comment": "Malware payload (RedLineStealer)", "value": "360ca0543bbf3df62ebc7602683fc4cfcd52a203f83175b89030ed9c12dbe337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697902691, "uuid": "6fa7bae9-4939-494a-a854-f3115f569215", "comment": "Malware payload (RedLineStealer)", "value": "6cd6a8a437dbbf5a1b98c5ac283da98f04678493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697902691, "uuid": "37c143e7-27a7-46c9-bdc9-cb77193db750", "comment": "Malware payload (RedLineStealer)", "value": "6a7507443738534f96654c8db068d831f44bfd9c7ae2b066f8fe2ab99cbd46b03d7a7543392137b8bed72398270d404d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697902691, "uuid": "eb01b89b-7ea3-4463-a612-fc10ba845ecc", "value": "T196A46C883C40D472C069117D22AB6E209D2773D487FB2AEBB35C7BDE0A775F28272556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697902691, "uuid": "e46d2fcc-e893-450f-80a1-bf2d35810aff", "value": "1134c477873f65e93095a249b0d63bdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697902691, "uuid": "3c82ce80-3321-4c61-84bf-5209f8eacd97", "value": "6144:d+jq9ergs45O/mxZSzigiqrFtAOjD7KSh9DsAn46g/24IGbBAMS:d+Lrgs45VgFDa64phBAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697902691, "uuid": "ecb1af17-7626-4c63-993f-7711338469e7", "value": 464384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697902691, "uuid": "04d6dce0-3fb3-44c3-88d0-cb21f43ff05d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697902691, "uuid": "78c1977e-a989-4f93-96aa-c26803e17724", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11423a4-6fc9-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697862335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862335, "uuid": "4a45e3c3-1fde-4cda-bda3-6cdc6f2623bd", "comment": "Malware payload (LummaStealer)", "value": "972f3b377aeecb732cc38e401586369a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862335, "uuid": "09958b76-3c2c-4719-b89c-d1d3f6140a34", "comment": "Malware payload (LummaStealer)", "value": "379a82b969570f6811e1051d3d144f7a95ab57b67013ffb057a5e88fa5d3dca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862335, "uuid": "0249b268-4d0e-455d-b5df-9f11053a5443", "comment": "Malware payload (LummaStealer)", "value": "bea1c73b8d2204e93baf4d72f79c3cb16a9675dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862335, "uuid": "e39e91c3-8514-4833-b63f-3cc2442f3cfd", "comment": "Malware payload (LummaStealer)", "value": "cff778585abc6c71bbc99087fb41fef3f486a8cb7abb7e6eebcf39b74065fe78a20d762eb96b89412ee1cb6658b20897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862335, "uuid": "9017d909-50cb-4aa3-9e9b-d5e7295c913f", "value": "T114652393E7F97421D8F527B028F703930A397C9188B4875B7B90BD884DB2E9451B973A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862335, "uuid": "07682f38-1f41-4601-9df2-43d52889e2ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862335, "uuid": "69cff086-245f-4859-b881-d254ab780d0d", "value": "24576:/yVlptEhYvYEjV8FpMVTpjExMjexpTEd4s+y9AWv00MhZODHvPjorWLNwT:KVlptyAjV9TdEeB9AUnuSnjorc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697862335, "uuid": "eb1c958a-84dd-41bf-90a0-01909704c20c", "value": 1515008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697862335, "uuid": "32193c21-7793-4b8f-9fc9-431b64bd8e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862335, "uuid": "5198f5de-6001-414f-9fda-6510e6a961ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597975fe-6fd0-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697865114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697865114, "uuid": "f98a6e92-eeb3-41eb-95a1-e6ffeadfdfe0", "comment": "Malware payload (Amadey)", "value": "7c222154d02dcbed2c2c4f4d1a91ca3f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697865114, "uuid": "e74f27a3-7442-42d0-bf02-7dcf23589e15", "comment": "Malware payload (Amadey)", "value": "3e2d564ac5064fd8f534c7c15f729f0088e3f1d25bf2f04070b6753a25fa1f1c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697865114, "uuid": "32617808-cb20-40e5-8da7-a7ac1b889f24", "comment": "Malware payload (Amadey)", "value": "e9855bea1cf1eaef30de0e515465de4dcd25cb96", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697865114, "uuid": "cfa549d0-dafc-437b-b8bb-12022aec4513", "comment": "Malware payload (Amadey)", "value": "3c2191cc5d1e95d0ce6daeec752be9c558a19c21a9fc1a0a26690a22db1eb94af563edb10f1403e44d2507ab1160d174", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697865114, "uuid": "e3166bc6-fb85-4196-acd6-0975b189037b", "value": "T144652343B3ECA163E8E5377058F123870E34F8959834478B3A9669CD4DB26A8D5363B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697865114, "uuid": "58d64b18-1411-44be-87d6-fe7ff9bd2eea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697865114, "uuid": "e816c28b-0ffa-4980-a2c8-12920a22208b", "value": "24576:fyplAwOV8GILqinKhZeIijKj/MYj16ux2tFAxuF8VRkl4qK3my+HV24JKEUcnag5:qpwzFizIiKQW16ht6S8VGmqMmy+HYHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697865114, "uuid": "5b2a40fc-0079-4055-8dde-93dce1c1f9d4", "value": 1516032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697865114, "uuid": "61569be9-b61c-45c4-977b-36fad08e7954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697865114, "uuid": "ed05558a-2d30-4dff-91b9-d5524f82bcb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3c292f-7047-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697916282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916282, "uuid": "b9579f6f-5b01-4692-a838-7d0c7a044790", "comment": "Malware payload", "value": "9a9ff8038731bb601dc7819bcef68cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916282, "uuid": "ab2dadfa-3e37-4a98-b9cd-b361f4c810fa", "comment": "Malware payload", "value": "3ff04a886155759f844f7bc5c71a1920f663f315d60d6ea8afeaf76de410315c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916282, "uuid": "a430896b-b7af-4739-a266-f412aea2bb70", "comment": "Malware payload", "value": "260b0552dea09163867967be6a3cf66ac182d5fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916282, "uuid": "22d38b27-b6fd-43fb-b43e-640f9b26e9ef", "comment": "Malware payload", "value": "62f319ae0fd908001f5722629808cfb6f9b418f58ce685f0381151eb08c3c5c6a1f9d089d6039f39b95cd16869f453dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916282, "uuid": "b303a287-ba1c-40de-9fbb-81b408d24058", "value": "T1A9768D921A7494BDCFA6A07C8B0A4FD6D761F48613383DE703806DD93F9A5E0197B368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916282, "uuid": "2b45438e-466f-4e85-bb65-9ee86d0b726a", "value": "c956bfa6c49ecf82abb9526e91192743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916282, "uuid": "6ae58d82-818c-41df-8526-8bc503e9b5ca", "value": "98304:F90UVwrQkNPs/RRCTwVaNPWYjTH/rn2oKensvFfjlrfOPW+A:j0UVfOk/HCUVzYjTH/729ensfbGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697916282, "uuid": "ce605aa4-e054-4558-89be-92609b1f5005", "value": 7589888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697916282, "uuid": "ad5bde58-7635-4102-96ee-f68502251eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916282, "uuid": "aebca6ca-c3c1-45b7-a1d0-878dda77e4d9", "value": "TTzYVX231UFR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8da530-6fb1-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1697851992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851992, "uuid": "620294a7-a14c-4e76-8a9c-d35d9b864d29", "comment": "Malware payload (CoinMiner)", "value": "a0bf63eab17aa9609439d4cdbf5118fa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851992, "uuid": "ba0df275-9614-4dc8-bc68-df904f5597f7", "comment": "Malware payload (CoinMiner)", "value": "402118a1fe9e2e3c12ba4e931e9e3afeeb464e0bd5cf075e926062c7a7255d87", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851992, "uuid": "a8b1fa2e-ae4d-4c81-b6e6-9cdceb9f663b", "comment": "Malware payload (CoinMiner)", "value": "c643a85342008281705e53b5676e2780d378a165", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851992, "uuid": "a675038c-69f8-47a3-a447-c55146012bab", "comment": "Malware payload (CoinMiner)", "value": "66df2c7cad254ca2d7288e37ff4da248e0e1f43d8c6ffa07125370078747a8e59b4ff48471de1c4fd5517e4021895eff", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851992, "uuid": "3ae1d80c-d7f2-4800-8a69-35fd68360e33", "value": "T1F7858D09F39409E9D85FC73089199F32D3B4B85A0721DBAF1B66C6871E73AD19F3A211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851992, "uuid": "7e7a9610-08ba-48b8-8fef-2bb0cc611937", "value": "8a73a83fdced3fd9c55fbc1b70e551ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851992, "uuid": "c2304a65-e390-464a-a26c-4ef38f6c4a5c", "value": "24576:OOMOMrteoqVbvFP5xZod7qJuIFvNX52U3sKh6:8OMrMJvrfG6XcUZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697851992, "uuid": "12059f7e-a02b-44fd-809a-60270e56e085", "value": 1797856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697851992, "uuid": "b27723ba-0b69-449a-af58-c974a049beb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851992, "uuid": "60dd6ee4-f09c-46b1-a782-2e209d6a4b4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a507af-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697884513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884513, "uuid": "eb5cffcc-22d1-47e2-b686-631460eaff07", "comment": "Malware payload (RedLineStealer)", "value": "9a5d3950fcfc4ddcea9427d205581974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884513, "uuid": "a9467607-bca7-4186-8dd9-d4bf56cfb2a0", "comment": "Malware payload (RedLineStealer)", "value": "41a13943bd7c78e0f6ef393ae3162459332dee2a4b347d0ba2ea25ed423a5ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884513, "uuid": "cc9f3e21-ee59-4e04-8ab5-21b4c1aea250", "comment": "Malware payload (RedLineStealer)", "value": "f752a4505c8513fbdcac65fd526b7d93edaea321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884513, "uuid": "eade4188-c077-4022-afb4-74cfbc672a78", "comment": "Malware payload (RedLineStealer)", "value": "a4f10cd1981665473f44abb351792f1c1861e2a84504d693985282b3f77d669e33e6535fc19bb0ff70a0fe688adb3940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884513, "uuid": "62c32869-5777-4a2d-88f5-50bc149568ae", "value": "T166A53353A9EF0062ECB147355EDB02C34B2ABE26EC74924E3714A85B1873DD549F1B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884513, "uuid": "bfb1b567-4021-4735-9278-2b65896d9d5a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884513, "uuid": "a481e0af-82ce-477e-bfb3-558782912bd6", "value": "49152:vfWIqPmeYvcM7iixFGH1pJXO9MUAfTMJG3a3oJ3HCc5FKRbF0T+:HBqPmD8HvJX6tAfTM83/JXCc5QRbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884513, "uuid": "02643a7f-a7c1-4cd7-b9eb-cb2ca916aa19", "value": 2159616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884513, "uuid": "b894664a-d3c8-4b4b-85e5-6a2c600a5bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884513, "uuid": "190dd215-4a00-44db-9dfe-10d15ed53346", "value": "9a5d3950fcfc4ddcea9427d205581974.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b65228-7043-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697914748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697914748, "uuid": "917b3555-3a1a-4c1b-a86a-56e63ac52767", "comment": "Malware payload (RedLineStealer)", "value": "032e94acf3dfce3a55a4eddb960f5624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697914748, "uuid": "58872ec3-be3a-4d16-97ba-76d030b0ee31", "comment": "Malware payload (RedLineStealer)", "value": "41dd9ee3f37f67d0b88a9eac7d443d5decdaa8441368ed3710fffad471e1b7a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697914748, "uuid": "8ff6f343-4c20-441d-a8e7-28d84799d23a", "comment": "Malware payload (RedLineStealer)", "value": "470a2d5ba25cb31ec2e8b4b279cbdc8c861fa45a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697914748, "uuid": "ce4be7d6-b98b-4bc8-aeff-586df078c642", "comment": "Malware payload (RedLineStealer)", "value": "3849223379200aeca50b5c6bbe4b0f1a037ddb1d7e1bfbeebd771e9ccb4cb441a7be1f7f7d941a3e15b8036070d60ae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697914748, "uuid": "f560e5b3-a285-40e6-a8dc-f3be9519e706", "value": "T1D0752352E3D880B1D9F1277084F712837E743CB2DCB647AB2609EA5A4972AD0C53673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697914748, "uuid": "fc610bf7-38c5-44d0-b1f5-fb684e1c7a26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697914748, "uuid": "aa37ab74-76f6-4e9f-85c9-77a43925515a", "value": "24576:oyubMalKCFC3o6GLRQFX62aW7mIBPYOXRJBMW1ZQ7czdVnKSmCqvLOfynYhnL6ug:vRalKxYmXaW7DqOXRJBnQ4xVshNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697914748, "uuid": "627f5877-a28c-4b79-8b86-0cf7271b9828", "value": 1609216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697914748, "uuid": "0edd7aad-d6ee-4a58-b5e8-05f8e25153af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697914748, "uuid": "6112b9f1-3288-4c9c-825c-c18447ad08a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f526f8-7049-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697916989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916989, "uuid": "b53e7de8-2add-4558-8b53-0e061d301445", "comment": "Malware payload", "value": "47c4a4f1e16339ff6d1e1766034bafc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916989, "uuid": "474acca4-de65-433d-b66e-40dec2d3bcee", "comment": "Malware payload", "value": "43344abdef5e0471f32554e0cd3af99dff313a2b6ce78aa0aab637211606ccf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916989, "uuid": "8b84e21b-923f-4643-bb6d-db7b85fc45fd", "comment": "Malware payload", "value": "6fb5f929317bdd57d276b08dbbd823addf7525da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916989, "uuid": "7ce0e420-7379-4fb7-ae85-475ecec3652a", "comment": "Malware payload", "value": "5cf8b8a1b8d5793a26f04c47eed93bc6dc039fa6e462fd75d7eda6585ccd0dc3f0ee2d2a83ca302056ea10eea747e25b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916989, "uuid": "9a383605-c79b-4434-82b8-dba143cbd518", "value": "T1FA752303FBF8D1BBCAB60F3174F70A931E257C51A8B1536A578A991E5D316D068F032A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916989, "uuid": "e2d0f24f-6e4f-472f-8d68-712f43ec957d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916989, "uuid": "e08ed458-57fa-4a10-8d22-7421443214e5", "value": "24576:JyEb1zqtlqsrJG6G6jZRUBTVZ1BHPhTdSn8uMOoc5blmYRqkyb+NXbfZbjq:8O1+tcsdrjZeFVJpU8uMYLmY15N7tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697916989, "uuid": "2a4fb5ff-a071-416c-8c42-31c9d49ca486", "value": 1604608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697916989, "uuid": "198be5cd-afe5-4b39-b0d1-d6d8633f5bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916989, "uuid": "3952d21c-bff1-4b65-81b7-681f6352d5fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fe3724-7057-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697923222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697923222, "uuid": "aed5a65a-ff30-4644-8b99-8f285ebf1263", "comment": "Malware payload", "value": "dc74b070ae139a09cbfd88d0e747fa6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697923222, "uuid": "e869c95d-b0d8-4fe7-b3b8-9cec8ef061d1", "comment": "Malware payload", "value": "44a787cec958112a2520ec14f2da6a0bb2ea250f62310fa6266f09d5236c7d46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697923222, "uuid": "226e5059-0d04-450e-8214-3bff81502d32", "comment": "Malware payload", "value": "108aad23aed2535aa43e7bdb21d1c98969140007", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697923222, "uuid": "28c68609-e7d9-405d-81e5-106b0df6416b", "comment": "Malware payload", "value": "ec7f4c220444e3dd80b49926b75e9e7f6b36deb66004433c26c3060d9ceaa12b5fb5cb0ea7f0239badd080df222aafd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697923222, "uuid": "2c645ba0-a936-498f-84c9-5cdc34a3c9a3", "value": "T1A544C011B6A0D831D5A358351870C6661A3BFCE2AA7481CF37943E2EEE317D09B66F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697923222, "uuid": "f1e1c222-16e7-462e-92fa-c5333b02db4d", "value": "e917b644331755ce8f3ab54716b5cd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697923222, "uuid": "99d0d4c7-86ee-48cb-998f-53e4da1f4dfc", "value": "3072:qyBNMnlA8HK6w3JQJV0m1iG7knK+VCer+2ZzKMyyPPJ:hqlA8q6w5QJVh17ItkM+28WP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697923222, "uuid": "c760467e-8c96-4d22-b5df-00eee5b15a97", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697923222, "uuid": "79703912-6faa-4acf-a8f0-02589b6265cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697923222, "uuid": "4eb3b6d2-cb9e-48ea-8690-1aa8793477fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ba73d2-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697884515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884515, "uuid": "291329c8-4428-4a73-88a5-845f0c349460", "comment": "Malware payload (Amadey)", "value": "f8a4728069955f4180651baa5430925d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884515, "uuid": "2801a441-e65d-4266-8176-54035613f862", "comment": "Malware payload (Amadey)", "value": "44d9707f7cbf9b0ef1ff54daeb8461f91ab8c903326bb4cb86d84d2f02d7e9fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884515, "uuid": "62ed7014-e5d3-4468-a6b8-086b0423f165", "comment": "Malware payload (Amadey)", "value": "9c2628b2cac5226346a788b95a06ba9514d4580f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884515, "uuid": "2b77a519-f9ad-43c0-837e-ba284a6dbcfc", "comment": "Malware payload (Amadey)", "value": "81bc71826ca41861d524a64dd260032356712de75aaa4518f29e93ef25d56d153f6432d784dc9abe28603a54062f1bf2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884515, "uuid": "ec13cac3-0efc-431c-9e66-1e1bacf74d5a", "value": "T1BB157C2139C18135EDF310BB87ECBA3986AED4B0071912DB16D85BEED7606D27F32592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884515, "uuid": "94c76682-9c82-4bf7-88cd-beeab7f32b52", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884515, "uuid": "805918db-eea4-48af-8112-db333b3ba06d", "value": "12288:hKb9xnTvG+wwJMRrxbhxJgSSBBqjwcez9OuVD83fzo7N0DuD3iCjVoeS1J:4Lq+XJMRrxbhxJgSYVBz9OuWvzE7VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884515, "uuid": "19ed67a3-c702-4109-9759-6e4f0b4774c1", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884515, "uuid": "cad6fd44-19c7-4bcc-b55b-d77f17f71da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884515, "uuid": "2d585290-5f97-4aa0-b5ef-cac7d14b572e", "value": "f8a4728069955f4180651baa5430925d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e652d1-6fdb-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697870105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870105, "uuid": "eefe7aad-90dd-4678-82f5-6d84a25c0b6e", "comment": "Malware payload (RedLineStealer)", "value": "b685aad16bbcf5c105f9fe2e0413847e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870105, "uuid": "f8f5b09d-876d-42d4-be3d-887e2cb7ed68", "comment": "Malware payload (RedLineStealer)", "value": "45b6def20feedd1394fbf0c6c8884932836b315bd8acf4c03808f293628a1ca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870105, "uuid": "5daf3bba-cc37-4627-b5ec-31a48e44c781", "comment": "Malware payload (RedLineStealer)", "value": "82a3e4e52f8f3c76680c7d1b879a0bf57b5350ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870105, "uuid": "e2f779e2-d9bd-4471-9b33-9840699cbea5", "comment": "Malware payload (RedLineStealer)", "value": "5cb24afc4c9198d833fece7f4777b52c4d29f076a57d31c25ab20ed635a9077a77eabfa1ff2a8d4b424a3be9c5705986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870105, "uuid": "633c71b0-10f2-4cf5-8813-daa7f95b8c08", "value": "T108B45D33DC4861E1D2D71C7994A98D6558F9BA6123F16CE31E6C0B4FCA363D3EE29224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870105, "uuid": "7ec5f962-9f50-4242-b5c7-369a26d323e0", "value": "bb8b51bfd9f71c7452726205f579a090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870105, "uuid": "67a47390-ab32-4576-b715-8c5c3b0e5371", "value": "12288:xfdZpriX3TZhc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRRL:HrrkU5rdV1sjAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697870105, "uuid": "af7465d6-022e-4861-8e94-d67447babd91", "value": 516680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697870105, "uuid": "7ebb70db-ba48-4229-ab98-9e4f9a007fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870105, "uuid": "cfab2d5a-10c7-4f56-9400-3e5627fc111b", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.21040.3270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aaf3b56-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697884523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884523, "uuid": "95d0ed70-4ecb-434e-857d-9c7c1882b466", "comment": "Malware payload (RedLineStealer)", "value": "3a6a7fd8ca02f4b1288e29ddef2f51a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884523, "uuid": "0cda7eb1-a855-4de2-81ee-2ca0608229f3", "comment": "Malware payload (RedLineStealer)", "value": "49926eba92a0c43370234424320b5f1041852237382d0d991fb93cda57f7e406", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884523, "uuid": "88456ae9-59ec-4147-bc97-91fa6d08b881", "comment": "Malware payload (RedLineStealer)", "value": "6a6b4b0900b694be65421175eb501e8b85a7b972", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884523, "uuid": "cf785dfa-8670-4f75-ac61-d49907bba967", "comment": "Malware payload (RedLineStealer)", "value": "c3f47b1c8aefe8c227540cf77fc17d6e1c52a326acb7e9c03664d19245d3b54543aa231834b144a3828a554e5199f942", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884523, "uuid": "4f5ba1d9-1dfb-46d1-b54a-3fb4a9c2177e", "value": "T1F5157D2139C18136EDF310FB87ECBA3986ADD4B0032952DB16D856EED7506D27F32692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884523, "uuid": "6a8a5da5-6447-4f26-acb0-7815a39c5849", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884523, "uuid": "0691940b-583c-4018-b37f-151814b3803f", "value": "12288:FdxAtAePOHiJMRxxcZ541BYlLckufEjWky8ot1QyuG/yuD3rCWvmLIcesJ:RePOHiJMRxxcZ54bGcNfEjXU1RvZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884523, "uuid": "3cb8a193-0d35-471d-bcb9-95f25b6f00ad", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884523, "uuid": "100f46c9-fefd-4b7f-b63a-a781117079b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884523, "uuid": "b28d447f-a649-4d48-be52-abe0fc6a6dfa", "value": "3a6a7fd8ca02f4b1288e29ddef2f51a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39774d19-704c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697918317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697918317, "uuid": "2fe0f81e-8859-4112-aa4e-da3f1f9c22d6", "comment": "Malware payload", "value": "9fdd200cacee780875994e2999e8a8ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697918317, "uuid": "d915e249-6854-469b-8776-2d00b9539f0d", "comment": "Malware payload", "value": "49c9e530488ad18f92a9cdecf4c905d554d59a9e27fa9ba083f762b748a07a61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697918317, "uuid": "b1a28aa9-ebf9-4785-8ec6-9548d0e7746b", "comment": "Malware payload", "value": "d07634b9131088f38fcaf372f9bc2e8ac0c47d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697918317, "uuid": "b5d45ee2-544e-400e-aa84-7f193495c0ab", "comment": "Malware payload", "value": "3100fedb95e5b4ac07c4d5a09caf9fa73f305932eedb06559303c06529e7e83a13cdab195cd31d591db17352e89afeab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697918317, "uuid": "745ef437-df7d-4761-a538-7268dcb425cf", "value": "T1B07523067BF85921EAB51FB068F7128312357CB0487607B315476B2B6DB3B99A63132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697918317, "uuid": "7c793dc0-44c2-4333-9bcb-678d618609ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697918317, "uuid": "0088fef1-8ff8-4a18-8112-e9d5a4add402", "value": "24576:1yujnZGC9yiE4dlfvgknED2h6BSL7ll8jW1TuIwHQ4C/S9bfXfd:QmZGSyitzED2EWv8jYji/C6Xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697918317, "uuid": "f0e8e211-68f8-410d-83d0-a008588503f7", "value": 1600512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697918317, "uuid": "6ea74d27-f4fd-403a-a3c1-b9b94f2da66f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697918317, "uuid": "3c35851e-0beb-4557-adf6-b21bc05b88dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3362e446-7031-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697906711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906711, "uuid": "e9fb1cb9-6016-47dc-93e1-eeb02e2c03c4", "comment": "Malware payload (LummaStealer)", "value": "00d64aefa34e823e64071e789a6d7ea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906711, "uuid": "60dac209-6c88-4328-a92d-29cd22308477", "comment": "Malware payload (LummaStealer)", "value": "4a7ee8c3c62c87ed0a8c008b67223da88f759a91065f50fa2266fcc20f7ea793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906711, "uuid": "8a5f543a-3688-4385-8b14-265d3f215cb3", "comment": "Malware payload (LummaStealer)", "value": "b8b0230e857dbd90ca6982033d9f14a86e094dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906711, "uuid": "2f7add2e-7b64-4cdb-9734-499f73412737", "comment": "Malware payload (LummaStealer)", "value": "bc4a7dfa1d11884e9d33c7b6db619a47f267ab4901cb32153e7f323b7ba9c98a930d7dbf02a4eb8c2991f6131096bbf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906711, "uuid": "7b541c0f-96c1-4920-ac96-1b9c6b0e5c9b", "value": "T14544C02176A0D832E4A759351934C6961A3BBCE2EA6581CF33943E3EAE717C15B71F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906711, "uuid": "750823a9-4c82-4836-bc18-d3ad7256a753", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906711, "uuid": "61cc736e-b5c1-45fb-aa4c-0e8e8e9188c2", "value": "6144:apa0iAZuyJDlEpJiEw0RHXHvAHAXdaXIYm6sE:ajtYGDlINRHXH4HANUIYmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906711, "uuid": "fbe00297-c94c-457f-a435-0517e6fda2e6", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906711, "uuid": "fd412998-7e15-4d35-8c63-811e9242a368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906711, "uuid": "8c8178c8-acce-4aa2-a3eb-36164115d092", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd02e7a-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697884552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884552, "uuid": "80d5ada3-5571-49ec-928f-a87a2afb3241", "comment": "Malware payload (RedLineStealer)", "value": "26205d90d4cc6475fc0109002a482fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884552, "uuid": "a6aa257d-66fe-42ad-942a-0e5dbb2a47f9", "comment": "Malware payload (RedLineStealer)", "value": "4b581fc9dfd9071d5c657b445ce314f1faff31b33093c99a90c37b9491b7b76f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884552, "uuid": "d8d33c9e-b3ad-4662-a677-66f843a4a9a4", "comment": "Malware payload (RedLineStealer)", "value": "646c83ccaa76df3931d4df87eb34c3a14455d52c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884552, "uuid": "46ff5258-a780-4008-a8b1-43c2d0991e4a", "comment": "Malware payload (RedLineStealer)", "value": "286f7b60fc990d7e254a27a09e3bcc51ec6607122742eff02bbf5453af1fd5b23d90a971ed00d920b34b853da6c129e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884552, "uuid": "ac1228be-af2d-4cec-8251-3c9afc5305e4", "value": "T16D04AE1174C0C072EEB61D3605B0EBB1997EFC340F60AE9F6BD40A725EB02D3967596A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884552, "uuid": "dcd6cc9a-3df1-43fd-8243-1890fb01524a", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884552, "uuid": "91196954-37fd-4569-af8e-651b637d92e4", "value": "3072:dDQfFRizKw/kal99mdVeiOEru0PIBycsx2oO+OKfxxnd:dQRK3l99cV4EqsUR+xnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884552, "uuid": "7a425c3f-2a6d-4552-87c9-1c92af447c17", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884552, "uuid": "b6a29533-51d0-4b5d-a5cf-914d666dc439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884552, "uuid": "d0725c5b-9164-48f6-a5b3-dbe23d4f9893", "value": "26205D90D4CC6475FC0109002A482FD7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90afacd2-6fbc-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697856616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697856616, "uuid": "9628dc01-4ebf-4043-b172-dc0c8447687a", "comment": "Malware payload (RedLineStealer)", "value": "819c50760e6d98e678b5d82a4cace623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697856616, "uuid": "9b3518e3-84b4-4131-9715-b42090bff8f9", "comment": "Malware payload (RedLineStealer)", "value": "4c14487d2de8fc567b5091a9aa00ecf933dd2edbbe400c1c77c08693901b9e2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697856616, "uuid": "7fc4ed80-a60c-4e25-bb84-7201a68af0b7", "comment": "Malware payload (RedLineStealer)", "value": "6707eab48efc9826f099d25d20c016fd607ec50a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697856616, "uuid": "c721c6a2-8355-434c-aebd-6dac466e5eee", "comment": "Malware payload (RedLineStealer)", "value": "373341c11fbdb60c5044b63e11cb7e941394af222688289320ff5cda4b1a862ab0384f4813ccc781f28e1967e158b1f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697856616, "uuid": "f8abf04f-15ee-42f8-a277-3680c887c7aa", "value": "T1886523432AC95877C9F3133068F743C31B22BD92A974971B2796E5C8AAB39147662337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697856616, "uuid": "ff22e23d-00b9-4533-95b3-a079c6e9d965", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697856616, "uuid": "48d97adf-fb2b-4bf2-9915-a5deb768cb1b", "value": "24576:7yy9PSdxyghSp6VAU7kKm135LIkWssT3ECW5LVNKcGMjOtxhp2YRusC9:uaqdxNkp6eU7kKc3ykWvEV5nrOdMGpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697856616, "uuid": "ab9e735d-1bd7-4d3e-869c-666f05f5eb63", "value": 1514496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697856616, "uuid": "c2179a95-fb15-454c-9c1a-c7ceaf7f5cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697856616, "uuid": "fa1c2144-fc2f-45e0-b85a-a59761e3311c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3963f79a-6fdb-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697869784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697869784, "uuid": "37ddc231-ddc3-4388-ad11-dfa7eb141147", "comment": "Malware payload (RedLineStealer)", "value": "7620b2bd72698ef810f472ef1a53a363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697869784, "uuid": "77d93bdf-6ecf-4a96-b7c8-b29b06b867a0", "comment": "Malware payload (RedLineStealer)", "value": "4ca03271d581294aa258c1ec3a84028470ecf87f5e9be222fc839e0f85bc4818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697869784, "uuid": "d6854fb6-5d86-47c0-965c-d1a63a6140d3", "comment": "Malware payload (RedLineStealer)", "value": "d32128284d9ded88f0d956cdc639a663aab11ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697869784, "uuid": "10a8fce7-92d7-4613-a89c-a363beb3e0e7", "comment": "Malware payload (RedLineStealer)", "value": "6215e64696989a9b660b7d8b83e50c7f2bc0db548c0b30cb4665d9b66a3426c871b99e5888806d445484742b69368967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697869784, "uuid": "dc97aaaa-702a-4c86-ba2f-3a37a45cae8d", "value": "T1EF44C011B690D836E4626D311870C2961A7BFCF2EA7581CB77983E3EAD716C11A76F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697869784, "uuid": "19cdc31a-1ac0-49ee-8262-f74e1db05004", "value": "0cce327fa0253e8d26487249a6cbdfb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697869784, "uuid": "2a0d0a91-afbe-4a3e-86e6-1b4d7e14cb2d", "value": "3072:b8BNZIkrMb3spVE0Hg4e0t+o2mFBf54m+fQyveAh9dzUnKddY:Ab3rMb3szE0Hg4e0t+o9FBfh+3eGlVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697869784, "uuid": "1f52a02b-43b5-4eba-b16b-e169c40f8444", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697869784, "uuid": "a4546d37-4513-4414-a0b1-fca44cacfac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697869784, "uuid": "ea3d0a41-3435-4799-9039-5e1fd98dbbdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e05b802-6fcb-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697862947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862947, "uuid": "6e898d73-91bb-45d4-a7d9-936528f043d8", "comment": "Malware payload (RedLineStealer)", "value": "3963c955a34f058077d9010e4950c9b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862947, "uuid": "0c3945cd-76ff-4d38-9637-49eda8cdf52e", "comment": "Malware payload (RedLineStealer)", "value": "514e2e15b07d9a29270781043a5aea8eb289fcf952355972c18b1eb256cadbb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862947, "uuid": "a68d63e4-ab4f-4dc0-9335-33c6b555fcaa", "comment": "Malware payload (RedLineStealer)", "value": "0114cbcef9e1d5c6c51853f58b43357fb1de7791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862947, "uuid": "e0f1714f-799c-41ad-918f-3ff02c926c69", "comment": "Malware payload (RedLineStealer)", "value": "b1e038110ebde5196e01f2821c5bca780d98f5a458c1714479aab8e4b57d83c96300d945bf49b7ceaa369183874d398c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862947, "uuid": "9af871ca-75a5-4db2-aa55-0c0bf6db402f", "value": "T181B46D33DC4861E1D2D71C7994998D6558F9BA6123F16CE31E6C0B4FCA363D3EE2A224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862947, "uuid": "d4a21780-cda1-49b1-b29c-1dc882f503a0", "value": "bb8b51bfd9f71c7452726205f579a090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862947, "uuid": "e236d591-9ff7-4b93-975b-71ad33a41446", "value": "12288:qJdZb7zU1Tehc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRBL:Ip74B5rdV1sjQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697862947, "uuid": "97ba5591-32d2-4957-a5e9-9ce9ace08dc4", "value": 516680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697862947, "uuid": "d9aedfa3-25c2-46bf-8e84-23e72a520775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862947, "uuid": "ec921cf0-b12f-40f2-aef8-d6afc3ce8e62", "value": "SecuriteInfo.com.Win32.PWSX-gen.11161.20156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01733b31-7057-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697922948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922948, "uuid": "39ef9de1-6b79-4924-ab4a-55d5a8d610ec", "comment": "Malware payload (Mirai)", "value": "ec48dbee86454a9674fcc09a670ae3f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922948, "uuid": "6437e7f4-11ef-48fd-8896-61c0c68ac8ec", "comment": "Malware payload (Mirai)", "value": "52c098eab74480da1946c7a716f2d865c74373ce9a124b7864fd9c1e29152aac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922948, "uuid": "298c7c2f-fbbe-4716-b9e7-76da93666e4b", "comment": "Malware payload (Mirai)", "value": "33dfda1618ae99a1fd8e703c33471907f6c654af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922948, "uuid": "bca40798-fac9-4ab6-9f90-79c2a3b7f294", "comment": "Malware payload (Mirai)", "value": "7df75f98499f6ac579fda1525689cebbef48a4f1f3a43b7b84d5f7808a68bb0788df122d5093957a320667cf6352e360", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922948, "uuid": "5f13620f-ec70-43e0-ac0e-075aa4d6d1e4", "value": "T1BDA32995BD819713C6D022BBFB2E418C331653A8D2EF72479D256F24378B82B0E7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922948, "uuid": "51af4cec-9125-4924-91ef-adb112f59f68", "value": "1536:4ms6LWmM0VYioQJ2xtQSvxSTcaXt5ltvE5V2OmjQ3TObMY2qgG8c304rU:TskWPX/QSx7Mbl1E5V2O18lX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697922948, "uuid": "19a6d7d2-14f8-4b09-ab94-3dd4304ae0fc", "value": 104316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697922948, "uuid": "6f26074a-265b-457c-a59e-587b746a05f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922948, "uuid": "ef04a715-fa22-4f24-93fe-1ac666dada43", "value": "Aqua.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402a9046-7028-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697902867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697902867, "uuid": "f63d0cd6-9e72-4cb0-a73e-7435108aac78", "comment": "Malware payload (RedLineStealer)", "value": "6b15ea39d1b94768757916beadd9a8f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697902867, "uuid": "a2baacd0-03ec-4a3f-817f-807fdc19e8cc", "comment": "Malware payload (RedLineStealer)", "value": "5594aee8f2d40cc0a24ee191010f823be73524e947ffd2b7f6e3e37b18fc9220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697902867, "uuid": "61ad4439-d857-4859-923f-1812b114fa73", "comment": "Malware payload (RedLineStealer)", "value": "ad00ae67f7be972ebb678c01326c678521b72ca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697902867, "uuid": "b8ed09d2-2f52-48fe-bc2c-831bc59e8305", "comment": "Malware payload (RedLineStealer)", "value": "397e3c1306b5bb47174b21b41bbceabd9a43f46b966a58e59c5b940b06712ec1712b97e1dc44e648cfb2fbce6341542e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697902867, "uuid": "39bf2315-0f2d-4b6d-8b44-20dcb07611b5", "value": "T12DB46B51B0094F2AE3F2087CEACA5DAE4D507EED6F530B8F36C14B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697902867, "uuid": "5100e39c-f6dc-4204-b376-64b445ed80fe", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697902867, "uuid": "3c3b1909-0ee9-4eda-931d-eeac0cb9ded1", "value": "12288:G822l09FQB2o97Hr62k3n/+pLsv9+eXUeF6+1L:vlGFQkAr62k3n/+pAv+eHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697902867, "uuid": "9d0b27d2-7e6a-4ba5-880c-867e190d63d6", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697902867, "uuid": "6098c2ba-2636-4923-a4dc-7998e09a694e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697902867, "uuid": "1c75747b-d2df-4e38-bea8-d4243bc6fea3", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.2875.25147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19182f11-700e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697891634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891634, "uuid": "c5422e73-dc15-42b4-8383-fc0dcd937f0d", "comment": "Malware payload (RedLineStealer)", "value": "d12c99f669f53ca22ad6baf1020918fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891634, "uuid": "825f1bc8-6299-468f-b568-f771121c1e7b", "comment": "Malware payload (RedLineStealer)", "value": "564b0cb8a13964bc87dff7d5fb34b7d7dccf92ea2f89d3b9bb84fb13d5a2850c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891634, "uuid": "06245a58-f800-4c26-96c9-2dd718ee286d", "comment": "Malware payload (RedLineStealer)", "value": "e49581976b653855ffcec07e9d05d1bf9a16409b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697891634, "uuid": "8023cfb2-2b7f-4076-97b3-2bb439f0bb55", "comment": "Malware payload (RedLineStealer)", "value": "5ef154fbad239e0f6d68eebf0b04541c76cea2c0b7f4a8574afdf829ea61f6ff1f1292dca9824b3c44c6b12bbf65b98e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891634, "uuid": "3d3b62ad-8e0a-4725-b5fb-c55601e316b0", "value": "T187B46C33DC4861E1D2D71C7994998D6558F9BA6123F16CE31E6C0B4FCA363D3EE2A224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891634, "uuid": "e20d9a39-c597-4673-8e48-74c9c041329f", "value": "bb8b51bfd9f71c7452726205f579a090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891634, "uuid": "6e2081ab-a3ca-4be9-bbd4-94acf1ce23dc", "value": "12288:1/dZvLrTqgTOhc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRxL:r5LaQ5rdV1sjgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697891634, "uuid": "eab0dd00-1fe7-4a3e-bc66-dc84cd26dce5", "value": 516680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697891634, "uuid": "bfde9354-8b9b-4f47-9270-65c820902cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697891634, "uuid": "57bb9d7b-d4ef-4f43-9e05-1459b1b855fd", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.6857.2071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee4ec5b-6fdb-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697870115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870115, "uuid": "95346693-86b0-490e-a86a-f982bdd96665", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "19028191886bb9847556801b228795a2", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870115, "uuid": "cc5242ee-de00-4368-b31d-6c3008ba1ee9", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "58cbf150847528fa62ad3502e5016f444b6a6409d3202d94702dfbf4fcb761d9", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870115, "uuid": "12bf23fb-89c7-4508-ab0a-47c746610148", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7251f2464d967a233d5cd428ea4dfeaac45b8652", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870115, "uuid": "2c415276-af11-44d7-9a60-17fd3af471cf", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a73a235e139e58c369babba263f9d66e51c1deeee450c7af2e893b497ce14b6d27da9361260c93b8e709a7cf7970ce06", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870115, "uuid": "56484fbd-17bb-493d-b4fb-194cbc77814f", "value": "T159652387A3F49011DEF517B078FA22C30D37FC914629CFA72396A8D50D62AC2A53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870115, "uuid": "3c7cef8b-c036-4d67-aa9a-fc9b1014a97a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870115, "uuid": "3134263c-f7cd-4247-b8f1-3d76f385a542", "value": "24576:kyWt74PZabvtOiuFfsjxLOz7bY6Vvhta6OqoGbtFaDeeKnBk7CXQEWPNf+r:zWt7cajtOiif0xC706dhlOqoGbCq75XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697870115, "uuid": "532fb444-4133-45ac-8b96-617fbc686e88", "value": 1516032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697870115, "uuid": "35aee77e-101c-4137-bb1e-ab7767dd2a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870115, "uuid": "6167533d-eca6-4dee-884b-fd43590eaecf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59f04bf-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697884569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884569, "uuid": "84d5f62f-9b90-4357-8c22-9ca62c4d6db5", "comment": "Malware payload (AgentTesla)", "value": "5f583d97605ef71cf8d7e3743595b4a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884569, "uuid": "d579d16a-a376-4662-a3f2-20cbadc512a3", "comment": "Malware payload (AgentTesla)", "value": "58d21bd913674480dfd40fe09ce5b3e19b72ef1b13ace6a1bebcd275f6a901ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884569, "uuid": "19e582e4-4515-4097-bc55-abc6404e2003", "comment": "Malware payload (AgentTesla)", "value": "9f54758eefab8fc1c67368c24029b819ad5b70c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884569, "uuid": "e755a72b-87a4-4e5c-830a-b29696f5c287", "comment": "Malware payload (AgentTesla)", "value": "34c0157289c9e7093d6569562695714df46c9e4cd6e84372be74280ff820d572373b5bbf3025341e519fc245c5c0f3ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884569, "uuid": "e394374d-b2a4-406a-af17-a6b013069aaf", "value": "T10B24074977F4490AF9BE6B3248B14C5963B0E4925923EB0D4FC244A95F33780CD9BBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884569, "uuid": "b43858f1-f81a-4298-8ef9-7d318e74dba4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884569, "uuid": "18a79859-84f0-40dc-b143-e90cb829d3ea", "value": "3072:qYHXZiUotOkH+LGP34oOKerVUzeeDXbwa21D59ua/aHyvZRSd2iX:qYHJiUfWbwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884569, "uuid": "d0942f10-dd79-4374-8c5d-35a96dc74e87", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884569, "uuid": "ad100308-e833-43ae-9308-90334f6c74c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884569, "uuid": "eee13aff-bb9f-47b9-b14b-7d48c1bead45", "value": "5F583D97605EF71CF8D7E3743595B4A6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36ef80e-704d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697919059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697919059, "uuid": "92ae9357-aa65-42c9-a5ba-05d8d35dd321", "comment": "Malware payload", "value": "3b76e79518bbfaf98fa6a051c3b72020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697919059, "uuid": "4a65ae91-6814-41a0-b570-ee69d45916da", "comment": "Malware payload", "value": "5950bc250aea30acdbd275a5c615555bff8401d295d80feae8dedbb8b1957402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697919059, "uuid": "0e7dc41f-90ea-4cb6-8300-78a5c91b37ff", "comment": "Malware payload", "value": "f30d3b25523eb799be9d2964184b228c03a10a68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697919059, "uuid": "a353f5a3-8ef8-457c-ae74-b5fcbc7dc8af", "comment": "Malware payload", "value": "3cc011d4415afffead6e41cfc30174705533f7736779f80a009cd0e36c1ab3bbfded8df2bb6e389411f1f2d00530b35a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697919059, "uuid": "d79b885b-9387-4173-8aac-55c720001b1a", "value": "T1BE75231367E20033CAF217B4A8F749CB1BB97D616D714B6B26985A4E1DB1AE0187133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697919059, "uuid": "91f9412c-bce7-48a1-8eec-8202603a8e73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697919059, "uuid": "04fa9bb2-5b72-47e6-969b-d259074d2d04", "value": "24576:ry/yJykxCHQv8+RsVei2TQNlfTuB3svH3C7VLUlSIdEV1vymPfQWvMVdQrlq0S:e24G/Cei2Klfqmf3COSlBBkdYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697919059, "uuid": "cd1fe32a-14ea-4c9b-90ac-09c243cb2ba5", "value": 1610240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697919059, "uuid": "4f6fce58-7570-4734-b4f8-502967d0fe68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697919059, "uuid": "9d303578-a384-48c6-af8f-08df7b8f5ac4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fa85cb-6fb5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697853672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697853672, "uuid": "0e9dc85c-7b08-4989-af23-e87dde2c853d", "comment": "Malware payload", "value": "878e5424ebe940f018d0cf4f1a017e83", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697853672, "uuid": "5a3decdb-70cb-4595-81cc-e04f215f11ec", "comment": "Malware payload", "value": "5b418fa0e2b1945c266876821c872e22dcceafd99370bbe9f4df398f0a4f4eaf", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697853672, "uuid": "03d6001d-1c38-49a0-8fbe-eaf747ed207f", "comment": "Malware payload", "value": "979d904a543da7a937fa69decea18ef5d97d6503", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697853672, "uuid": "ec786d12-88dd-4aac-bbe5-1b018fe3c4d3", "comment": "Malware payload", "value": "bd6329fd66310ada31da2b675615543b243a72ba38da6b8bfcbdbd9cb758e10995a94fdf8c236d596f90c03564000338", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697853672, "uuid": "01d1c9b8-7d6a-4465-8e6d-14f722b3fecf", "value": "T1AE0712C3BBC99829C07641B38D4D7661766A4E299A03AAC7390C3BEC2DF3AD45F057D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697853672, "uuid": "d1c9548b-be0f-4b80-9041-ee321d9be931", "value": "393216:816p4LLYTMQcD8GHBRwxq0PEAGxIKus4SpcTfae2nXA:8oSLLYE8Iaq0sAkGLae2nXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697853672, "uuid": "5112d0d8-bea7-4cbb-ba1d-84f2760ec87b", "value": 17044146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697853672, "uuid": "78c2a8d0-a947-47f6-b8e5-178710a08c43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697853672, "uuid": "7a0169bd-15bc-4c3d-8f7f-0ca4a22e0b69", "value": "tv-latest.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53a90ed-6fcb-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697863227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697863227, "uuid": "7b488ce2-b77a-405a-b7b1-3d3bf3147022", "comment": "Malware payload (Amadey)", "value": "ff6c569c2089e8599acf5699488967d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697863227, "uuid": "dd2eaa9b-88e9-4fca-9f70-15c1b5b17626", "comment": "Malware payload (Amadey)", "value": "5b4be17def4fde4af18348d3cd7563d059071182af25415d867f67641a44c645", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697863227, "uuid": "217d2e8a-5066-4b09-86e5-53503c63e2bd", "comment": "Malware payload (Amadey)", "value": "cd39250bf7e6ac715bf56fd7aff3699aa7252ea1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697863227, "uuid": "fe5445a2-68c8-4e43-b9b7-912ead895f03", "comment": "Malware payload (Amadey)", "value": "1dfd661d50a936595d91746b7c82be4852fa7101dade63da66e53581781b0c73e2ee67b7e916155e10d75a5d54ce5821", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697863227, "uuid": "e6deba2e-3113-4a00-a11c-98e65711a664", "value": "T1F2652346F7DD84B1CD3567B08CFA13436638BC318474E2532A41688A1EE37A4A9797BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697863227, "uuid": "8672b0c2-3865-4962-9049-fc5d980c04cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697863227, "uuid": "9b272dbb-db4c-44ad-b15d-a82687c8ea16", "value": "24576:7yKh03UZ24VEv+cZCKaAU7z0WZjGznwOVO/s+uaa5hta+QvRcwIO9vEyaDOsISIV:uKy3Uw42FU7z0cj6fnN5hfQZwOiCFLkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697863227, "uuid": "79c431bd-67a9-464c-ad5b-cd95028817f5", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697863227, "uuid": "0de3ae94-1066-4f1b-ad3e-3bf078606187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697863227, "uuid": "c31bc0a5-36dd-48f3-b963-c63cd98885d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829ebe20-7035-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697908562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908562, "uuid": "8d67f37b-dd42-485f-bb3c-843bcfdb1b05", "comment": "Malware payload", "value": "b27867d0cace8dd9731bead50d325267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908562, "uuid": "84a27ebb-05e5-4bac-9392-0b2e84a27464", "comment": "Malware payload", "value": "5d403d35df35920df658161a12b8f1af0a8b1ae9329e5b85b82657e8bb970637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908562, "uuid": "99fb552e-1998-46ad-b174-6495e9a40d84", "comment": "Malware payload", "value": "dd5430429c2c448c11c9698c7c13bfa93fd9d3cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908562, "uuid": "a9db07aa-afcf-4090-a146-54299f58f211", "comment": "Malware payload", "value": "933018b2f81815cdb51047a741370adc7f4a76a3315939ccac792b9701c427e5dd90a496002af7d3a20970e62b408646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908562, "uuid": "2716b05a-9456-4d35-ae36-5a5824d68553", "value": "T15244CF2177A1D432E0A35D351974C2A51A3BFCE2EA2581CB37983F2EAE312D05B65B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908562, "uuid": "dd51eb0f-a066-4433-ae56-49f05c47a827", "value": "e917b644331755ce8f3ab54716b5cd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908562, "uuid": "27fdf5a9-b5d9-4f8e-815d-0f4eaea44d53", "value": "3072:9yBNp5KlAjHCST3hcpWf8kke70J1fX7fzC/uUuc+tKWFHJ:oRQAjiSTRcpWf8kk0QZX7fzDcJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697908562, "uuid": "71b548f8-b6f0-49e2-af42-7f42ec567184", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697908562, "uuid": "7e70e003-9638-4b31-80d9-64a69a5e6587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908562, "uuid": "8bc29b4e-a7e5-4332-9f8f-bc240ba5706e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5320c661-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906335, "uuid": "077786ea-15a9-47d4-a09d-f9387bde6a93", "comment": "Malware payload", "value": "f236ec5f7262e5477b92853034794bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906335, "uuid": "c9d686d3-a754-4cfb-8b59-827fc8feae11", "comment": "Malware payload", "value": "602ead0967a4b2ec579eaa089bd865bab131fe095ffa29da852f94adbb4548ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906335, "uuid": "dec3ee2f-3d00-4778-a0de-bef21dfda0ae", "comment": "Malware payload", "value": "da24b1ce5e4beb614723e0d59dbb6b8785f667af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906335, "uuid": "69e1f278-bd5e-47f0-a7b7-86cb0ad32672", "comment": "Malware payload", "value": "cd80ed6cd0034f087cf51e3d2d25d112c44e00c8a94dbf2594732c15dc2a8fbee19eaaa45aa6f5870c7bab4e75c8bb2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906335, "uuid": "e65cfc1c-39c5-4b6d-9cec-9a582d7d3d28", "value": "T121656C83A243E43FC3065337541F4635AC3A6EAA33B719864DF6BD2C1BB528076B2D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906335, "uuid": "48a6a451-0296-44e0-9395-e2d2b6b6c73d", "value": "24576:I4FCNrq06Bmths0D7v6dEiBgSLvL4kM4/BTl75thfL5TvfnBLnB3qX:vFCNrq0uraSX4tW5thf9dLnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906335, "uuid": "165a6b95-fc99-442b-b609-f80719adac35", "value": 1421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906335, "uuid": "f445ea34-519c-497c-a724-30c75757c135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906335, "uuid": "a19ae06d-79ed-424d-bae5-8e87d17b89d1", "value": "SecuriteInfo.com.Win32.Delf-THP.8027.10258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd99b480-6ff9-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697882945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697882945, "uuid": "9f97c690-7ddd-49f0-b650-f7c8110b541e", "comment": "Malware payload (Stealc)", "value": "fa3ca9b4ed4c63bad45f6281823be022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697882945, "uuid": "02e2177a-5cec-4563-871c-07ae97e46f5d", "comment": "Malware payload (Stealc)", "value": "6119709db9e601c75496fc5397737aa7bfef40bc4e02a0cf0e354e37716b5701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697882945, "uuid": "8a22035e-89df-46ff-a932-f3a65590de5c", "comment": "Malware payload (Stealc)", "value": "e48bb108eb9522b9b5aa8afc6c68dd1bbfde31c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697882945, "uuid": "68b32ae2-4983-460d-acb8-7b77bead1faf", "comment": "Malware payload (Stealc)", "value": "5fde16a141f915745c5e690cf2fd27eb7a5b5fc31d2590ca6daa667cac22c7bd8ae49699d7ab1f62ad9277204d33c0d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697882945, "uuid": "aa53cae3-3048-4fb2-a1f2-ccc1dc537091", "value": "T1DF45231793D95531E8F137B095F611031A387CA78E34A76B3795E6AC0C72A99B23233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697882945, "uuid": "3eff039f-b0b5-4141-9ffc-983f24fc98fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697882945, "uuid": "b549214e-403d-49f3-a3e7-0c0ca7253184", "value": "24576:MyQxAJbNfxe3KLm98mWAU0F3KkH4TdYhYHL2xPzGXykB18oAe+4x:7SkxZLfmXU0F3vHyYYLGbI7B1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697882945, "uuid": "2713a7b2-d67e-4437-844d-6faf93edb343", "value": 1235456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697882945, "uuid": "f167f671-4da5-4257-ac51-541c5e180dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697882945, "uuid": "ba9e1fb6-4240-4546-adce-9d8bd27bd07d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cda09e3-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697884554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884554, "uuid": "4592c87b-1825-4678-b1e7-63fe7d0c9756", "comment": "Malware payload (LummaStealer)", "value": "0a7922fe9226c0b59fd0f26748466800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884554, "uuid": "33fdaf95-19cf-48a3-b1c8-0a8e598dcb6d", "comment": "Malware payload (LummaStealer)", "value": "64833a01254582891d8ccf7be60eaf688dd59a642bd49acd939e629f74efe127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884554, "uuid": "06f988ea-7bee-4836-9f2f-58bcd1643cd1", "comment": "Malware payload (LummaStealer)", "value": "d6dae002040fd17df5f8de996eca025cc25edc45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884554, "uuid": "b187380e-c356-4ebd-b410-539fc14376c0", "comment": "Malware payload (LummaStealer)", "value": "9e64a2284360ee2d8c0e3f34c90cee31760eb3c34edd9721b1a820527542eb2479663129082dcba478c277c242e6da9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884554, "uuid": "7746cda1-ae76-46f6-bfec-84ffc753d3bf", "value": "T1DD44AE0174D18432D9B2353209E4EBB95A3EB830CB959AEF77E41FBE4F702C19631A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884554, "uuid": "562358d7-4a80-4d59-a929-ae7c4f866781", "value": "e6c8a6ac2c39bf589d2a9a54b0ca583e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884554, "uuid": "0be9bd0b-e336-45e6-9e64-96560e06dcaa", "value": "3072:mvZQ5t7pj3UGGBxNYCE2mzfmKxPJPq1MEFBMl/xl/ZcT8OkrmrteAg0Fuj3BrJ7l:mKVTh4EzfdxYMEv0/dcT87AOLBdLOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884554, "uuid": "5c55b4c8-43b3-47a4-82f3-83872f519fca", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884554, "uuid": "33542bb5-fd63-4f10-a9f6-84c47358888b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884554, "uuid": "357882c8-98f3-43a9-b450-596efa984175", "value": "0a7922fe9226c0b59fd0f26748466800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22273acc-705f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697926439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926439, "uuid": "c3869756-158b-4dd6-8282-b79b1cacb7f7", "comment": "Malware payload", "value": "1bdf1f98f86b24a5c98b037e32e65c0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926439, "uuid": "7195bb08-f657-428e-a73f-2664334ab4a0", "comment": "Malware payload", "value": "653b45d0d346499953e960bedd361368a53ec06795a9e6f2205a2b7b74c1a102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926439, "uuid": "d395f310-fa66-4579-8808-82424024140c", "comment": "Malware payload", "value": "6e6b818f8f4d63726c0f46f0c83907258bbb3c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926439, "uuid": "855331f5-b110-4ee0-8d8d-695cfa22d479", "comment": "Malware payload", "value": "4aab9699dfdd5f29798a3f0e7ad49170eae7ac326abc0530993966fb3d14132902e776b9b52d8a4baf66a72b8cadb8de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926439, "uuid": "b656b5af-cc6b-41b4-804f-177affed10aa", "value": "T11D44CF11B6A1D832E56359355830C6A51A7BBCF2EA7541CF37943E2EAE703D08BA1B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926439, "uuid": "7e702d9a-859a-4e5c-957f-429866856bcf", "value": "1a993c5a381c8e12968253c74a42dfae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926439, "uuid": "9cd15f03-06b3-472b-a2fa-1cd2e9e1c84a", "value": "3072:HN1BNvcJAimc9aPYOuFTEuQHaiziTRVAOFm1SEmKy2MJ:JlCAir9aQ5EuQZORlmvdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697926439, "uuid": "3eedd05b-ddd1-43b5-8e70-f7562fc9588c", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697926439, "uuid": "8e992688-da88-45b6-9b52-0574011f9dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926439, "uuid": "fe588063-7eff-4d5f-b165-c3a95e67c915", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d23725-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906332, "uuid": "a8f9111f-3ca9-4249-aad2-a2362e932f08", "comment": "Malware payload", "value": "023b50d24be0acf60ef5a39a8e46340d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906332, "uuid": "70293f02-4f76-4549-8365-04101d666eca", "comment": "Malware payload", "value": "668036c1661f7954d5111adbc1ecbf35ece7a03ad230641171c74d3340fd4822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906332, "uuid": "46bcaa68-4cf1-4bbc-8f93-cb75925e0a45", "comment": "Malware payload", "value": "67dc7ae08559f082a9bb336830ea2b5c06755040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906332, "uuid": "7a2b8c2a-1efd-4241-8e2b-8de49dccf725", "comment": "Malware payload", "value": "a1dab788734603b6194c13988174832643b29c2667a56d1b022caee88de1bfa4c7c43696097695e31d32199be4e4445f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906332, "uuid": "fbc0c21f-0591-4e3a-a3e4-aba29239cb43", "value": "T11F059D12F6D240F7D22D153004BE27B9EA3A9A430B15CFC79764EE6A1DA31719E37239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906332, "uuid": "c6626afe-194c-4de7-999e-181b36fd600c", "value": "12288:R5AGOzvfzeAq0GERqtIbqP6IbGbuJLUwmN:R5ov7rqVERqt1TbKuJLURN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906332, "uuid": "8eb6a471-6674-427b-8b78-6905ef117f1d", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906332, "uuid": "a5fececf-c98c-4cbc-abaa-ff363ddfc601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906332, "uuid": "e36ebbd0-5d77-424e-921b-8923137b13de", "value": "SecuriteInfo.com.Win32.Trojan.PSE.10S0A6W.9035.26106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3135c779-6fe4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697873636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697873636, "uuid": "c1f79ca9-688e-4771-8e93-f88896e40cc1", "comment": "Malware payload (RedLineStealer)", "value": "da11c0724de78b683e9b0b0500a2aabb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697873636, "uuid": "2ac9baae-fdef-4cb3-8752-8c496fcee2d0", "comment": "Malware payload (RedLineStealer)", "value": "677aea100247ff0f83128c3355de1cfbf24d176ba28d27b489e9b07ff17e65d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697873636, "uuid": "4d226eff-f02a-488c-b4bd-d11eafe44452", "comment": "Malware payload (RedLineStealer)", "value": "4ff6d727ac53ec9b90a3908a8bed69a7ce9195d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697873636, "uuid": "8071400c-6f73-4d7c-bfd9-bc7ee43301c0", "comment": "Malware payload (RedLineStealer)", "value": "06a734a655382435f2e2ad86dd390b8dac1972ad967c108e6024434e0147ff0e56ce737f7c638bc8d82199fd6099fb5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697873636, "uuid": "7c189f38-4ece-42ad-8701-cecbc0970206", "value": "T1B0B46D33DC4861E1D2D71C7994998D6159F9BA6123F16CE31E6C0B4FCA363D3EE2A224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697873636, "uuid": "3738086d-51ac-49c2-abaf-58e2701c1330", "value": "bb8b51bfd9f71c7452726205f579a090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697873636, "uuid": "e7db9fbc-2177-47ee-a164-a4a9b20c8c5d", "value": "12288:3AdZLanzFTNhc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRoL:gdazy5rdV1sjZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697873636, "uuid": "b1cb344a-67bd-4c53-8237-7f88d3aef2b6", "value": 517704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697873636, "uuid": "8bb4832d-7550-49e5-83b9-b9a5cf524b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697873636, "uuid": "15621dde-69df-4591-80dd-52aa811dc398", "value": "SecuriteInfo.com.Win32.PWSX-gen.3462.10630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7feb3eee-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697884505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884505, "uuid": "6dea25ae-841d-4ad7-bca4-ceda032f8b09", "comment": "Malware payload (Stealc)", "value": "ef70b147c0a5d36421a2e3a444d24f2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884505, "uuid": "6d02d639-f921-431e-8855-dc3f539ae738", "comment": "Malware payload (Stealc)", "value": "686843d48819c4c53e03cb1eca5a4a40082fe24c201b01ce6c0eecbe7c5a7e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884505, "uuid": "163a39fd-6b1c-4c2e-b979-7823cae31492", "comment": "Malware payload (Stealc)", "value": "8c5aa0cbc8533bba3d010f2126a6a8b9424a29fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884505, "uuid": "6811dc45-2785-4f65-98a8-4e2c43265a97", "comment": "Malware payload (Stealc)", "value": "ac35aa57c7e6f99a6b8b8c10acaedaf023c99471c23df4e572423dfa7aa1056559b5dbd96c09880ad0b59c6a2cbbf3cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884505, "uuid": "bc576ebc-90b7-40da-af1e-b718ba31c420", "value": "T1F4643A517916C032D56061B21AB5BFB2C59D6C199FB04AEF6BC00E76DA212E3BD30F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884505, "uuid": "c64d4769-7e03-4b00-a51d-19724a79c42d", "value": "f722e751a647e22fa4d7e966bdaa4f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884505, "uuid": "f0d4f94f-0970-4d61-8235-b14719a12a22", "value": "6144:a7bWZGyntnUkg3RqWJLdb54Y4y2egsM7u67LnAOZiZVvL:a7a9U/3RXJP4Ts8u67LGVvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884505, "uuid": "6e6b9345-130e-4594-bc25-90c3f4e52e77", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884505, "uuid": "5094d80c-740e-4d9f-bb4a-348ff0b604e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884505, "uuid": "67de8608-a72a-4a9f-a648-76d9a0b51ca4", "value": "EF70B147C0A5D36421A2E3A444D24F2C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac7e02e-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697884550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884550, "uuid": "34936d57-1057-47b1-8e0a-fd6e3f50c18f", "comment": "Malware payload (RedLineStealer)", "value": "a580b7f4f953ae5417644e00f072eada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884550, "uuid": "44cf3581-82c6-4935-a0d3-085cd553b997", "comment": "Malware payload (RedLineStealer)", "value": "68a5745a84dff382d7e40bdf48e156840a8a627e626bade0cdfd47605d98cd4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884550, "uuid": "36d39dc0-abf9-441f-a6e8-122b9b9069b0", "comment": "Malware payload (RedLineStealer)", "value": "638761f6dadfedd50546e8b6ff7786b0df91601f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884550, "uuid": "67533c30-613b-4992-97f2-296a46303c80", "comment": "Malware payload (RedLineStealer)", "value": "ca46d42df5ae373b93a1e9b13b90224aca2ff9d967812a48f9734b9cdd5c0a67b1834657fad7bc0c0d82f507086b6167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884550, "uuid": "e48bffdf-e5ee-4e67-adf3-d697dfe7f2cb", "value": "T19265235316E82932D9F12BF0D8F642430D353C207930D3935AA1A9DE8EB3AD565B637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884550, "uuid": "c7fad631-a6e4-43b0-a1fc-449162f0fe18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884550, "uuid": "068bb8c9-d9e4-413d-a257-4d850d48daa1", "value": "24576:Pyvucg5mxhWOII6445cPTdQX/ln01Ynys4vS2Aj193MkLhN8S5CglnfGL:avu7kxwO96t5cP5QN01guQ193Mkndln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884550, "uuid": "7f09e7f5-59e4-4962-9b63-668f791d7678", "value": 1512960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884550, "uuid": "788a7716-819a-4648-830d-00d703d729b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884550, "uuid": "2eb08d19-bb47-4d77-b6d1-399dd546d8aa", "value": "a580b7f4f953ae5417644e00f072eada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46bd44f-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1697884567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884567, "uuid": "cb787896-678e-460d-832d-fb88ad886a09", "comment": "Malware payload (AveMariaRAT)", "value": "425ab00f6f0c6428a0edc8eea44a72c6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884567, "uuid": "ce5a47cd-3837-41aa-b9b0-1d61b33d9b82", "comment": "Malware payload (AveMariaRAT)", "value": "696aaa0a2d06804fd98c3b16ae704eb779ddc833a6782fd289716dcf7fda35c8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884567, "uuid": "b103fb25-efb1-47d1-b798-63edf74cfc58", "comment": "Malware payload (AveMariaRAT)", "value": "21fb61892722310ea7bfbc4581d6bc8549e747ac", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884567, "uuid": "8d4c918a-7d62-46df-b2ba-db88640a11db", "comment": "Malware payload (AveMariaRAT)", "value": "483d443a450d3c730871f136469258c1863b102955abcbcf997f2a4bfe8abf046d24ab0ba7b083ce9d328f34c420ae0c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884567, "uuid": "fdc3a780-1b9d-4044-a6e7-3ae0af063e43", "value": "T109E4BFC8B600B19ECC17CA768974DC70DA523C7B532BD11664CB3DABBA7E5968E005E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884567, "uuid": "cc8e354e-8148-4360-9af5-b0b41eb3b7f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884567, "uuid": "af0087a2-78ff-4874-a0f5-e08d04e7e7ef", "value": "12288:66RsEwmhzfqBu4aqwQcY5AsmK0S5FejZ0UuMd6XXH93zVqajynHLAN4QAPrvAkkb:fjwCT6baqbcY5AsmXvjLus6djJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884567, "uuid": "ee25e6d1-3e29-4555-93bb-8bc3ff27b464", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884567, "uuid": "410ff791-11c2-4b38-b7b9-bb3a29e7ac5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884567, "uuid": "f99bee37-ed6e-44e2-ab2f-7065ab23afc3", "value": "425AB00F6F0C6428A0EDC8EEA44A72C6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1172e358-6fe6-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697874442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697874442, "uuid": "c4fb18a5-4828-4989-83a0-5e160f64dc9f", "comment": "Malware payload (IRATA)", "value": "e057c4e7b37b3be1dbb6977af5db9b0a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697874442, "uuid": "dc285610-4c0c-4175-8de0-a14839ed4472", "comment": "Malware payload (IRATA)", "value": "6993d0ce074816c4f58761aa1579104aa5b95f1dbbf32ea70a67f904f6023fc6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697874442, "uuid": "0a225e92-ebfe-40e7-ab0e-34c13b57d572", "comment": "Malware payload (IRATA)", "value": "599d4fc854764feb2dbe306248d49aefb36ea11d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697874442, "uuid": "ce06fbd8-65dc-495d-8b0e-7f3c51e38594", "comment": "Malware payload (IRATA)", "value": "93e6c7f9cd76d1348ae827bec1275e09a4937d806abdd7595fdf29fb9a4d3f5684caab29a3d711a6fd021c246b8953df", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697874442, "uuid": "28134918-b3a7-4b9a-bd02-6e63cfcbb927", "value": "T19FD52343F237A86BC876D1752640333A508B8E6DCA05FB4A799877A934BBDFC47812C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697874442, "uuid": "7c3bbd81-7c1e-4dc4-ba3f-a44a07dd7aee", "value": "49152:dE7vlzMDP491kAO9Ods2eWoUJrfWkyjBKXV/udUFuV9:dYeA91kAO2leoVf9yjQGC89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697874442, "uuid": "107de11c-16e0-4e83-9d2f-ebd2e73ebe20", "value": 2760842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697874442, "uuid": "5df25424-df67-46e7-91c0-edb5623355a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697874442, "uuid": "524331d5-26a8-42f2-ba1e-a6d9ab7d0d9a", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418ea9f7-7036-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697908882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908882, "uuid": "79a9df12-5dd1-41ce-9e38-42c4f8005976", "comment": "Malware payload", "value": "139dc9dfb25cfaa39100964c86d92fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908882, "uuid": "970bae56-985a-40e5-bc25-3c8172e11ecd", "comment": "Malware payload", "value": "6a045ea17187709bdeef34b9d03c84fcf7c934c70e4206dd06787580995ec87f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908882, "uuid": "34a6d095-d033-488a-b216-7ca2e2b781f1", "comment": "Malware payload", "value": "a60f7661efe8e20762115317d5ee626eb0eba526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908882, "uuid": "2c5d2508-9bee-471d-a363-385a9773ee96", "comment": "Malware payload", "value": "6544d95739c2c0bd8670b0e455cdcfbf58111c116e4dc5c1cf605c57460261c48a8f639ddfa400642f2f603896e912ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908882, "uuid": "585eaec8-9415-47fd-828d-8e7e7200bd40", "value": "T112752316B6F85176CAB81B305CF307430BBA7861ADB446266589AD4F4E33F90E63173E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908882, "uuid": "4c7f0df9-7d89-415b-8cba-c6bc5e7db38e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908882, "uuid": "bb6a5474-27f8-4441-85a8-1ef9bb72bb8c", "value": "49152:pK8JcyhTc5cuCHGJcjo6loFnQ94Hjx/MVyAthA:UScOwWrHG+jfAQa9Mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697908882, "uuid": "d6258143-5916-41b3-93df-9f5034089ed2", "value": 1578496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697908882, "uuid": "d6a390d0-1275-4194-9702-1df0f5db5510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908882, "uuid": "f09996f0-7420-4aac-a398-653472e48bb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2662469-7029-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697903488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903488, "uuid": "f5f6f234-ae42-4f58-9db3-7c9effd3e5d5", "comment": "Malware payload (RedLineStealer)", "value": "ba3cc252387fd4f90201c371bd3e0190", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903488, "uuid": "530091e1-cd71-4e3e-9379-2b40cd326b6e", "comment": "Malware payload (RedLineStealer)", "value": "6b96f6652af99c513bbe89a4c5e61e2729aa1f67ce0c0c3d0ca28d2959dcd82c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903488, "uuid": "16af6dd7-7202-4482-9909-053b30c9624c", "comment": "Malware payload (RedLineStealer)", "value": "6796980637d3eb3dfe03c8951e4db9e581bc7181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903488, "uuid": "39b26057-3798-4b19-b3a0-4ba287fd379f", "comment": "Malware payload (RedLineStealer)", "value": "91884be090673a819cba8201fce8fc5d9d7a701d6137963144109a6c01f6f1477e4e030b699e836e2c43c9501eae1bb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903488, "uuid": "602ae8ec-a3df-49e1-be26-0fc63d8f9831", "value": "T116B45B51B849472AE3E20C7CCACA5EAE4D507F2D6F5A0B8F36E14B04778A7D1697810F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903488, "uuid": "76f28103-0a49-4923-8932-d50689f303f7", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903488, "uuid": "2fcb96a4-4c84-4601-ad5b-e829eefd091b", "value": "12288:U8JU2lI99zBaruMczCFTBF4s4l+eXmzFvH1L:1lI99IruMczCFTBP4YznL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697903488, "uuid": "63d46fbb-3ee1-4d8d-96c2-d728f9fb00cb", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697903488, "uuid": "336c4592-f0bc-47cc-88bf-3a734bcc9b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903488, "uuid": "1489d92f-f649-4d8c-9558-5ab9da31f1aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0ee844-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906328, "uuid": "7ac2583e-b330-4b33-b886-4933e6bc20a5", "comment": "Malware payload", "value": "3f87580fb42252e78a93f6933decf547", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906328, "uuid": "756d603a-9418-4fe4-8f09-0477eaa93bbf", "comment": "Malware payload", "value": "6e6d8df5ac15f7b8295a2607de32a846c36cedf80d1b9d6ee5a8b940c285380e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906328, "uuid": "59a8f283-0dd1-4919-b4f1-da5df080bdfa", "comment": "Malware payload", "value": "10169689abdd916edfe8ad7ade5dfd0a04a5ad5b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906328, "uuid": "7227b18d-0ed4-4cb6-a3e1-dd3d626eedce", "comment": "Malware payload", "value": "0e13cc3340ef751f7abd8394b7ad2849157e6b387daa434bed8c7b4dacd09eb9aeb260f31cfd010a5c0071628e8d5cf5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906328, "uuid": "3bf41a6b-aa52-4ace-bfed-387a38334059", "value": "T140A45949B6B0E969C05CC9B2D4B264B1A9111DA47C9D489F36A0760F1DB33C36F72F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906328, "uuid": "0ea59c37-0c82-42b2-ac02-5dcb0722898d", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906328, "uuid": "8a325f86-66ac-4c80-95b2-b3cd3b0835b8", "value": "6144:+RR5rhZFQGrsUwF7vlPoSckoSReAjThvHi9RjWVOOO3w2hThx:+R5nWFpPoSctsB6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906328, "uuid": "d4687dc5-9570-4008-928e-decbb2a36758", "value": 464794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906328, "uuid": "5bd6fbf3-4751-4b81-97f1-ecc862f53086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906328, "uuid": "75739d7e-35e5-474b-8493-c4bf36ae3ed0", "value": "SecuriteInfo.com.PUA.Tool.DialupPass.21373.9767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8fc594-701e-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697898697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898697, "uuid": "1365bcad-e648-48dc-8ad4-eedeae6d98a9", "comment": "Malware payload (Stealc)", "value": "77b201032b63ac8045eb6db64904c5d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898697, "uuid": "9a1cddec-25ec-4d8b-9ea4-f42dee7a34fa", "comment": "Malware payload (Stealc)", "value": "6e98f75742c12f006a1a711feabc456dde5dd424d439723d37506c51af48745e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898697, "uuid": "acfc7d35-24e1-47ab-9176-cb0d116017bb", "comment": "Malware payload (Stealc)", "value": "65c8ac68af29e16da8548a3db389843bf3bc7891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898697, "uuid": "87ebe588-1fd3-4774-99b5-0a897c5197dc", "comment": "Malware payload (Stealc)", "value": "7bbb4a03a903294b92c87a05a79b458ebabcfb298beed4cdcde080a045438ccf428dfe0f4ca599a5c2606a14794233e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898697, "uuid": "ff58faa3-1424-482a-b02d-0e6e0d952147", "value": "T1F8452303A7D88036DCBA137088FB06131E39BC559D78C7563792D8675EB2A8478B9737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898697, "uuid": "277b2c07-932d-4a71-9ead-4b4e57776545", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898697, "uuid": "340ece00-0495-4f40-9e9c-7baaec68bfc9", "value": "24576:hy2oADz7IW/HLShEyAUIKm0jcZaIPcEnu5um9nv4P2Lxbg2:UTo7IWvLShErUIKmccfPNu19nfxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697898697, "uuid": "259871d7-1a9d-46fe-ad93-d2f9a2bf1f08", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697898697, "uuid": "d26f4a60-1979-4155-8822-bd022a77e70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898697, "uuid": "975ccd80-8ac7-489f-a334-0dd388eb331e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8894a0a-7062-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697928006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697928006, "uuid": "bb1bab63-a8cf-4799-bca8-f7f03d98e64e", "comment": "Malware payload (LummaStealer)", "value": "07f111bc158869921730ec3cea567a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697928006, "uuid": "5ba29b5c-caf3-47d8-9396-4aceef60d465", "comment": "Malware payload (LummaStealer)", "value": "703b1954034aada5cdfb746ef6633a8e7943c89a5a0d09fac3069f07009805d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697928006, "uuid": "b65f66ce-01fa-461d-823e-57533973d74f", "comment": "Malware payload (LummaStealer)", "value": "a48556b802365cab31170b70e39dc508f697167b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697928006, "uuid": "f3764e89-4c47-452a-baeb-cb4f943e7528", "comment": "Malware payload (LummaStealer)", "value": "13e40c30471b9bdf5ff25f2bbbac83c3161e6aed2bfb8a019e15f095bb9d407d8418276889a65d338fedc79ea80c54f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697928006, "uuid": "a6800ed2-2527-4992-b270-9a65a234bbab", "value": "T10F158E2138C49176EEF320B787ECBA3642ADE0B4071915DF06D857EED7606C27B32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697928006, "uuid": "df3bad8e-0f65-485c-be8f-291159481de9", "value": "4c2ede2d1d1824f0fded580996722f5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697928006, "uuid": "d4f086c8-adff-4bf3-a3f1-9af03cb8b42d", "value": "12288:Zu5XAW9g1Azv0X5tHXSlVceJnMa5ifhNYwvumoQzem0:ZpW9g1Azv0X5FUHz5ifx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697928006, "uuid": "05ec32a8-3b9b-4c6e-b3be-da8816722401", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697928006, "uuid": "4b3c995c-ceaa-4a6c-9a87-358c5ba6de10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697928006, "uuid": "0518e89b-b665-4046-af04-50e18fc54a6f", "value": "07f111bc158869921730ec3cea567a0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d25bc61-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697884528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884528, "uuid": "fcf80220-f18a-49e6-998d-a5c8793ee58a", "comment": "Malware payload (Amadey)", "value": "3d1c121ba9aeb7fed880487d32da4713", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884528, "uuid": "a603c652-26f6-40c1-90a9-6f66f981be89", "comment": "Malware payload (Amadey)", "value": "723e13f7f7c2e462ba52e41cc8e68747ea7500f2f9adebeccf4761f8594fb4c3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884528, "uuid": "00d481fa-541b-4363-8d88-0dc1c7819576", "comment": "Malware payload (Amadey)", "value": "785060dc6800fd09d3a3fc42ec4cd0761c3e3656", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884528, "uuid": "8a6889c0-1a2b-433f-bada-3cf540fbf52a", "comment": "Malware payload (Amadey)", "value": "5cefd4ff0821bdf4d20d4b4ec0130a2642342ab730d4e94a555ff461820507cd6c71411d460387c56ed0c1b3bc20e49f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884528, "uuid": "56bc3a48-e1cb-46ea-b305-7c518ffbaa9d", "value": "T11B158D2139C18135EDF320BB87ECBA3986ADD4B0072912DB16D857EED7606D27F32592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884528, "uuid": "d86f3e4b-3458-408d-8c66-fd186499b2cb", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884528, "uuid": "6a776e44-55d3-443f-a433-276543a0414f", "value": "12288:tK+tx4HG+wwJMRrxbhxJgSSBxi7wnez9OOdj83fj/zl87uD3ICjEL0S1J:sK+XJMRrxbhxJgSYFez9OOuvjxREo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884528, "uuid": "9237b8df-89b0-46a6-89a0-f2efc13bd4d4", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884528, "uuid": "0bc9bdd0-f1de-49f5-b69c-63fe86332efa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884528, "uuid": "cd891165-2aa9-40e7-a661-37ec026b7c60", "value": "3d1c121ba9aeb7fed880487d32da4713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afaf9d23-704a-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697917657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917657, "uuid": "27f1d344-2c33-4a09-87e0-1a728b2b9e77", "comment": "Malware payload (Mirai)", "value": "bf1e088a31e97406911d582a27a2d319", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917657, "uuid": "b73de9a0-94e9-43e8-9e67-fe19684f0ffb", "comment": "Malware payload (Mirai)", "value": "73d676a0dab17cc2b70375dd14d0bb9c9e85646051c13413309fa6fddf8b4f6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917657, "uuid": "25cfd1e4-4a38-4f41-a1b2-3d171cf2309d", "comment": "Malware payload (Mirai)", "value": "2825b416feedbec6e703049b5fa71b75d61f5905", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917657, "uuid": "7d3679fa-b240-4d9b-b5f5-58aaf03ccbde", "comment": "Malware payload (Mirai)", "value": "ec0a956683e4cc6a9a04cb358c2c9e9e76561c06d9f435de686f4124c59b3152693258c3befa07ac5d8888ec44cd9514", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917657, "uuid": "ed3f2d84-aed9-4354-b59d-c86bf26f1690", "value": "T199334CC5E583D4F9EC4306B59477EBB386F3E93A00A9DB93C394D836D852521A61B38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917657, "uuid": "04ad7eb0-53ce-4aeb-9f2d-0bc46ace2433", "value": "768:sLXuZUl3lHiR+yubAGfljR0JGl42phnBwTCH4vdbWbc/a89qFAIYT:KXuZUl3lHs+GaWC44QCH+lEc/LqFAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697917657, "uuid": "8b2d41d3-3e54-44ea-a75a-280dd3ead1a6", "value": 50348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697917657, "uuid": "ab217e22-bb6b-465b-b869-01e7e7907012", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917657, "uuid": "5bd1cc96-5c3f-424b-a13d-2d9192eb16a4", "value": "bf1e088a31e97406911d582a27a2d319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10b3fc1-7052-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697921095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697921095, "uuid": "17407802-d512-473d-a2d0-66249ffb1700", "comment": "Malware payload", "value": "8b14112970c163461f22a53846325477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697921095, "uuid": "6dd8140a-534d-44c4-847d-165f01844cf7", "comment": "Malware payload", "value": "73eb3d2aba8df513aaa814e4b1760b8907417e6ee5dc42c43c5c4f0be0c67cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697921095, "uuid": "1872e460-04ff-4e13-9783-785f1947718e", "comment": "Malware payload", "value": "7f1719777007bbb50711a0710e9e008ca76d89bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697921095, "uuid": "8dbb2e61-ad5a-4627-b33f-d1c861941ebd", "comment": "Malware payload", "value": "5141d9d1b6c314908c5b38cc3a9f65a4869b5461bad8a250397f78c6fecf07923e8d2ed2a4c44925d0169ea5acf9838e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697921095, "uuid": "1a6fe09d-f82e-4415-8a0e-05b9737af7a4", "value": "T1FC753313B3DD5133D1BA1F70A8FB40470635B8B20576AAB712DA958E0DB3BE19933B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697921095, "uuid": "12568cce-5df0-4aef-a2a2-e4d17c260d43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697921095, "uuid": "c261fa66-7dd3-4fa2-8842-f71d856f84f5", "value": "24576:Sy5yxY6CfDq0U3NvK6VIg2Hu1Ekvs4bFpHA1SEXQC2NenUvqNwtp4SKi:55yOTW0U3NvK5g2OOkTIKZvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697921095, "uuid": "c582844a-3bd5-4df1-a16f-b810af083372", "value": 1602048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697921095, "uuid": "590ecf72-edc4-4a9e-953c-e61b3b6536f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697921095, "uuid": "70d0cb3c-d167-42ef-8af1-ca0391e3c6f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0013acba-6fca-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697862387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862387, "uuid": "fabd5625-fea7-4ba9-84ef-742d308ee392", "comment": "Malware payload (Mirai)", "value": "920e89e60b3f0cf16fe5fa8f4096de52", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862387, "uuid": "bd14e00f-c160-4f81-ae7e-f8d1b4d146be", "comment": "Malware payload (Mirai)", "value": "7400b059554139fce9e9cc51c9320dd4abd4496db894ab763206b0d154a7d247", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862387, "uuid": "f2322df9-bb46-4300-aa51-59f8cf22733f", "comment": "Malware payload (Mirai)", "value": "91ba74e8deb77827da78a96c967bc0ee6f7c07ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862387, "uuid": "14dba1f4-2265-4a1a-9609-a5f9ad553dc2", "comment": "Malware payload (Mirai)", "value": "9c9f46b83beb0ecf53a5a05e44cde30a23b6f54a267bb7a0e5b0100375c3d31c50910857e2df18fab28b00202083b1b7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862387, "uuid": "06578747-4aaf-4346-ab86-aa24719a077e", "value": "T13404D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862387, "uuid": "2a00dbee-e6b8-48c9-9623-f344f77a85f4", "value": "3072:ueEksFM+wXWOsaVR8H3NaMZOTTMJxt9U+7fKbgE:ueEnO+wXbVWdaMATwJHy+uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697862387, "uuid": "4c6c2e5e-23d2-4b1c-b330-3eb5fba6d1ad", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697862387, "uuid": "0dea3d5f-5ce1-4dd8-9db0-cf5acc781b09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862387, "uuid": "23fc5c04-cac8-4fb5-87ff-1f2cea450413", "value": "bot.mpsl-20231021-0425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf89adc3-7031-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906973, "uuid": "1366bafa-ac9a-4aea-bf18-38ea580f1b98", "comment": "Malware payload", "value": "576a1d9e79bf32120d74eabae45f17ab", "object_relation": "md5", "Tag": [ { "name": "Clipog", "colour": "#63832D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906973, "uuid": "d0024800-2b16-4a41-8a1c-4a0e36a691f9", "comment": "Malware payload", "value": "75878356f2e131cefb8aeb07e777fcc110475f8c92417fcade97e207a94ac372", "object_relation": "sha256", "Tag": [ { "name": "Clipog", "colour": "#63832D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906973, "uuid": "6d1209f9-84cc-4c51-9594-aa5df622818f", "comment": "Malware payload", "value": "56df507f945d6149a1f0090a19c71254cc08c84e", "object_relation": "sha1", "Tag": [ { "name": "Clipog", "colour": "#63832D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906973, "uuid": "fcf16ac1-ff21-494a-b119-91435754449b", "comment": "Malware payload", "value": "15758871606b8d71431dd4f9d6f94e4026c6cf07ef8b928211d817018ee6adb94444f88fa7fb167a289b3699f17b1d92", "object_relation": "sha3-384", "Tag": [ { "name": "Clipog", "colour": "#63832D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906973, "uuid": "97844f61-baf8-499c-8813-602c8c8ea929", "value": "T1B7F35B0B77A460F9E176C27CC9625A06E7B274321761EB9F0364437A6F332919D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906973, "uuid": "b3aa5bbe-88c1-4ae7-acdf-025fce8bb21d", "value": "a5dd8b448456ef8ea6c5dc359eaecc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906973, "uuid": "dfe51941-a1bc-4ce9-9a24-9e4fdf46b7ad", "value": "3072:NFX2siZyM/WT1HMAh9HBbv+W10AvXix7GS0fnPD1zTXN4KiK+KX0:DX2siZyMKsGHBqQhPiFGhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906973, "uuid": "b9c2a5ab-3169-452a-9068-3ac26120d85b", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906973, "uuid": "39791625-212c-4e54-965a-ff6560df8289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906973, "uuid": "dc74772e-08b0-492b-8410-86ea563c85f7", "value": "FG-Tool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4279b2ef-6fb4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697853049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697853049, "uuid": "2ba64e15-0bcf-4d8e-84a9-fd02392c3488", "comment": "Malware payload", "value": "c2ad4a189fa04e3db5c5c8ae2aeca207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697853049, "uuid": "15673c6b-718e-41a8-967e-e0ddda6d2177", "comment": "Malware payload", "value": "7721b998cea6f21d723d73b315cca9941a812af0cac228f1eb697c7c3ee08207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697853049, "uuid": "6cb8298e-00e3-4ff8-a156-df76aade1f6e", "comment": "Malware payload", "value": "798ea55889ccde8c9b6754e021f3626924bb35f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697853049, "uuid": "bc7cbfa2-52e8-4966-bd74-97688e0b4b9d", "comment": "Malware payload", "value": "1db12140dc70373d08b2e72726c6755c7861acfb7be999b25a578ca9ce8f3ca1c7fae96db37fef2e54457f1c45107eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697853049, "uuid": "2d5b3801-cdaf-4bea-8064-1fafcf5f40d9", "value": "T17406F177B4CA6471F4632A7378E62462393E48CCE047186939F4ABE6F532D098F8B751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697853049, "uuid": "3170f4ea-2a47-4416-b999-319b533f64a1", "value": "6011984d7c1f1b97a34d7517a498bff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697853049, "uuid": "fdde8976-b3da-478e-bbd9-e90b4d68169a", "value": "98304:Td9vuwGgcE4TBrHJWGs2NyqeoNE/7SRYYz:TdZcfTVHJack+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697853049, "uuid": "8ad929b3-a089-45e7-8df5-d992e99739c2", "value": 3978151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697853049, "uuid": "73364a5c-b790-4570-9787-3a5d87de3876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697853049, "uuid": "cef6a7c9-704e-40c4-95e6-8d42fb74dcdc", "value": "86449ee6fba0a20815654990a5990051aefc4c0e40df1e742da41755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ad1f7c-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697884549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884549, "uuid": "52be3ae8-63b7-474d-a65d-01ac459d1722", "comment": "Malware payload (RedLineStealer)", "value": "dec82f0dfe4b8901747192dcd7204377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884549, "uuid": "395d69c6-a735-4f0b-a29c-257d6aff1fbd", "comment": "Malware payload (RedLineStealer)", "value": "7897518dfa11c90b8be018a8a51c00fd9cc4ca0c0d8dd3f7a1c960f3b84be068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884549, "uuid": "0d53b3fb-ac15-4ac4-bb62-f019a056946f", "comment": "Malware payload (RedLineStealer)", "value": "35aa6e9b73ca87f6dc016da713a3f78485729cd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884549, "uuid": "946ae088-e4c3-41d9-9d25-46163c45dc03", "comment": "Malware payload (RedLineStealer)", "value": "f12eb270c6426c84b66f2ea46d2dc3147dedf836a29842218758c1a2d6b41cfd6ba83f515a686b7caf3d1f166a4f1c94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884549, "uuid": "5c1021c3-7bb8-4542-8faf-8e784fc83cb3", "value": "T1E2652361FBC9D133D8FA2BB049F603C32F367C65947416533709996A09E3C81AA3676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884549, "uuid": "1c8a3d10-de57-44d4-b631-16254b19801b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884549, "uuid": "54592a6e-61d0-4813-943d-65ce2a69ce14", "value": "24576:Ay+FZBCuv7AQLEylu3qJwKguZqJGfPx4v1Hq9PvtMqVwQchPzLzxZD8N5M2gTiby:H+FZguDAQLvMVKg1JGf54iOzQ27LzxZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884549, "uuid": "176c184e-7347-408b-87fa-8703eaf4851b", "value": 1518592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884549, "uuid": "04f5c6a4-037d-405d-b921-56790782ddc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884549, "uuid": "28a0a9cc-3cf4-492b-9ed3-f63c5129fab2", "value": "dec82f0dfe4b8901747192dcd7204377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c9b4f3-6fe8-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697875546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875546, "uuid": "f43c49b2-6053-4fb4-a8c4-e8bcca809aa4", "comment": "Malware payload (IRATA)", "value": "86de2ebc5739a3b250e86bc4956cae11", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875546, "uuid": "b1314044-0911-4c05-ba6b-682eb546312b", "comment": "Malware payload (IRATA)", "value": "79192acfdd193bed6d337cf3cb504303c967011425f7c9b54e0043bc3d68f653", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875546, "uuid": "a6d0bc1e-cba6-4956-a2a6-e85380dfb898", "comment": "Malware payload (IRATA)", "value": "0e9bf0b45ffe6b5e5204a6c6b89dd428407c5cb2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875546, "uuid": "1ce4b9de-84e7-48ce-9dc2-49a0a3906c98", "comment": "Malware payload (IRATA)", "value": "d4a629d74f3e0bd89d69ac0eb6278c3f5a4b3315bc9061bfe4ae274a3340de7f2f11f7c6531e20f8123b9f4d47c47a8b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697875546, "uuid": "15750cc1-7eec-4f5e-851c-03e822a380ad", "value": "T161A533ABE0437563FA3ED2F2118721C151561F04CC8F98497A3E372C567BADEA35A4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697875546, "uuid": "0d0d87bd-e905-48f0-ac79-48c78f0d4d14", "value": "49152:ZEwKhcjgEwWH/z7t/DZrVpejkB7pnjaLiC6V4TlCQnG:ZrDUDW/vfBFnjjVWtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697875546, "uuid": "2d72c9a0-a089-4154-afe1-4c6b24bb72e5", "value": 2206939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697875546, "uuid": "060e3014-3c0a-4c08-81fa-4e6aaabafac3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697875546, "uuid": "2137bedb-07d2-4ba0-acaa-26277a3d617e", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081b78b5-6fa7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697847368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847368, "uuid": "14f4d3e8-6e38-4bea-8a44-1dcf9eb07854", "comment": "Malware payload", "value": "3a821fb20eac75c05e8e9454da2df324", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847368, "uuid": "9929c1c0-2b52-4add-b8c7-8824c07cfad9", "comment": "Malware payload", "value": "7947cc1d452e24086700b59506765c2411c8d3d042d92fc858eda3cf3cf45e36", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847368, "uuid": "3f29b693-028c-4e28-80fc-c242bb97c20f", "comment": "Malware payload", "value": "de9b6550037ec88f2bd223c6022b5d23e5804759", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847368, "uuid": "9ba7a8c5-c9d0-4c19-89a5-788d26251bfb", "comment": "Malware payload", "value": "7d531c84f005d24ada7ab4fc3948a087cd484527e7a87b14d25317459a75d0e24ce5eb42fae9d3d4c64a3311cccd044b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697847368, "uuid": "8397b392-5a47-4ca9-b08a-4d15af8b4e0c", "value": "T181417B141FE52724F3B39A7568FAB311CA77B849DE018B8F018183882462615F5BAF6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697847368, "uuid": "b494eb2b-2305-4171-ab97-819e3122b96f", "value": "12:8AXUm/3BVSXvk44X3ojsqzKtnWNtW+UcCsvXTC6CveYMThbdpYrn1IlI5u9bOVng:8A5/BHYVKVWO+/CWu6CWtdd79ds5ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697847368, "uuid": "18e33125-3814-4577-a990-b98e0e815ea8", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697847368, "uuid": "b8db8311-2ab2-4526-937f-2965263b0998", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697847368, "uuid": "da7656ec-90f6-4e5a-bead-8cae2962352c", "value": "f14ece26964aa788fac648360b8ecca0214d979c846646fca3302e1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110d326b-6fca-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697862415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862415, "uuid": "e534796a-a4b6-473e-8032-c2fd7dd854dd", "comment": "Malware payload (Mirai)", "value": "cfc0d698a1df4c90cc1c63f5316e2dbc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862415, "uuid": "179e2601-f63f-42fd-8ae5-7bbc2c462674", "comment": "Malware payload (Mirai)", "value": "79d195770dc8fca1f61d3d0db80c2d55005e4c39cf65e7a1430d7971df7e0d24", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862415, "uuid": "7cf9b08b-5cb8-485b-b2fd-8e16d93edef5", "comment": "Malware payload (Mirai)", "value": "881b3c0f62921ce22022ab5487ca9348d03da297", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862415, "uuid": "5f1fb9b5-6bf1-4b2c-978c-5de7a4db2cc3", "comment": "Malware payload (Mirai)", "value": "ac4ae056c1b895d4dd3251d957cdd09aeaf9cd227bb9f4778bee4a069013fd54e7d19cce08bd6b36e5d70fc4b35fb25f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862415, "uuid": "e8e8d8fd-f0d3-492b-9822-7cb16caf8e0b", "value": "T127C31A55FC405B13C6C212B7FB5E428D3B2A17A8D3EE72039D256F61378796B0E36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862415, "uuid": "425c6a07-46db-4b87-b10c-93c622ac45e0", "value": "1536:Jtv+s43G5bUWkWRALSh71QAFMxK4VIGUT2yR2hO/CoA46n/txlc6wyw1FrR7PVzp:bv+XQJRsg71QNE43UqyR2hOO46/ykb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697862415, "uuid": "c3624d2c-6353-4896-9cfe-2c45761628a3", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697862415, "uuid": "9f4346f8-e2a2-4fa8-9178-7eb6fda1aeaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862415, "uuid": "16504032-4d7a-4b30-bbc5-62706fd85ed8", "value": "bot.arm5-20231021-0426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2a29d2-6fd3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697866412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697866412, "uuid": "340e7a67-e549-4b1f-be37-1978d03d8b68", "comment": "Malware payload (RedLineStealer)", "value": "124ec3cf0d4db5778e4c2eee4358c506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697866412, "uuid": "dc17c313-44fe-4535-8d5f-5dc95a8e79f3", "comment": "Malware payload (RedLineStealer)", "value": "7c7d8541766ddad17d9735ed7183d3d7e3433ea580258ed89f465fc8e91d3b82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697866412, "uuid": "00fe1b28-7abb-4fe4-be99-3246e1ed9d53", "comment": "Malware payload (RedLineStealer)", "value": "8893dce640f3aef09637d558b2f34b67b3e57684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697866412, "uuid": "6f8f8791-176c-4b3c-9450-1689e3ee1eee", "comment": "Malware payload (RedLineStealer)", "value": "47d9ddf4d9a68c004698172f162fcd8b562bb31e5efee255b8ebc696ef5856072743ef614eb70c5e7ac8b54608b16392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697866412, "uuid": "d30cb554-88a9-4c04-bc83-3a13077f9f12", "value": "T1D0B46D33DC4861E1D2D71C7994998D6558F9BA6123F16CE31E6C0B4FCA363D3EE2A224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697866412, "uuid": "514c7fc3-ee03-4b6a-914e-52cf8dac8889", "value": "bb8b51bfd9f71c7452726205f579a090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697866412, "uuid": "74dfd89b-41b3-4d5a-971d-46d98c52cef6", "value": "12288:EsdZYbKW0Tqhc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRYL:p2blg5rdV1sjpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697866412, "uuid": "ba3438d0-6222-4bcf-8591-0c55791b91c3", "value": 517704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697866412, "uuid": "e056e478-a9b5-4cfe-8bf8-bf126ea5bcbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697866412, "uuid": "54873a98-b683-4047-8137-c88af64240cf", "value": "SecuriteInfo.com.Win32.PWSX-gen.22729.427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340de068-701c-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697897692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697897692, "uuid": "c316d189-d60f-4ee1-8834-47f60ce79739", "comment": "Malware payload (Amadey)", "value": "5ac065624954fa0e1d57df4015c893a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697897692, "uuid": "b7e8ffbc-ee75-464e-b3d4-f8234b8b8b62", "comment": "Malware payload (Amadey)", "value": "7d01e23fcc7ba1645e20f9826d6c3bc4ef03713f1935569f01fd856b471c6393", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697897692, "uuid": "31bf540e-2e13-489f-8cf9-36f5911b5b04", "comment": "Malware payload (Amadey)", "value": "6b8cadafa827556c42386bcfd2cf580dfd073b33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697897692, "uuid": "8641b938-f49b-4173-b53c-c119c8ef8491", "comment": "Malware payload (Amadey)", "value": "8816fa5a825e39d29452778e010a4755cdaed2a800e2434c31586c91dc61fb45d6b3d19cd2feaf0ade0ac0501e027b95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697897692, "uuid": "75b4719e-edde-45ed-9d92-6b51cf7fe144", "value": "T11E452313EAD89252E97567F04CF303831A3A7C929C38A7555B02A5C50D739E8DBB1B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697897692, "uuid": "b1253033-cbbd-4b16-a364-8e28ebc2e2e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697897692, "uuid": "10e2e16a-803b-4818-990e-e383c2d2ed23", "value": "24576:jy8U+u5iicvoh9SUww5KCqyTv12LVrljEwZ5UZ45LoES7MFq36:2BcZLU1KBK12JrBEEUsoESgFq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697897692, "uuid": "63a938d1-ccab-4437-a5ce-d692c76eeed3", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697897692, "uuid": "e612b9ea-53e0-4aa6-b04d-0c75ad09112d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697897692, "uuid": "1ce3b27c-5df3-4e43-b7ad-da3b679bc5d1", "value": "5ac065624954fa0e1d57df4015c893a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99912c95-6fba-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697855772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697855772, "uuid": "23570f84-4f8a-4e6b-a419-c86c2a9da2d7", "comment": "Malware payload (RedLineStealer)", "value": "933d69aa61cd10c9c50b342cd8b08dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697855772, "uuid": "bbbda25c-ed94-4fee-92a2-624fda0fa1bb", "comment": "Malware payload (RedLineStealer)", "value": "7e8329ce45baad20bd1b7ce9bf6e6f1d6ea5935904130a70a275617f522fe238", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697855772, "uuid": "de7d409c-ca11-4f79-a001-58af88cb3697", "comment": "Malware payload (RedLineStealer)", "value": "4617a0506a02830e7d6f34ab6e1d6dad2a989476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697855772, "uuid": "6da74b85-f8f4-4d0e-b9db-e7bb307da236", "comment": "Malware payload (RedLineStealer)", "value": "b94333c334c0dc715027228c9a3b3b3877dcc09deabfe99c74e7417a03f61186e2e5626be59a5c280fac678f612b3473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697855772, "uuid": "06c9bbc7-13d5-4633-a9f3-06c6bf80b6cd", "value": "T1CBB46D33DC4861E1D2D71C7994998D6558F9BA6123F16CE31E6C0B4FCA363D3EE2A224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697855772, "uuid": "a681eacd-0e82-46f2-936e-868067c52adb", "value": "bb8b51bfd9f71c7452726205f579a090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697855772, "uuid": "8aaaf14b-2a10-46f2-aad9-8b8e58582760", "value": "12288:iZfdZ5riZ3TJhc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRRL:YbrSk5rdV1sjAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697855772, "uuid": "3d8768ce-2815-45e7-8012-0bfebe2592b3", "value": 516680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697855772, "uuid": "ff63b39e-507c-458e-b98f-cf97760e54ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697855772, "uuid": "171ec631-13e9-4cb5-8fd9-a212d27d3ce1", "value": "SecuriteInfo.com.Win32.PWSX-gen.7845.20802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87718b2-701d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697898371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898371, "uuid": "bc246fe8-8110-4522-b7cd-1a4f854b220d", "comment": "Malware payload", "value": "9985a2b46e58e370fe89691817f70859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898371, "uuid": "bd302d40-d191-4161-b641-d35c6ede6fac", "comment": "Malware payload", "value": "805e179bd7fadf38e18f51e2bb87a8d6e58ac854ca9830c970e3f83fecdd964e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898371, "uuid": "0e29cd5a-a5df-4f4a-8b66-228b31ee3a40", "comment": "Malware payload", "value": "b2637db3f33fcdbd769f67e3a8a139d927637c39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898371, "uuid": "6ba09385-9260-4ca0-8442-ec8be352e503", "comment": "Malware payload", "value": "cd450b23ae6598ef575d9aa123c03ff121e443dc80602a575cf66342f4a424202e4b6afebb6b54ee22cbca526bb73c54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898371, "uuid": "8052e076-7ff5-4954-ad43-05932ccad484", "value": "T16B44BF11B6A0C832E56269305971C6911E7AFCE2DB7481CB33983E3EEE712C19F65B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898371, "uuid": "49bbb23c-5dde-4dbd-81df-f8f5eb6c3da7", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898371, "uuid": "79ba4f17-1f7d-4220-a065-be3e03fb3eef", "value": "3072:xyBNXIxAEzM5N3nm4nh6SN8O79dwAz+2zYa5Kj+mI:sdGAEY5NXtnUa7JzGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697898371, "uuid": "d25191fd-bbcd-4c3e-af98-173627c0fd69", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697898371, "uuid": "0511e074-3fc7-4a7a-b1ed-dc052f0d99ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898371, "uuid": "03b45eff-55fd-4c09-acdd-b157d88538df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa696f8-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906329, "uuid": "1784e3d5-a141-46ce-ae55-a148ae8da835", "comment": "Malware payload", "value": "df5f821e76d1b297ac869973dc571311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906329, "uuid": "3cc69c80-200d-41bd-8e4d-8442bab73963", "comment": "Malware payload", "value": "82053ac2dbe642b680aedf33610786c76e0f93946edb7d84addb7f46de5349dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906329, "uuid": "c072d02f-1b03-4114-85ae-043ffd7fc09d", "comment": "Malware payload", "value": "e0a51de3ac7a976857fcf62947a3d77ddf2a4e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906329, "uuid": "9e460382-cf25-440b-85c2-57293ce09c44", "comment": "Malware payload", "value": "5a86a0bd9e14109899250c4f9846a801ec83ba35cd905ec90fae73dac2217432cba8b9d5bd080af4573de54ce6029095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906329, "uuid": "7737cbda-2133-4bcc-956e-baab02fe8ff9", "value": "T1E3F11B93EDA288B7C55DC9BD5D498934E5322A317AE2E2D36FAF580DCC251804BFC712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906329, "uuid": "2174e9a1-57a0-4a3e-ae7d-96333b3aff34", "value": "192:noxfRq8HebguuREnZXbzNbotbFtZKN8lryIle:w3HqsREnZX3Qt02g2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906329, "uuid": "38715780-a94c-42ba-a98f-610c03717960", "value": 7786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906329, "uuid": "1965155b-3369-4d11-85b1-0a1c25309828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906329, "uuid": "81847d17-2280-4e6a-baa4-1d093fd5c54d", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.4387.9383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3435d3-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906402, "uuid": "4aeeaf0b-229a-46de-940e-6924872cbc65", "comment": "Malware payload", "value": "b528a401deefc717d7148aeb9aed1d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906402, "uuid": "01e130d3-6780-4253-b353-b91287cb5f83", "comment": "Malware payload", "value": "82cd193864b6a6d757910c6f495e81b4e9c1d5aa47351a8966173977b7909539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906402, "uuid": "4fb187a4-998f-441d-97a0-2fc332ba92ba", "comment": "Malware payload", "value": "454a6699bebfe16a264378d4845097879610085f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906402, "uuid": "183bf811-789b-41c9-b134-2414b4fd1307", "comment": "Malware payload", "value": "2eb417651dc151d2279cd5558ca304303b89949ac8dc9b14b2c14401852786aa7b8744edd15f8cdbc996d8f94649a9dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906402, "uuid": "352535ec-978b-491a-a64d-f4ebfb2bf3d2", "value": "T1FB44B0117BA0D875E4A22D351834C6951B7BBCE3AA6481CB33943E3EAE712D04F66F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906402, "uuid": "d2de204e-fdd7-401f-9728-07590ec6a6aa", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906402, "uuid": "ba41e538-60ab-428d-a995-5d6618ff30cf", "value": "3072:Z4yBNAbl0xAYzwy43rGxA185T70N/5iMKJ4ftBJ:1aliAYMy4b5u3k/WQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906402, "uuid": "926555a1-8e8d-47c3-a34b-0024b7c56e64", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906402, "uuid": "27b3ce98-cdd9-4a94-a7de-c41bb9765ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906402, "uuid": "0e0a4c85-2ff9-44eb-88cc-8b4dce7ac816", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ec6d51-704a-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697917664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917664, "uuid": "de02fb30-1e7f-44dc-b997-91188169f840", "comment": "Malware payload (Smoke Loader)", "value": "291f31bc765bcc17576d036d09a08071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917664, "uuid": "317430b5-7f22-42e7-9983-acf4e6b7c89a", "comment": "Malware payload (Smoke Loader)", "value": "84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917664, "uuid": "1456cf80-af28-4b7d-b32e-c6620dcf011b", "comment": "Malware payload (Smoke Loader)", "value": "d8c319c6c5faf2815d897741ef89396a25f58a86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697917664, "uuid": "07104f3a-af41-479b-8620-8c9578eb1acf", "comment": "Malware payload (Smoke Loader)", "value": "191c844c5cea248e23946ece6e78284c5b15f9745a4b64d0ea9c4dc13a667ff73c9094a7261e501a5923b4c02e529c31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917664, "uuid": "ab9bba6e-4533-4895-badb-197f2a482edb", "value": "T19C44BF1176D1C432E16769355870C6A61E3BBCF2EA7181CB37983E6EAE312D04B72B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917664, "uuid": "3373053b-261f-4d99-8696-6368684fb99e", "value": "e917b644331755ce8f3ab54716b5cd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917664, "uuid": "533e3fdd-2f47-4aa6-b274-f7e7a4fe1a11", "value": "3072:byBNpOKlAuHKSX3NCrtbQr3YRAyXeAyPkx6yApn93DW2K6wkJ:qmQAuqSXdMbC3UAQeAyPkxcJat3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697917664, "uuid": "733581c4-3b4f-4196-8483-7ef3c4b056af", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697917664, "uuid": "b2b53fbb-3572-4d4e-9433-12861c3babac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697917664, "uuid": "af838508-fc25-46d0-a1ef-4f4c47011d0b", "value": "291f31bc765bcc17576d036d09a08071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977d3d73-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697884545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884545, "uuid": "83286d97-a5f1-42f9-9093-a840802792ec", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c2270a44669683b95cc484686fc26489", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884545, "uuid": "2b0ee469-247b-4579-8538-c1b7c92cb10d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "88994d9d4c1eecc9aa1be9338d3c8c2f4af84d994e9a4603803cfdc14429ea22", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884545, "uuid": "5ded02ca-ec74-4102-8434-142419456222", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e5e8aa02cba05069ae63f040fba87dae038962fd", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884545, "uuid": "36d1bce0-8bf0-4b81-bf0d-8463358994f1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e37631ff02b51ad53b40464f0eff64dba9d918056c998ff6216af161f378dbb17b2b320d54ec13b9ad83f902b876d068", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884545, "uuid": "0dd7dae4-4246-4cbb-b6d3-a63f9b7e0907", "value": "T16B652307DFDA8822DEB437315CF703831A36BC615C3882237256E9696CB22559139BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884545, "uuid": "3d475d7d-e543-4d1b-9ea6-93df9aebaa80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884545, "uuid": "0bdeebde-4b86-46a6-b375-4460e2544f00", "value": "24576:NyByg84HaXpfvzzuDAU7NPuj/0qxUTlBFXn+fzCRyM3+Y9x9/bVuGkPQtv4CM5kh:oByg846XpTzukU7NPm/xUxTXSM3+YBT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884545, "uuid": "c63f61cd-d6bc-44ce-ae25-b9d7b84da6b3", "value": 1515008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884545, "uuid": "020f30b4-a149-4cfa-b4a4-327205282d96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884545, "uuid": "e80b31ab-babe-4d82-b7a1-0898c75957e7", "value": "c2270a44669683b95cc484686fc26489.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39461a7-6fc9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697862339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862339, "uuid": "3e89dc6b-40a8-4558-83cc-bcb7099544ce", "comment": "Malware payload (Mirai)", "value": "e589f0c3acdd2df8998ad0478af1c378", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862339, "uuid": "8f7ca591-423e-4f1b-aaee-f3aa4d0b8a21", "comment": "Malware payload (Mirai)", "value": "8ae12abce00465657583fba3f60eee3c5d4eafee25d5c2865549d3ec21f72783", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862339, "uuid": "f2e69531-5db3-4c49-b57a-e76e08e30c28", "comment": "Malware payload (Mirai)", "value": "ee40a6382860c74d1e7e5e726a6d031139a26ffa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862339, "uuid": "c3870154-ef3f-458c-b8de-1246e616d58c", "comment": "Malware payload (Mirai)", "value": "feb9b5e6006e45664982cb707b55607616914b65d96dc0a373bda3ef5b611396f21e11affaa22a3c24bf19e3446c467b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862339, "uuid": "364b31dc-96cb-4951-bd86-a87ae8f1fa92", "value": "T133042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862339, "uuid": "cf20abca-f426-4de3-9c8c-3c96ebdcd6b0", "value": "3072:HK/lcFNbBLbcBCkoajwdyqkk4/T/6EBpdu/hJjogM/RHWT+M:HK/aBLbEloajwdybkwRBfu/XMgM/RHWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697862339, "uuid": "c5504bf2-9074-4306-a561-45b93d05650b", "value": 179805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697862339, "uuid": "e4723bc6-ed99-4bbc-903c-c30304098a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862339, "uuid": "dfb46e53-0b31-4891-9894-14f66270f453", "value": "bot.arm7-20231021-0424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec76fb2-6ff3-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697880101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697880101, "uuid": "bb386d8a-47c6-4216-b848-1a3385ad0c4e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6431a57b920c12657a5e769be9d41db8", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697880101, "uuid": "1dd9e195-f4a2-41ae-8fb0-2ad1b57e5e74", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "90fcf12de33c6bd7e478172cc49da62fc8eb70332bcae5fbba47e2a7c0e5d87c", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697880101, "uuid": "a4927d0f-401e-45ac-92b5-7c0df857fd8a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "17c948f83f3690e8702c2885b417821effe488a9", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697880101, "uuid": "94848bd0-bdde-4cb9-ac55-cf207be435e0", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "898dece4982a6728a474dbab1874e24a8b3a9a9c8081e34c5cb21578ec8ad13ab0b96b12cd1919096b591e249d0e5c77", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697880101, "uuid": "c9c39220-ca73-4561-b162-77490c4212ea", "value": "T18944CF127691D876E55329351930C6962A3BFCA2AA7541CB37A83F3EED303D09B61F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697880101, "uuid": "e0c72781-0aa6-4e09-88f6-a97e2c629e99", "value": "0ce12663226524285e6f6ad95f88d0da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697880101, "uuid": "dd392639-42e9-41f5-aeb2-fbcb48c2977f", "value": "3072:HZ1BNLUxA5XIgA0/BwzrP56JRrJg+nfseW9Gnj/6LK2R:tVCA54gAkuzrP56J1JHfY0nm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697880101, "uuid": "7855ad40-9526-47a8-b817-fa511e98b6d2", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697880101, "uuid": "d1433733-20d0-4953-8f73-71bcb1690b9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697880101, "uuid": "fa9b6f56-1a00-41a9-bd8b-b2b8c72d009f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1aaea1-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697884526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884526, "uuid": "606284a2-a1e6-45df-955c-95306a1ba9fa", "comment": "Malware payload (LummaStealer)", "value": "bea2b60e149b4fb3dc838af21245e703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884526, "uuid": "2aec7605-be0f-4b1e-aafc-51fa9fb58de9", "comment": "Malware payload (LummaStealer)", "value": "936585d565116a8520c0bce7813cd99571f49ce0e5af8f88d554f46906deafec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884526, "uuid": "b0537930-ede4-4019-9d2d-56d86ed5ab4a", "comment": "Malware payload (LummaStealer)", "value": "44cabfd8c74d4cd3a645e7d1da9d0791fa649ca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884526, "uuid": "3a56e640-1d74-46a4-8aac-3b55facb0d73", "comment": "Malware payload (LummaStealer)", "value": "49fd48f042c325749db95695c2b9f1eebfb5a3062cdbf29d58e93fb912156c597318e3c4a4927d7d84c75e3ee3a9aed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884526, "uuid": "a6cc6a3e-6032-4e46-ba05-905db3d01152", "value": "T1816523537AD49072C9706374D9EB13834E38BC90CC75962A2781AC5E5DB3161EB32BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884526, "uuid": "1730ab07-1b20-4014-868c-a4d93cbf4bc3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884526, "uuid": "f54836c9-2444-411c-9f99-7a6069cab543", "value": "24576:1ydonG54NA9I1nePPhzrWi1frA65+1LIJGWEMySZCU8EUFw65BEgRwhwFI4tF9Q:QbQ1nI5zrWiZrP+FIJGE0PNogRwyG8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884526, "uuid": "92f0db38-c598-4729-ae12-5d66bb169d81", "value": 1513984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884526, "uuid": "6d2a2fcb-02dc-4bc7-a9f3-9d183573b163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884526, "uuid": "ded48bd4-1d21-43d4-aa14-6a2b6e271360", "value": "bea2b60e149b4fb3dc838af21245e703.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd0082f-6fc7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697861443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697861443, "uuid": "c54db5f6-6a5b-490e-8b84-3c1ae495f415", "comment": "Malware payload (RedLineStealer)", "value": "ef2c58fa13d0bc5d7c322a51eec952ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697861443, "uuid": "40fa7e8c-2336-4fa8-8545-aa7945fadf47", "comment": "Malware payload (RedLineStealer)", "value": "93a5e769b10b1c80fec8042956d84562012e8d3c0d1a3e2970dd7361f79d33df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697861443, "uuid": "f72ef040-d40b-4114-aacb-ae0ebe9b7048", "comment": "Malware payload (RedLineStealer)", "value": "5063a62cb171112c70a01fd1f04b98e3e96ef32e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697861443, "uuid": "ef8c5568-156e-44d9-876a-8a5c6e69034e", "comment": "Malware payload (RedLineStealer)", "value": "23b1be68118d47ab8436a1905b9dc8d0b1f721fca320313aaaf4b4eff1d7d6c5d267b41003f5ba3f704ef812ff446cc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697861443, "uuid": "2212e3c5-ec87-46ea-8e54-ee57d0070aaa", "value": "T1006523E366E80836EAB0273494B313930B31F8A5E5786B573751E5A50CB3E60F573B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697861443, "uuid": "91df1380-566f-4350-92fd-637be300db4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697861443, "uuid": "392aa95b-39f6-44f7-8f87-e3c03aeefe5d", "value": "24576:xyJiDdar7Syed4Z4fRceEMOjd7+pDAeqNp7BQ5VhQ/kszc6VRTmw3Zz7:ksdcZZ4u9MGdYDAeqP+Q/54+RSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697861443, "uuid": "09c67a85-97ca-4455-a78f-a811d3031ed0", "value": 1516544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697861443, "uuid": "af779c70-ed12-4c7f-9168-01292641d9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697861443, "uuid": "723a1f48-02b4-46b8-aa60-92287cc09bcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b887ab2-6fa9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697848420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697848420, "uuid": "7d9d1d67-dd39-4b10-8772-d3175b4b7a1f", "comment": "Malware payload (RedLineStealer)", "value": "09f00de26d78f36432ec4c736776d03c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697848420, "uuid": "e1c00cea-5fcc-4969-813a-67254f8cf2fc", "comment": "Malware payload (RedLineStealer)", "value": "9481382a3f7b57e43068571a3fbd242e48321f802b219fc09d32f76f30272ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697848420, "uuid": "4f18f229-a25a-49fe-93cc-5da3f3e90983", "comment": "Malware payload (RedLineStealer)", "value": "e8b13aacdca1fd6a71735dc0a406b7e22a552251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697848420, "uuid": "40e897c2-2017-4342-a5c7-31e01e3ed171", "comment": "Malware payload (RedLineStealer)", "value": "0744cfe00031cf4bd63fbebd69b8d706cd1e8da88b6ef5ef9b6345df178fe2d4ed3a038971c60ef8061d249681044f57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697848420, "uuid": "d7299aa9-a610-47cc-b6b5-73b9d9973249", "value": "T1CEB46D33DC4861E1D2D71C7994998D6558F9BA6123F16CE31E6C0B4FCA363D3EE2A224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697848420, "uuid": "ef2f2661-0437-4caf-9fb8-66efd30bcaea", "value": "bb8b51bfd9f71c7452726205f579a090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697848420, "uuid": "6d427379-b6ae-43fc-affa-2855eabd3852", "value": "12288:GfdZZraP3Tphc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRRL:q7rsE5rdV1sjAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697848420, "uuid": "3c9fda4d-066a-445a-aec8-41f1dd2a0eca", "value": 516680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697848420, "uuid": "08c56988-1585-49e5-8456-8676261793ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697848420, "uuid": "ca2644c6-aab7-4833-81ef-e1849c656352", "value": "SecuriteInfo.com.Win32.PWSX-gen.19366.25140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e34744d-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697884529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884529, "uuid": "d74d6bc7-9db0-4766-9f80-95bc80366456", "comment": "Malware payload (Amadey)", "value": "473bd09029b825ba5395ddecf5117fab", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884529, "uuid": "cf84b4a8-c8ea-46ee-b1c1-07705871b419", "comment": "Malware payload (Amadey)", "value": "95c7efe4302f3ef6759cc6af567e196ef27eb66af28f8ac4178b53a6a1fe7e00", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884529, "uuid": "44c7d8e9-3459-43e6-b525-9c2431174f9b", "comment": "Malware payload (Amadey)", "value": "872d6628f1b06f5a5941b1eae29547d8e2831c44", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884529, "uuid": "3b898f99-17e0-4dfb-ab0a-04505bbddffc", "comment": "Malware payload (Amadey)", "value": "4208c9b53c0f00042d624380762bd59d546bdb9f7fb580f29d06984166d65683b6833ddbaaeb0b7a223de60d501e29c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884529, "uuid": "48b2cd8c-3743-4282-9128-e26de0b4b983", "value": "T130157C2139C18136EDF310FB87ECBA3986ADE4B0075912DB16D856EED7606D23F32592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884529, "uuid": "46c3788e-af25-4776-890e-a7366d435cff", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884529, "uuid": "6a9ce55d-b324-4776-92ba-bffefe455945", "value": "12288:ZdxSVoPOHiJMRxxcZ541BYlLckufEjWky8ot1QyuG/yuD3rCJQewJ:hPOHiJMRxxcZ54bGcNfEjXU1GQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884529, "uuid": "28047308-e67b-4023-b27e-14b403dbfdd5", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884529, "uuid": "a980080a-a984-4588-81e0-044aef1ba882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884529, "uuid": "ab333a55-bca1-48c1-ab44-ae7a79af1e46", "value": "473bd09029b825ba5395ddecf5117fab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb10f5ff-7003-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697887208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697887208, "uuid": "cb23d367-d2b8-4e3b-883e-5731e10e4efd", "comment": "Malware payload (Stealc)", "value": "eefd93029a9b77cbcf8ed68d0b34c92a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697887208, "uuid": "4307a33e-07a4-4759-86f8-b09e7c2e9ef7", "comment": "Malware payload (Stealc)", "value": "974a5eadf02f8ce0a968cb9c241e32d7a61f0ccb9da0b7ec27b40db87795817f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697887208, "uuid": "b9694da8-2299-480c-9e4c-0ad6889fb3cc", "comment": "Malware payload (Stealc)", "value": "fa16d6b5029a09b3c379ae4917f40a3086085cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697887208, "uuid": "9bc55cf8-14ea-40c1-92eb-cc58bcfd2a34", "comment": "Malware payload (Stealc)", "value": "354ad749a4922457e3b4bc1ed3e59e48612d51ccac574b482276c7e3074764f353858e049995845f1b2aa2f7a31c725b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697887208, "uuid": "64ecb297-ac31-4df2-b5b3-ba797c9fe178", "value": "T1884523876BE95476CEB41B3868E307933734FC829C3C83462391EC999DB26949171B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697887208, "uuid": "37226af8-64ff-46b7-bd93-94b17a654a33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697887208, "uuid": "6d914d61-0206-43f9-a957-8ab641428455", "value": "24576:FyHcDOnEK7OWPx+jnhqzJIyT+7iuZHsFz/w6IeMIL3:g6CbOWJ2nQ2yT+5heM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697887208, "uuid": "f4e250e7-cedb-4466-8afb-713154df803f", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697887208, "uuid": "156f52e3-5fe2-4947-b068-e964cef1aae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697887208, "uuid": "bc189dfe-06fe-4289-adb5-feb3bfe82a4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3a3ef5-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906323, "uuid": "e2cd5f9f-ee17-4709-b0ee-c48daa519939", "comment": "Malware payload", "value": "f56a87470a74339fe9e8d77f8e6ce8f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906323, "uuid": "3863b5f6-8cee-4b64-9ab7-97436f561ebd", "comment": "Malware payload", "value": "9794c936a0f58b8824df17fdd14be5c13f5d25f86d7a9d321e159874c269e21e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906323, "uuid": "161c2bda-c2b2-469c-aea1-2be1f783153b", "comment": "Malware payload", "value": "b73ffa9991e46a50236ab2949bbdb09abe7180df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906323, "uuid": "55509689-210a-4e10-bdc7-b1377bbff7f2", "comment": "Malware payload", "value": "5c5b40a2ee5aaf76dcdfe312a3fb9d5865342a07da5bc8c8f60e3527eb535abf8886c5636982742afbdd0f3b1de53a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906323, "uuid": "8bc57703-511a-4669-8e02-7db18956b9d2", "value": "T139D48E5DE2E0943EE2671B3C5C1F7E88982DBE5129A8B875EFE83D0C1F79240741D19A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906323, "uuid": "16cb2869-5777-4ac5-9558-8f2c29cc7628", "value": "6144:qUZD6jS6EbcD2Yzrg/i/b8XYvmo63eedaWaoKEeR4Jv/DtC/i26N4vLW0NaVzVUI:tD62NbC2agEW3KEXDgKPS/jLGeT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906323, "uuid": "b8388a24-cbc6-45fd-a21d-52af05f7065d", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906323, "uuid": "a21ff28c-614b-42a3-88eb-93fb0e9fdb09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906323, "uuid": "316c3d55-93c3-493c-9a2c-8ef6a7d40130", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.6593.7747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1db83e5-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697884562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884562, "uuid": "569fe5b6-769d-4da5-b188-a8cfe0422f4e", "comment": "Malware payload (Stealc)", "value": "224d3c7fa9f6be88e6ce37f1247a8867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884562, "uuid": "16aab744-fe84-40d2-b3a6-2907f686b7c5", "comment": "Malware payload (Stealc)", "value": "9860d84e1df290c2e382dfcbca989b855034a14f4973fc62454ba5901ca3a3a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884562, "uuid": "d77af6b7-6984-4af6-a2b8-7a9bb113d5b4", "comment": "Malware payload (Stealc)", "value": "71c386eb180a9705f61852b3801ceac22d683aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884562, "uuid": "4ea15e91-1564-4529-849f-2e5019fa38d8", "comment": "Malware payload (Stealc)", "value": "5a1317aaa7c2fa53ee9760e87a784ea9a5d022202f8e022d676d5e5b9a4507e710ff59fa64a0e17367068334d5776e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884562, "uuid": "d06f251d-3992-4b54-8d9f-906393e698bc", "value": "T1CAF32910D68055EDD0A906BFA69F07EB9C083D6D1342C2E3EB611F79A0E13F572758AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884562, "uuid": "8cafe992-234b-4dcb-a567-8da9f3a68b67", "value": "372dad7e771f409df9ab1b912548c291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884562, "uuid": "0a8355c5-51fd-48a6-a985-887b2780a673", "value": "3072:2K0ufpwQ5jXl9t6Swu6bCYf5z46CyOVfFfbtIBjtZuEZpxqB5n:N0uiQ9jtpf4DHO/pspMEZ3qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884562, "uuid": "04edc91a-a0c5-468a-b7eb-6b8f48493e5c", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884562, "uuid": "e1adf288-b12c-4a27-a084-9636ccde07ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884562, "uuid": "230b5d6e-583e-470a-8bd1-98819dcef212", "value": "224D3C7FA9F6BE88E6CE37F1247A8867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713aa35e-7033-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697907674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907674, "uuid": "eccf67ac-64bc-4fd3-8cc8-4a982347c7c4", "comment": "Malware payload (LummaStealer)", "value": "98c02979db19eb538ac83e8cd8e83cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907674, "uuid": "0a26ced5-8fb2-4765-95a3-487db6a11746", "comment": "Malware payload (LummaStealer)", "value": "9908463593e6a22247db288d2966051a140a36fc712d5b546a3112ebba6b0483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907674, "uuid": "29315b26-8247-41c6-a9c0-73735b259742", "comment": "Malware payload (LummaStealer)", "value": "aa9d6c94d548765ce8c64c0acd986ac119426b2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907674, "uuid": "8d1f3d2e-26b2-4d58-92e8-8b503cf62144", "comment": "Malware payload (LummaStealer)", "value": "280278857e4dc4c1449356e168d9c301904b55d89affb01f09af2ba47154fb1f3ed4e7edeb91a2301bcad4ea45e23b14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907674, "uuid": "1eb81596-6cf9-43d4-ba08-552a3049f51a", "value": "T18D75AE4AA1677D73C4E68EF004598209BCEBF41063089F03BDCC995C769E9DE9C6B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907674, "uuid": "18340786-11fa-4a7b-b239-248e90ac7e9c", "value": "e24778f24214c85de8cd98738af1bd0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907674, "uuid": "30027664-fa85-4223-9a0e-a53b1773a9a5", "value": "49152:2n1EAyUj/jJU+xYMGmLwpflalwYqZwj/:2Hj/dwFdai1Zwj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697907674, "uuid": "ec5720db-2b96-46b3-8ae5-318d654bb6ab", "value": 1598976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697907674, "uuid": "f65e96e4-db0d-46d6-bc51-e30bbc84be74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907674, "uuid": "452fd1c8-86fc-4e23-9034-c2fa3096a16b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db19acb8-705f-11ee-8907-42010a9c0042", "comment": "Malware payload (TeamBot)", "timestamp": 1697926749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926749, "uuid": "1bedb39e-40da-42db-9f12-f26ff20a2423", "comment": "Malware payload (TeamBot)", "value": "f141e1ebab8898741ec9c2b2ce703534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926749, "uuid": "44eaba0d-a324-459b-a950-9eb96cf32438", "comment": "Malware payload (TeamBot)", "value": "9f63a88e8ed926a18f4bb89dfcb59fdfc7b57d887b1e2099113948a9bb90795f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926749, "uuid": "b8786c16-a365-4ae5-ae69-1a63966e469a", "comment": "Malware payload (TeamBot)", "value": "21acbdbf76f330f2445fcd4f6ac37aaf85220f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926749, "uuid": "30b84992-cd48-4e1a-8fb5-6886393e421d", "comment": "Malware payload (TeamBot)", "value": "5289f3a2ff97a3e666ff6df7984dbba3d531f4cda96775b33577c214038e80cce532f0ba3d4dc619495b3ada0a6e9085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926749, "uuid": "e14ee9ae-27f4-47f7-a843-702df7a1041e", "value": "T1BB44CF2176A0D875E4632A354830CA952E3BBCB2AA3541CB37983E7E9D706D19B75F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926749, "uuid": "46b09c75-2e29-4689-96d5-d4d20c87a1cd", "value": "1a993c5a381c8e12968253c74a42dfae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926749, "uuid": "f1068b42-56fe-42bf-b223-39473ab36e2e", "value": "3072:Hl1BNIcJAtmw9RPaUnWKDnjlb7c6d4a+hbKDDZK0I2J:RKCAtL9Ryale6d4XbK4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697926749, "uuid": "fdca59f4-4399-4779-bac6-9d717c85d5ab", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697926749, "uuid": "87ad034e-7b20-491d-b2a8-1a52e89b3d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926749, "uuid": "6ed0c735-2a8c-400d-ab1d-611f9e128840", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff4c4d6-6fae-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1697850441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697850441, "uuid": "0a9c0697-074b-4090-9e6c-dc08d58ede83", "comment": "Malware payload (njrat)", "value": "d8fd3af79b378a4c5f91faea903fd69d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697850441, "uuid": "69255251-d0b9-4b0f-aa0c-f93edc3c4715", "comment": "Malware payload (njrat)", "value": "9f9b759776ec7c67a1596eeea75052ffee443e984bba8a9697fc1b511b5ac738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697850441, "uuid": "ffe4307d-6423-4895-adea-cdfd3ec8a5b9", "comment": "Malware payload (njrat)", "value": "dcadfae57335514384ae738faa210fe486e69d89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697850441, "uuid": "0a897fee-1fc6-4f5c-bfa0-4ab01bd93089", "comment": "Malware payload (njrat)", "value": "e1ca94143bbb79d21c840326ece83a96b6ae16e11f16553a5922892fa3dfe556db22469e239766fd84ad2d987d5e1863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697850441, "uuid": "6672669e-db1c-48b8-997a-4bc958086995", "value": "T1F1C2195D3B908166C2EF2BB006B2DB2502F2E10B5A27EB5F4CD844FA6B773C14D819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697850441, "uuid": "4666848c-edd4-491a-94a5-b4c22e24bb57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697850441, "uuid": "67e36b07-a199-4197-9e6d-3e183c22d90e", "value": "384:oLd6cufEYAA/XgWeyoHzCYe/iBY2OzRLTm3yilqr63+bntVvGD:Wl8AA/6T5e/gsEWVvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697850441, "uuid": "ebeadb86-203b-4782-bf77-01dcb5d7b754", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697850441, "uuid": "9be41d8e-9dfa-466e-9264-818bb2d916e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697850441, "uuid": "de924e61-2b29-420b-bedf-6fab12cfa05a", "value": "bQNp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9194bd64-7058-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697923619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697923619, "uuid": "277a9c8a-6308-436b-84b4-ef41ef6511c6", "comment": "Malware payload", "value": "6ec37109b5123d1701eb52aa5506afd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697923619, "uuid": "a7b2f8b8-207b-43d7-a5bc-06fa4625728b", "comment": "Malware payload", "value": "9fcc8d9212ee92c395f48f4fc5e587431485426f1bfcf8f4640db7270ebcf18d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697923619, "uuid": "93c29b8c-785b-40fc-87b3-0d193b981366", "comment": "Malware payload", "value": "89555bfa07c2168855dd438067a138e4b7d43347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697923619, "uuid": "80604e5f-7ea4-428a-96e5-736e7e117b5c", "comment": "Malware payload", "value": "30f736703ffd86159bc5799fc8338c0c1478e856c63a32303d5a6098c7825a2b09ca4c6b761af1cf01406718b93d4888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697923619, "uuid": "1133475d-a05c-40a1-855a-547716cba9ec", "value": "T148F58D217DE28537D72313328D1DF13972EDA6A01B3982C7539C1F2D2E742A26B15A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697923619, "uuid": "6845e63d-f946-4a2c-aff9-46a81c0dcfd5", "value": "e15db6cad1550c3209bf2d0020279b5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697923619, "uuid": "e86c79ef-7ce7-4ae9-baf1-5db255206f4d", "value": "98304:MqNAQ6FGtvX6KN5hBAud6kDjGpUeTle0GzDxKD:MqN5u06KN5hZnUe0GzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697923619, "uuid": "4476624f-18f9-4f7b-8504-3f8504a63ad7", "value": 3482544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697923619, "uuid": "a530cedc-6a9b-4f7c-8f9b-9ca18d72cb99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697923619, "uuid": "94049aa0-6ae0-4392-bebd-34b38ee03081", "value": "1f2e6cb1c536ce906263f7f7e15961d0124629e703bea1719c5bad2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4497f6bf-7041-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1697913612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913612, "uuid": "821bd6e7-262b-4de4-96a3-d18b33397edb", "comment": "Malware payload (DCRat)", "value": "a69ae8e293e69e608cca3de5be7649c5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913612, "uuid": "c434ea5d-59ca-4b6b-8610-d69cca744035", "comment": "Malware payload (DCRat)", "value": "a0ae3b36042c70468740ed065997b88c03a521919bdc1e486322402675c01ddb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913612, "uuid": "c528ef09-353e-401d-856e-b96a7e2f498d", "comment": "Malware payload (DCRat)", "value": "67cf60dc0fae08149881aaed7fa32e7d54b63291", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913612, "uuid": "b5467da1-7634-4e57-9d0c-11c979220189", "comment": "Malware payload (DCRat)", "value": "24f7e12f268114fefcb7f5a3a3d0fda9c92100df0d935aeca97501b950be5be1f475dfd6335c510d896244749812ab80", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913612, "uuid": "ad1da01b-0128-4c5e-a0bf-03a9f03358cf", "value": "T1F216F1027E85CA52F0191633C2FF850447F4AC91A6A6E72B7DB9336D55163A33D2CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913612, "uuid": "3df750a5-ac8b-4d15-8ea4-98cff203ba88", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913612, "uuid": "55db8dbd-4e82-4a93-af69-853df061bbdd", "value": "98304:UbMqfrPDgC+3dOf83rECUVoVzJ6JT3U8Av9hEl:UgYP83dOf2Y9VoVN6VE/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697913612, "uuid": "e1212b7c-aaad-497d-84cb-8b695f74f4dc", "value": 4159572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697913612, "uuid": "65460688-aca2-452b-93ef-eae88b21221a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913612, "uuid": "1bc1ee81-4405-43ac-9f08-aca380168c2f", "value": "A0AE3B36042C70468740ED065997B88C03A521919BDC1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4449265-701e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697898820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898820, "uuid": "c1793f7b-8af4-4eeb-8591-fb87b11f084b", "comment": "Malware payload", "value": "cf6afe0432fcb31e974520abe3dd67cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898820, "uuid": "e52825b5-2205-45aa-9c74-b21dd3773c79", "comment": "Malware payload", "value": "a2576b755e75e6397ddbeaf6987d81c511968a65fa1f11507fa926946b258f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898820, "uuid": "f0d47260-b212-47d0-b61d-df3cac88e827", "comment": "Malware payload", "value": "1516df1f6d2008ba075cffee9015de10d2793bdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898820, "uuid": "61b6ba7a-db9a-4576-86ae-546627d46aa8", "comment": "Malware payload", "value": "d121a14c70d257bde33fe11db08ebcfd42ed077e96a0723327197a963b74b6cb836a8526291dca87c96ff9a3a960276f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898820, "uuid": "16ba8295-785e-40df-a949-ad5201d73134", "value": "T16445E041B1A1E84DD4C759F6CD9ED3E01271699F8212CB0DAE41FB2578AE3C329C768E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898820, "uuid": "9a51092b-92e0-455d-a509-df15c0d454ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898820, "uuid": "c18ed9d3-ca2f-46a6-ac64-3b557f4d633d", "value": "24576:7IPnEmNyE2k93v6GllRQG1XdZBtmhn39YUv5Cf+Jd8:U/xNJVv6Gpv9dZBtSn3ZK+JK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697898820, "uuid": "b6d076bd-b3e0-4d4a-8b20-8a0fe47e2dc5", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697898820, "uuid": "2e707950-c84a-4130-b229-112bd4111251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898820, "uuid": "308b0d76-957b-4d0a-b629-aaf7d30441a7", "value": "SecuriteInfo.com.Win32.PWSX-gen.5843.19325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240df553-702b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697904108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697904108, "uuid": "a019b466-9332-448b-b1de-6935c60797b6", "comment": "Malware payload (RedLineStealer)", "value": "9851e19a47a8bd69d6d57710f0865a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697904108, "uuid": "a76b1179-11cf-4fcf-9a43-288d10d516a5", "comment": "Malware payload (RedLineStealer)", "value": "a29f46f38fa95cc6eea4a744bd3d05ba1d87d015c81db4c87f8c91cc536eab30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697904108, "uuid": "599df238-1c35-4a8f-b874-bddbe0911bc4", "comment": "Malware payload (RedLineStealer)", "value": "afcc590d0ee1bc4beb54ca31725840950d60a427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697904108, "uuid": "5e45ade5-5fdd-411b-b1e5-870b786b78c1", "comment": "Malware payload (RedLineStealer)", "value": "cd0a956d34eccda5419d22c8a327b94231c12ef5907bd4fa1df4aff9c94ee0e412c560ba63004c09d2e18c6d750a756f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697904108, "uuid": "c42916ef-cc26-4aa7-806d-70a43e351e1b", "value": "T16D4523176BE88226FCE907B469F603A31B39BCE12878935B77C385181D779806B34776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697904108, "uuid": "92436e7e-dce6-43b0-808c-092b501dd132", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697904108, "uuid": "0e49fd5c-3049-4b31-911c-6e78e21b0fef", "value": "24576:QyZs004Qs4NmOlp/1bGQWyNtVsCFvh6Rtt9vgxOzMwKZUvFm:X/QlsOllkWtqqh6d9vrzMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697904108, "uuid": "b1dac8ad-2887-4d60-92ea-4035f318b62d", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697904108, "uuid": "f9901dcb-b056-4fc9-81cd-260bb02f514a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697904108, "uuid": "584a01d0-8eb6-4d3a-b144-593a1a2bdd23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328ee6a7-6fca-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697862471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862471, "uuid": "5f6c7a9e-6b9a-4242-a9a6-48360602f607", "comment": "Malware payload (Mirai)", "value": "bbcfcee2d18b1a7a9ad3121eef367390", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862471, "uuid": "78908690-b417-4847-94f9-be7d4594e4a3", "comment": "Malware payload (Mirai)", "value": "a387f884c06fe3e2d24a4eeab1694edd0d753d6ba5f0c235597f0db5417157ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862471, "uuid": "271c9cc8-f673-48bc-9127-d413f7f4d1e3", "comment": "Malware payload (Mirai)", "value": "a855799096eaa7c11b0ce39c6bdd34924f18c4e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862471, "uuid": "434973df-2848-472e-8381-568319248aaf", "comment": "Malware payload (Mirai)", "value": "952ca2c282220fb34302461e093ab976b2bb6446573a3f294f66c85a287adfab603743b05506c406d961981e2f481934", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862471, "uuid": "189c4471-7a59-4eeb-a045-ef32d9e9bebc", "value": "T1A9D33A17B5C180FDC4DAC1B44F9EF536DD32B1AC1238B16B2BD4AA222E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862471, "uuid": "20527679-902c-470c-9662-a0fc4d85f647", "value": "3072:tGtwnNiaOnUTbFiPT9OSQ7AOaogjV2iZlBWCgxiAeQPdL:tGtwnNiaOnUTduLy7eQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697862471, "uuid": "da95ea8d-3be6-41a7-afa9-3dad3bae1eba", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697862471, "uuid": "d042f8c6-a4a7-4601-9eda-23d5e01d3356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862471, "uuid": "d200ed17-2ec6-4fec-a5d9-e250cd935c6a", "value": "bot.x86_64-20231021-0427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56d2b52-6fbe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697857510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697857510, "uuid": "58762c1f-1a60-4117-b8fa-8146efa1554d", "comment": "Malware payload", "value": "4850657b6766c8e4aa77e743b6afe1cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697857510, "uuid": "18c89b57-fa35-436c-a880-8bed0443a474", "comment": "Malware payload", "value": "a38da72082fc2dc1f60b3b245e1f2382d5f8c1d08ebc397dd0d81cc9f74ebbe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697857510, "uuid": "dac696b1-3668-4e90-975a-2442b98d721c", "comment": "Malware payload", "value": "febb07971574d23034fdc3b82f03642599c19376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697857510, "uuid": "9106d513-2ad3-4b5e-86e5-d6d4ab9fcfa2", "comment": "Malware payload", "value": "e9bc34f94dec634a8bb254a2e183032edd941b7e4f583884190258388de7c82fea33af6420357d8a48b13c8a5594bce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697857510, "uuid": "f56362c2-91e9-4da1-b45e-fbb6f0e4d843", "value": "T191F4C912A7E0D00DF1B38A70BDF181656D3ABD3A45A8E91F76805F0E1572A939DB073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697857510, "uuid": "77186eb2-f134-4b0f-99cd-12a4a84dff45", "value": "7c592c9d5874a181ca049e5f5de936a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697857510, "uuid": "ee0dfa63-17e2-4347-ac1e-4f4bd20cf06d", "value": "6144:0WtCoa0GOr9TbuEQCjLKonFWIUsX8bRrmLtwABHNwsT4L:0M7pn931jLKonubwLPBHmMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697857510, "uuid": "05c02d16-2ee0-48c9-a3af-0f120cb557e4", "value": 794544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697857510, "uuid": "fb66b661-968a-4287-9d41-3300e6526b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697857510, "uuid": "903b160d-e2f8-4b9a-98e5-ab94367de49d", "value": "c97231396401b664fb865042a75fb600f6a752b2667bb8ef2d662fb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2db3bfc-7016-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697895301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895301, "uuid": "f22a069f-53d2-469b-89b5-bc230374a850", "comment": "Malware payload (RedLineStealer)", "value": "b71c28ff7303897ab8150b47d964a383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895301, "uuid": "b676e846-4a95-470f-82c9-c0ff91b60ade", "comment": "Malware payload (RedLineStealer)", "value": "a3ec0982ce08855c2c47a8246d2cd18bba731c3318dde3557c48677487735125", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895301, "uuid": "6586d929-0ebe-468a-91e8-728facc7e0b1", "comment": "Malware payload (RedLineStealer)", "value": "f17522b796cd03a5cdda44f11a04d2b94660a29e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895301, "uuid": "6afba464-a453-424e-b71a-524de6c5a384", "comment": "Malware payload (RedLineStealer)", "value": "f87315bb884077b11e279a3c6637b83a1d073bcf2f1908ae81240e27ebea3465436dd9506fdf7b21ec669df5435ca4f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895301, "uuid": "c83ecdaf-fc37-4724-b2d8-f8c3b856ac76", "value": "T111B46A51B0094F2AE3F2087CE6CA5DAE4D507EED6F530B8F36C14B8267967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895301, "uuid": "1e66035f-9fe7-454b-a6bf-7bebae6b2867", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895301, "uuid": "0bd51222-56bf-47e6-b9ce-48ac10d91f24", "value": "12288:d8W2lw0QB2o97Hr62k3n/+pLsv9+eXUeF6+1L:ulw0QkAr62k3n/+pAv+eHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697895301, "uuid": "bf7ec1a3-76e9-4e6c-980f-c2123bce8037", "value": 507976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697895301, "uuid": "dde7c299-e52a-4847-95b0-986e51a32ec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895301, "uuid": "ec5bcd16-3dd0-45c3-bb96-7aac8275acad", "value": "SecuriteInfo.com.Win32.Trojan.PSE.11AU12L.5706.28036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f644ed4-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697884424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884424, "uuid": "7544f00f-3ddc-4bc1-90c5-b8a2bc1df000", "comment": "Malware payload", "value": "330195dd953b07f83150f861923bd1f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884424, "uuid": "097f5676-eae4-4a57-b322-4925b7a655b4", "comment": "Malware payload", "value": "a5020ee9cc9b01306cd5eb5e7db2a6347809cc33477836760b36fe6b529df3af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884424, "uuid": "e7be83c2-4964-4803-b9bf-b1cb8f32b20a", "comment": "Malware payload", "value": "a1eac0cb2e78ab3aa5fb3cc18aa6b7786064ed48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884424, "uuid": "f18b3110-9937-4d1a-be42-b9dacb1d898a", "comment": "Malware payload", "value": "d714681ff44d9a80c52fbb4787c7cb71cc255b1d8df33eea42794824cf7197c7bb3e71502f2ae434f11a72ea0edca7e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884424, "uuid": "58322621-20be-40d3-94c2-b319cc2bbe4f", "value": "T1D845234673E84037CDE127B04CE706830A75FC71AE7891273B92A5AB4E7296450BB7B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884424, "uuid": "102715ea-2bfe-4095-b964-050736c03798", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884424, "uuid": "2f8b92b0-47a6-41cc-b6c1-a8c141ea8308", "value": "24576:Ry5t7E4IV0hqHcirlTAUVSHLaBqoy9qFG4mqPWyNe:EALGwHcSl0UVSHGBWt4XW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884424, "uuid": "bbadc1ef-4843-4492-a789-711460545aa4", "value": 1235968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884424, "uuid": "59145085-4d2e-486c-8f56-e7d53bcb6345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884424, "uuid": "66a56cf5-8423-4bc3-8044-1a1baa00ac44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d2bd62-6fca-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697862441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862441, "uuid": "9313a0f2-712d-4c32-a9ff-59c30a01ab4b", "comment": "Malware payload (Mirai)", "value": "7eae39ea118b322d9c99047e53492ba4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862441, "uuid": "66859ef6-6bc5-4b25-843d-87b14c5d830b", "comment": "Malware payload (Mirai)", "value": "a67a342f31da4fcad0b866e9a73b535aa3d7c88cd58e457adf99e2a931b27282", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862441, "uuid": "ff6bfc03-2097-4787-881d-f09d29e83589", "comment": "Malware payload (Mirai)", "value": "68c82ada8e2e09b7b51cbba2837c8a59dfe6d908", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862441, "uuid": "5beb3797-3604-49a9-8158-962caa6ccdf0", "comment": "Malware payload (Mirai)", "value": "03fce874a5f65a986f68e30679351a5c34e8d0d6adae25014448d1e3559715a7ca93f90fb00dac5910d360e45233d546", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862441, "uuid": "0466a8b2-9426-4522-a403-0d798d0ba6d5", "value": "T159D3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862441, "uuid": "1c72b806-fe2a-4a25-bfae-e196dc92e579", "value": "3072:gHZ+t7Ao5xFOV48wlP1z0RraPuk8d+Ow9L3sibP:gHZuAmAV48MP1zuQ9LsiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697862441, "uuid": "0cf58b60-4a45-441f-9101-dba88b5285ee", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697862441, "uuid": "7e031b74-4c6b-4fc2-a93f-913b54ab70f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862441, "uuid": "00a89a59-f6d1-4cea-b619-6662fc7e1a69", "value": "bot.arm-20231021-0426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3466a6-6fb0-11ee-8907-42010a9c0042", "comment": "Malware payload (TeamBot)", "timestamp": 1697851294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851294, "uuid": "813fae6f-31f7-42ff-bada-86db0b2b1799", "comment": "Malware payload (TeamBot)", "value": "6f2f142da39b8b2aadb0a9e07b57ec4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851294, "uuid": "08dccceb-5903-45a4-bdeb-1e737269dd98", "comment": "Malware payload (TeamBot)", "value": "a87ecbfbfb57f554a3dbd8f62b38ceb258205aebc32f3a97aef2fc2520393c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851294, "uuid": "cc3d5beb-d7ef-49b7-bab6-1db2683501c1", "comment": "Malware payload (TeamBot)", "value": "801152be186fcb8a90f1859857111d5f1f1f0463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851294, "uuid": "797d15bb-dae8-42e3-97fb-77e736579e1a", "comment": "Malware payload (TeamBot)", "value": "7d648aff65cf39529d4473126737de7268a093867dcab03bb58b7b01c4283914c1edc81271576aa2f21a30dd367416be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851294, "uuid": "da2d59a9-0cc0-499b-aa80-43e3aa9d9e2a", "value": "T11C44CF1176A0C836D46229321931C2A51A37FCF2AA7985CF77D83F6E9E713D09A25F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851294, "uuid": "d102d253-dfac-443a-b794-080ade826b3d", "value": "0cce327fa0253e8d26487249a6cbdfb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851294, "uuid": "40b382c1-59e5-43c4-8877-b4ac0c822490", "value": "3072:08BNu7EUru1U7vsZxUYBUNfi91ufwh0EQhMyg+OHKYcKat8:BQXrWU7vsDURNf81uBEQhhg/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697851294, "uuid": "8ee5ef53-a70f-4f13-bfb6-34ccad9185aa", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697851294, "uuid": "a4c59877-5746-44a8-9964-f1bf39c34f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851294, "uuid": "31e2c0de-5c69-418d-a40d-d6c5a712843b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e3e701-7047-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1697916243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916243, "uuid": "adc9b5f3-8d1c-42d9-a99e-14e62c97537c", "comment": "Malware payload (Healer)", "value": "36417626969d5c95bc9bed46e3164704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916243, "uuid": "7cdcfb26-d763-4d45-b2dd-646508b76c3e", "comment": "Malware payload (Healer)", "value": "ac83f97e0feaa00009066010fbc425e869f7f16d7a35d5d58bec33e430700ca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916243, "uuid": "c44a61b7-38d4-4153-b71c-e8881cc43e72", "comment": "Malware payload (Healer)", "value": "32a56595d5b4fa2a621b7bd61e48a757b1d77593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697916243, "uuid": "a0325864-6d9d-4b69-9d85-4b227eae9093", "comment": "Malware payload (Healer)", "value": "5a3f19a9451d8a1d1cfcbff8e56bf4aae5f42dfa4b6b113fc072ce3644fc085b4f37a621085976a259b4480aeb314b36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916243, "uuid": "87d1075d-bea7-478b-967f-c721e3225e16", "value": "T12D7523079AED6033DA7617B060FE238329367EE0ADB006B7259A4D559D73381E83572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916243, "uuid": "83ba8f92-2630-45a7-a7da-be787e2b43ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916243, "uuid": "28300c6e-de2b-417e-b758-406b6689f91f", "value": "24576:ryRTOb0DpYBPXQwT6X6hQLEeuBcymVEZO9MZVshNUNKmhpIaTYU2gS:eRlpYBP+X/LEDiym4XsQXhCRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697916243, "uuid": "bbb51c4c-5eb6-4281-8b2f-fc906d0d3611", "value": 1609216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697916243, "uuid": "8ba95b9d-e2d9-491b-8376-704d2805f7dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697916243, "uuid": "a6faf1a4-0d22-43e1-b3f9-c9472d70c88a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8313e00-6fdb-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697870104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870104, "uuid": "0f3613c5-d3be-417d-b48e-57b649dc2ecd", "comment": "Malware payload (Mirai)", "value": "1084e3e69ff99665828c1252f7164afe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870104, "uuid": "803f87da-0319-4f48-a1c7-25d371f20042", "comment": "Malware payload (Mirai)", "value": "adf75f99537c3667becfae9b1dd508da9865a29ce590d914d3da500831c5c9f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870104, "uuid": "4106c2ad-66dd-41a2-90f1-deff5aa21c98", "comment": "Malware payload (Mirai)", "value": "fe63db0e05c00bd4286efa864bd2d4b365a039fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870104, "uuid": "6d56048c-d253-4abd-8bac-ba5d2875b9c7", "comment": "Malware payload (Mirai)", "value": "d9ec626ecc7b93521c861e15158e842baf017f648c225d7a2ee8bca1c6a5aeb3154b90cefbc80700bb9b8993a4e7b113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870104, "uuid": "4f110c4c-cb42-44bc-8aeb-fb3319e55d95", "value": "T191430264A94AF24FED36C97908E9134239780F5BB1AF5F1914E1B7F29E180E4F490E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870104, "uuid": "f5bba0d2-84c9-4f3c-9d5e-ee771829d30c", "value": "1536:PxPi8RYJjynBKOKAhCfcxI7wKbhwkXlOY0KQkdVqY5:JYYn5hAcqPhwbkVqY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697870104, "uuid": "43a7d4ac-f928-4b9f-a1f2-b3fd36ac235f", "value": 57892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697870104, "uuid": "37f48f80-79ab-4cc4-83a4-06130bacf018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870104, "uuid": "9b9dab85-b5a6-4326-8a0a-0c6105c445bd", "value": "SecuriteInfo.com.Linux.Siggen.9999.6443.31086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1a812d-7040-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697913409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913409, "uuid": "79b4c6e6-ef52-4a7f-aba6-4a5535fc6896", "comment": "Malware payload", "value": "2efd05a33e44926b3c95798b882101d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913409, "uuid": "abd93805-b5a7-4dea-a67d-0642abb49011", "comment": "Malware payload", "value": "ae4c975bdaa91128595a0742e998703c0e9b270e8dfff42924c8479b1b8bdacc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913409, "uuid": "edc6595d-1992-492c-8db1-96b112300a81", "comment": "Malware payload", "value": "fa3b855f4a18360bf58d21ee05c99e05038cb306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913409, "uuid": "85e5c781-9b0f-4642-97b3-4c41e604b911", "comment": "Malware payload", "value": "a4f468024f57358026886c0ff6f70f21c2e598a3ca8f00f332a49af39e6640613d72efdb0526fce288b0ccd8f34dbe5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913409, "uuid": "100534b6-c231-444f-85f9-b03174c40003", "value": "T127841948FE9310FAFA471AB04497F27F6736DE099424CED9EBCC7909DC32922591A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913409, "uuid": "6b8c7beb-6ea6-41ac-b6c1-d215b0c1c7e4", "value": "07eb46c737220d993860bfd9ea99f600", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913409, "uuid": "df3be892-d3c3-45cd-9f2a-cefca66056ab", "value": "6144:yLTFBKdVbwDCt6kV3ejjqPaHuO/U/eLT0XjosaoD008kWLlQwBYeaRBYe6PkAbmc:oYjgCx3ejjqyJ/U/eLT0XjTaoD00cLl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697913409, "uuid": "4dd29bbd-f6c1-41fc-840a-7b15ad4e03c9", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697913409, "uuid": "682e14bc-7c13-41f1-9c8b-80bd11113db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913409, "uuid": "b3febdb3-c6e7-4265-ac0c-aafdf7c0ffbd", "value": "SecuriteInfo.com.Trojan.Win32.Agent.xbfpnx.8820.5970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99859eaa-7065-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697929216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929216, "uuid": "8dfcc791-6c55-4619-a8af-4eac22bd7346", "comment": "Malware payload (LummaStealer)", "value": "21c487ac2700dd689e4f666349aa91e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929216, "uuid": "c0900036-eb0d-4cb8-988c-a26d08f87179", "comment": "Malware payload (LummaStealer)", "value": "aec70d131f9941373ab58c5cd2105c3e0343a8c089d0660af872f16666a69281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929216, "uuid": "a8dfdbb0-0427-4ee7-8451-d6ff5714ee91", "comment": "Malware payload (LummaStealer)", "value": "051727a30780de58f861431ca18887bc348fc230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929216, "uuid": "79df3ac2-b55c-4091-bf38-86bdaf57debc", "comment": "Malware payload (LummaStealer)", "value": "bddba409ae9da4121ef65ca82bd63b310174751c05a5cab2fa4da53dea2f11eefd9f2c9ba7641514a1c0740c7fdda1d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929216, "uuid": "d1ce4f16-9ae0-4390-8119-4edef443d052", "value": "T11234BF01B6D1E473D572153609E0EBB55A3EB9700AA29EBF6FD40F7E0F302C1D621A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929216, "uuid": "5276ccb2-131c-4fa1-a949-4bed1cf8cfce", "value": "4f0cdfd3e1be2bc790b5aa9061b7d52c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929216, "uuid": "de517002-b0cf-4865-841a-c2846f3340bc", "value": "6144:dmfX4FIRd5DzznuBosiDKl51eAOIYyGOaTi:dMIKd5DPyedTzTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697929216, "uuid": "a49cbbe9-2e60-4b77-8663-0a58fe853a38", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697929216, "uuid": "f11c9fd4-3406-4af5-9c89-2badfa9d9a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929216, "uuid": "f3a66e91-712e-4366-b3a1-a0f8894b3c91", "value": "21C487AC2700DD689E4F666349AA91E6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92a78d4-6fc5-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697860657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697860657, "uuid": "659a59bb-f710-4cb5-b152-3fa77fbe5755", "comment": "Malware payload (Amadey)", "value": "5c4f03bc18579f1aa491bd8de9963790", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697860657, "uuid": "f604d4fc-7297-4b69-9196-bd4a565dcc51", "comment": "Malware payload (Amadey)", "value": "aee68b545de058e0eda0a0315ad21484b8b5c4544f58624387e50b9cadabb94c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697860657, "uuid": "5bac4ce9-5427-4df0-92f2-78d309fa7033", "comment": "Malware payload (Amadey)", "value": "af8ed5d8c4c5b69ff35ef9ddba34bdf58d5c4920", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697860657, "uuid": "ad1fa5a2-c655-404b-b324-11f040c9b2ee", "comment": "Malware payload (Amadey)", "value": "037c635fada1dcbe2b9b2eeb6acd95c839c05cfd636f1456993dc1f8922b57a9aa9cfc14303b91773d69479b0b50f561", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697860657, "uuid": "36ac94eb-712b-4053-bd9b-093029ea14e3", "value": "T1E2652343B7D45172C49627B0A9B316831E367CA18CB8675B26C1F88E0C736A8757A73F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697860657, "uuid": "793b8ef4-b667-4832-a005-304a509b670e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697860657, "uuid": "a393bc40-00d2-4d7d-a515-ae74c4c6dbf4", "value": "24576:py+LcUqeWMxpJxjEXWHIZh0IS48SXY8vsDfhcyc:cYqDMLJlEyIT3S48YY8yhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697860657, "uuid": "1292a8e1-81c8-409a-adbd-b1d5b1dcfc66", "value": 1515520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697860657, "uuid": "f09f5efc-13f1-4154-a0d3-c57026885990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697860657, "uuid": "ab253636-3685-450d-868b-aa0ccf0afc01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da50d082-6fb1-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697852015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852015, "uuid": "763ec085-9cd0-4115-8174-ed7e98ddc8dd", "comment": "Malware payload (RedLineStealer)", "value": "0aa2147468eb375c032f979f1fc2f959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852015, "uuid": "d7838b38-e306-40d4-8e37-06b417cdedb4", "comment": "Malware payload (RedLineStealer)", "value": "af54a35dd3ce3d2584bcc29d858664b3fc7304f0996d7bf07f6ae95e75c5e698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852015, "uuid": "b77e0ff5-7d22-42a9-8b03-20cbb5ab86a5", "comment": "Malware payload (RedLineStealer)", "value": "100f16fcd4cb7148fe7a1d3fbbc8e52a2d9b1c5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852015, "uuid": "c1fc1da0-28fc-4863-9595-642602c611eb", "comment": "Malware payload (RedLineStealer)", "value": "1a0b1ac945422839627ec58a50b794da6c6bb46ef7fbffa0d98ff1cb6e7dfb958fe2b7f619cfebb4f2976563ca76316f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852015, "uuid": "68e4167b-80bb-40b8-aac0-3bbabb7efd28", "value": "T1B0B46D33DC4861E1D2D71C7994998D6558F9BA6123F16CE31E6C0B4FCA363D3EE2A224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852015, "uuid": "24014d53-93dc-41d8-9e89-2d433c6e2dbd", "value": "bb8b51bfd9f71c7452726205f579a090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852015, "uuid": "90e27c10-b2e6-46ab-b095-be988c0af744", "value": "12288:B8dZPL+7gTzhc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRxL:qZLYN5rdV1sjgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697852015, "uuid": "92eb57a4-a911-40a2-9738-6c20f2f3c775", "value": 516680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697852015, "uuid": "b0967d39-9426-492b-bfde-e592c6b87095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852015, "uuid": "1cf40b0b-ec76-4458-97f7-f004ff1bd76f", "value": "SecuriteInfo.com.Win32.PWSX-gen.3990.15024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae88342-705e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697926051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926051, "uuid": "6f884ff4-e906-44ea-bae7-0f2adacab85d", "comment": "Malware payload (Mirai)", "value": "ebc4718c0655609c203d58bcb83f4025", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926051, "uuid": "a1c00050-cca6-425c-b8a6-cf77e2e7cf64", "comment": "Malware payload (Mirai)", "value": "afebbf38c3e17d80099ad814f4dcd5ba3c05194b3ed3bf3f7e34d821ec705d22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926051, "uuid": "078dd5cc-7049-4331-9385-1b6b94e19ee0", "comment": "Malware payload (Mirai)", "value": "0daaa6f4b40127f532829bff0fdc52489a5424cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926051, "uuid": "15f78ea2-b988-4a92-8df0-5153dff3727b", "comment": "Malware payload (Mirai)", "value": "9f7141869a1d544501641a38cac9761f65341303477f6aa35dcb94e746a1d2f7b1d63416147ce596ff9e8c414e83b999", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926051, "uuid": "53ea37b5-157f-4242-a656-07eb2d71693f", "value": "T1E0832895B8819613C6D052BBFB2E428C372653ACD2EF32039D25AF21378782F0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926051, "uuid": "e851eeb8-12ea-4319-a8bb-eccb74b99603", "value": "1536:YBQYPQq0whzS55IU9yzlTTcavt56Rt1JQmSfw0LlidvdSX:YBQYPXzzGyh8sb6Rt1DAk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697926051, "uuid": "70b0f4ee-4d61-4ec4-94ca-c74f7a520f6b", "value": 84824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697926051, "uuid": "4db14aa0-ab8c-4997-8fe4-7ac24a5cc5ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926051, "uuid": "6dc7a5d4-9e77-42f2-b0ff-70249daeea6b", "value": "ebc4718c0655609c203d58bcb83f4025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b917307-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906322, "uuid": "8e63ec05-253f-4a2c-9395-31bc763af09e", "comment": "Malware payload", "value": "a22b01850c1a7dd8000feea999d9c7c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906322, "uuid": "fb1626a6-b508-42b0-9170-9782f9a6d611", "comment": "Malware payload", "value": "b152fd85aa66038ebc17230039fa9425b82789cf5dc670516d2a32fb56f9b631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906322, "uuid": "f2eb3c24-d928-484c-839c-5182c2bfb841", "comment": "Malware payload", "value": "f3bad79f80d52c5482252075eead587ec0765948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906322, "uuid": "7b9d03e5-4d60-4d15-86d8-eddfd8a7ceba", "comment": "Malware payload", "value": "9d2a37ad79d860ce333d16806d2abdbf80ed2afc136ba03a462bc9c2b1e1ef3b9653939e9d5ffcbc6921dbf23f301170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906322, "uuid": "91ecc846-1df4-4bd2-87b4-37a12cfdd409", "value": "T13BF12B93EDA288B6C15DC9BD5D498934E5322A317AE2E2D36FAF580DCC251804BFC712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906322, "uuid": "97ee9805-4f4f-428f-aef4-da860afac00e", "value": "192:nyxfRq8HebguuREnZXbzNbotbFtZKN8lryIlY:+3HqsREnZX3Qt02g2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906322, "uuid": "cc8e6163-6874-4758-9fa4-e949377b32af", "value": 7788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906322, "uuid": "628241ff-fe6d-431f-8784-8c892622425c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906322, "uuid": "41dfa1da-1d5c-4ef4-bd56-0352d553f57f", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.18621.9423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22a68bb-6fef-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697878577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697878577, "uuid": "95c9040f-4eb2-4927-bd81-f1b050d421e9", "comment": "Malware payload (Amadey)", "value": "5b310c43bab37f07c488330693e1b26d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697878577, "uuid": "dbb7736e-b43c-42ab-95c4-98eaef1e67d8", "comment": "Malware payload (Amadey)", "value": "b1958598dd05520c142891ab553bddab2a138da120c6c7b05216aebbbc19036c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697878577, "uuid": "1cbbed1d-ed53-4f36-a206-3ade521aaa5a", "comment": "Malware payload (Amadey)", "value": "8c147cf51a78919c269003baabc78ff513036d3a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697878577, "uuid": "1f6a4a3e-dabb-43a6-9bb6-36b087ac4fb2", "comment": "Malware payload (Amadey)", "value": "c930a7d0661a3c91d9c8b1746242e1332d732ec3fc9a44dcc901d1d99bef5b449c052bfa234f2ffbc1b04eebe1f6801c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697878577, "uuid": "5f7f0d93-57ba-478c-b419-e9fce46a836b", "value": "T1DB452346F7E4A472C6F16BB028F6032B0A36BC655D3892562B43ECDD1DB3A80957137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697878577, "uuid": "ce289f55-2656-4870-9d6e-8d3a9e6fe735", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697878577, "uuid": "55ba8820-db4e-409b-b184-be30e6cc7c61", "value": "24576:oy+rZ7iThgQ5ZkFlT6AUGrhWGhMaOKz0vQgUYV+eXr2/i5+:v+rZ7ogEZYTUGrh3hiprUg9r2/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697878577, "uuid": "bcb8e1d1-0cbb-486b-9ae4-52f987615710", "value": 1226752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697878577, "uuid": "d222ccd6-7b2e-4b77-a088-fb79efe4c458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697878577, "uuid": "fbb40841-02b0-45f1-8908-8ddb506a19f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b04205e-7029-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697903395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903395, "uuid": "17369671-6da0-42b5-8b8c-d2b33d0214d5", "comment": "Malware payload (Mirai)", "value": "030d9e5de86000003dc207f31fa6ef3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903395, "uuid": "27900d78-1581-46e8-b085-9fba77548e8c", "comment": "Malware payload (Mirai)", "value": "b327860e83fa2e0550370e3f217fe3927e7c7ea066c5cbff43d91c27f3539328", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903395, "uuid": "859279a9-3285-4625-8635-6374d2cee390", "comment": "Malware payload (Mirai)", "value": "c53a3c1de4a9875e02844e03f50d2602caeac5ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903395, "uuid": "d0ae7c26-ee0c-4539-9dee-f0a877e78911", "comment": "Malware payload (Mirai)", "value": "80ff03629f8ed319c28a9563645b6227f354b54ee1be3989080e2def946a0c824bd8bbbc72c6bbfc5f49a0874f634812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903395, "uuid": "81fba059-dbdb-4907-9ff0-e247daec7b13", "value": "T131C3F945FC515B13C6C652BBFB5E428D7B2A17A8D3EE720399256F20378785B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903395, "uuid": "a8286146-cae0-4249-8329-29b644ef8a00", "value": "1536:U1HQPRnS+c6tSFlA1CA4ViaSrTXN5Lfqt4DKTr+aKrllxxwywJOl1TwPnBW1BuL6:U1GZoFl84dSDN5LfAvRlpFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697903395, "uuid": "a005d806-6adf-46aa-8b5f-73d3ca2d4fa1", "value": 129420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697903395, "uuid": "591d366a-ae0b-4f4c-ab6c-db354a8427a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903395, "uuid": "ff362088-3789-4b43-9691-7c47871d620b", "value": "030d9e5de86000003dc207f31fa6ef3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e14ed8-6fea-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697876373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876373, "uuid": "cdd6f1f4-b8db-4eae-a1df-1d75c0c2c24e", "comment": "Malware payload", "value": "9254b4c766a452f1c7eb6f1378ee5fec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876373, "uuid": "5a730f79-ce4d-4519-a5df-2259100f839e", "comment": "Malware payload", "value": "b3f8e916122bb04524835950620392962e9e1fa2ed1c4dbb99fba648f51096d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876373, "uuid": "1b9fdc5e-2422-46cd-86a3-b6b8530aeee2", "comment": "Malware payload", "value": "d9fa1bb620817b4c3f8514225e8ee69949562fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876373, "uuid": "e75b931d-84a7-4de7-8b81-ef237c2b332d", "comment": "Malware payload", "value": "ec1808c3a06e42be19304504c4daae9d2c2aafc279833d3f7244bf5beda9a2d7625782d5c9d3c6984ef08cdbd02b98e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697876373, "uuid": "bc682093-93bc-4cc8-91ba-490e5b369ff5", "value": "T1E9063A2D7A55A9AACEDD22F1935B4C2ABF9DD5431300A24F374993CDB30C192A60C79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697876373, "uuid": "55951055-7018-428d-a41f-c945709d1b70", "value": "98304:1yN15U7E78LXSMkqlvPxbGorfS9qom0BDjaHY/J3Ve9PaP8JiCfvihYNTw35QBRE:1yN1i7EwXS1gvPu27viCNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697876373, "uuid": "2507609e-312d-46df-8be4-fd47ffc5ae3b", "value": 3733504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697876373, "uuid": "26239743-28cd-4e39-a63f-a7e118f1a03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697876373, "uuid": "eaf06e92-726e-4522-873c-3ada041c16ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fdbf39-7061-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697927412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927412, "uuid": "f0949d93-c17d-46b1-94e3-04ce109ba536", "comment": "Malware payload", "value": "86aa3f1e58516c4ba0f0947dab58b1e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927412, "uuid": "1ac4ffa4-b15c-4cdc-9e27-d0eb1db24635", "comment": "Malware payload", "value": "b41dbb0880211b8bef437aa9a541f6cd1c15be6ed33f604571d5aea2f4c5da1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927412, "uuid": "f3cd68f8-93e1-4fde-9d6a-f0d9ddb70181", "comment": "Malware payload", "value": "f28ade90215c5a0d8cb262b1f9949075ff5f2714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927412, "uuid": "a01b9a5d-9d2b-4e5d-adc0-a21c13dc1b62", "comment": "Malware payload", "value": "8f30d307b435b661c0e0a8430a9f53d1dda9f5b7c0192b9df780590e4c024ac1d488ed79f6093d06935d63228263f6f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927412, "uuid": "c32347ab-5395-4074-86a7-50c99e3b1a16", "value": "T13544CF11B7A1C836E46329351970CA661A37FCE3EA7141CB37A43E3DAD716D08B26B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927412, "uuid": "e5421e14-4385-4410-8050-dcb4fbfb0501", "value": "1a993c5a381c8e12968253c74a42dfae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927412, "uuid": "6bc9b5a5-1a6e-4be6-bdf2-9a851769d3a3", "value": "3072:H+1BNscJAFmc9aPUol/+duYz0+wXgk+lQrv1M9DKlCNJ:MeCAFr9asPhwkktG9O8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697927412, "uuid": "878a6781-c257-402c-ba20-37e024733529", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697927412, "uuid": "68f40510-1054-414e-a46e-0f67ee07bef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927412, "uuid": "5060c596-1bfb-4afe-acd4-3dcd1801b5f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86647fee-6fce-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697864330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697864330, "uuid": "8aa6b44c-d39b-4a57-816d-2551c6cbee7a", "comment": "Malware payload (RedLineStealer)", "value": "384fa75b249150b9c693205d1210168a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697864330, "uuid": "7418b730-090f-43c4-ac9b-76d93904e94a", "comment": "Malware payload (RedLineStealer)", "value": "b7a1cb6937d81aa3c74fbcf0fcc473703140717b14cbdfb7147e0b15b1088984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697864330, "uuid": "b6604c23-e7c8-4502-9418-106e1075e94a", "comment": "Malware payload (RedLineStealer)", "value": "1864f6cf2c6093d37ed78c29adf1ee1a14253753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697864330, "uuid": "ddd4cf65-deb1-41b2-83b5-1e3b4e0e32dc", "comment": "Malware payload (RedLineStealer)", "value": "4aa5b67437fd8354a0632f745a93402a2e592f5209b49571071c32b6ad440c18735bf1ebeb63a1f72848678a74021803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697864330, "uuid": "26a223d1-539e-4538-a6e0-e63c65cdc3bf", "value": "T1FD65234797C94833EAB233B438F192C34736BC85AD30966A3195EC950DB27A5D27632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697864330, "uuid": "bf55bc83-3d84-403e-88ac-174769bfd0a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697864330, "uuid": "62f1a806-11c7-423a-9d7c-f7179553571c", "value": "24576:py9TU8WnHp7ieujjX/yZaccXbNdymzf4WTBKijhhLqoGPgAgLj2m2i:c9TLWnXuHXgBcXbNHDV9jhhLqz9gL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697864330, "uuid": "95ff84a3-95bc-4963-aa89-ef44e6fc9cc6", "value": 1515008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697864330, "uuid": "3b58a123-22f0-418c-a009-f46a42906551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697864330, "uuid": "222c0be7-a2cd-4fd1-86be-8b682580a776", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef03459-6fe2-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697873042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697873042, "uuid": "bbb5f8a8-6b33-456d-91e8-2c5cb436738f", "comment": "Malware payload (Amadey)", "value": "9e95646ef578848f4a8c1daf3618f5f2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697873042, "uuid": "416ff286-59cf-425c-bce1-f422e4810248", "comment": "Malware payload (Amadey)", "value": "b808a7ff112475e934c1a045916338b0c34bdaf4164b0d6b197ad91c0a8fec74", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697873042, "uuid": "7dfe6e83-bf1f-40a8-94b9-916fc22e0ace", "comment": "Malware payload (Amadey)", "value": "2a4ee4e308149925464e7192a0022d576ac1dcee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697873042, "uuid": "402e919d-5ec4-4b9d-88f1-7c1ea77b866b", "comment": "Malware payload (Amadey)", "value": "982d0a962ca8440f421879bcba49baef8087e012f5ed8288b65d40369f60202e361d3068310e89d1868963b14e37e2a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697873042, "uuid": "ee2fa1a0-97f7-4791-9ba2-37e84092f6d3", "value": "T10C652343B7C00472E9A527B004F73A530BB1BCE25E7C5353674666895FA3B98B13636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697873042, "uuid": "97877681-7204-4a5f-a8bd-f02d0a20e57a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697873042, "uuid": "d47199a8-9c95-40e5-90ec-b58795afbb57", "value": "24576:jymcaBvDI01nU7wmU6kE4AUIlnQj+xZODHK+3opbVdu07bsRqPIdKt/bziIegF+c:2OC01EXJUIlnQ+2DJsVduwsRqgdKtyZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697873042, "uuid": "b14ac77d-3479-49e1-a4d3-3191e4c3a903", "value": 1515520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697873042, "uuid": "8bb6177c-dfdc-465a-84f6-d1677b16ecbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697873042, "uuid": "186e12a5-e524-41b9-9203-3a8e039eefce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c29239-6ff1-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697879304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697879304, "uuid": "bf40f5bb-3a12-4435-b0f9-34d5519a6e45", "comment": "Malware payload (Amadey)", "value": "b20dee496f2e5a286b60ce5ba5090669", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697879304, "uuid": "cf4511d5-ac04-463b-b401-096841374d5d", "comment": "Malware payload (Amadey)", "value": "b8a3fefe45f2c34d83417b15377c12eab052a4d212d9984633fd235d62c7e2b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697879304, "uuid": "96ef418d-b162-4dbc-917b-9b9e72b43777", "comment": "Malware payload (Amadey)", "value": "369613de05d8e1e28ecc46ec760b57730ba443f2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697879304, "uuid": "99d6c9fc-760a-42d7-964a-bff11916d47d", "comment": "Malware payload (Amadey)", "value": "af215c3e98a2ca33278479c5160c252d580ad72b8b0ef72327e8bd12d735ab879e644a172949a57ed3ab01575ccb64b6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697879304, "uuid": "cd7be96e-9d60-4ce2-b7ce-fd8b04316de4", "value": "T1AC45230777E48031DEB9677069F2869703347C924D78A7AB738365C90D739A8A2713BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697879304, "uuid": "14e3286a-623f-4182-b253-35745bd6fb49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697879304, "uuid": "8ff09bbd-8ce4-4b21-a673-df126fe34b0b", "value": "24576:mymx/RF/7Q9fGm6r+5Af8jfCzbR5CXLa2ZXN2YPWtRy:1mxJFTQuLr+GfEf4nmZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697879304, "uuid": "0c70f9a5-a209-4b32-abb9-8fce80c65337", "value": 1236480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697879304, "uuid": "cc6c1d30-e5f7-47e8-aa61-d0faa1087521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697879304, "uuid": "c083deac-3fb5-4ce7-91f2-9cc6bfb05b48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7da320-6fe9-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697875854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875854, "uuid": "b26eee1b-b216-4519-b9d1-b3d53695cf79", "comment": "Malware payload (IRATA)", "value": "bc0f0a7dce2ff8ed111f319260ccea72", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875854, "uuid": "97aef717-15ba-48d9-aad8-a7d6974cb7a2", "comment": "Malware payload (IRATA)", "value": "ba0378338849f63684b63e7c6c3f8cb0837ba0a29b2e8bf468260166098aff82", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875854, "uuid": "00916448-47f8-4433-b1e2-c81c6338d28b", "comment": "Malware payload (IRATA)", "value": "7c3032ad5f9c7c3fa814653140fec0b7495cdc71", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875854, "uuid": "bffb5716-9aa3-47f5-8311-da37d394ac94", "comment": "Malware payload (IRATA)", "value": "8440426f3ee386c48ab02978d1183ec79854cf694051b02e4a610caaec5773c185ee7ef71cdd5e55448ccdfc8ac2f97c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697875854, "uuid": "e05f6d03-6f14-41e1-a5a4-7d05c1b15e16", "value": "T1F5A533ABE0037563FA3FD2F2118721C151561F04CC9BA8497A3E3B2C567B6DEA35B4A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697875854, "uuid": "c1c9728c-6f58-4216-a1dc-edd19324cc72", "value": "49152:ZEnKhcjgEwWH/z7t/DZrVpejkB7pnjaLiC6V4TlCQnS:ZCDUDW/vfBFnjjVWtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697875854, "uuid": "1f050915-bba4-43e5-a464-dd8128d91a29", "value": 2206939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697875854, "uuid": "ae53ebb0-1716-4267-bc9a-952803b62bad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697875854, "uuid": "0b5c4776-cd63-4740-9154-2aeaff26a1c6", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36533ad2-705e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697926043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926043, "uuid": "6dc9aff9-2341-4843-8701-fc024d885804", "comment": "Malware payload (Smoke Loader)", "value": "1f6b3bb9c0d1f261ba9cfd32b3710bd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926043, "uuid": "97fcb135-57f0-47f7-b215-9d3ef4d88a2f", "comment": "Malware payload (Smoke Loader)", "value": "bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926043, "uuid": "82087508-4376-4d1a-8630-1c05f465f7a1", "comment": "Malware payload (Smoke Loader)", "value": "ed717ad01c062a3620bc028540a1c689e8c311bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926043, "uuid": "7aed4f65-2b30-41d1-95f5-50ce46e5c1e3", "comment": "Malware payload (Smoke Loader)", "value": "a78133929631737b92a190937a840a63502bebd6f12f53333ccb4ed2d55e2820fff5d33fc5b0a432eb4d82d89ea3d18f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926043, "uuid": "a93f46ce-a735-43e7-b95c-203cb5a8f301", "value": "T1FD44CF2177D1C432E0A769355870C6551A7BFCF29A7141CB33983E3EAE712D19B69B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926043, "uuid": "778f5dc9-6e6f-427a-bfbd-d7131a4c8db0", "value": "1a993c5a381c8e12968253c74a42dfae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926043, "uuid": "03024655-1259-45f9-951f-d2aad1dc5cea", "value": "3072:Hx1BNncJAZmq9uPvQ0usm/mU2GNXvDukD1EBCo3KND2J:VBCAZB9uHLur7n1DXx9oat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697926043, "uuid": "970eba94-1445-40c3-b3cf-48c5783975a2", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697926043, "uuid": "da333fa2-4265-4ea8-bbc5-3b43b8f88dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926043, "uuid": "e57bd4ff-7b45-4a2a-95b3-2d2954e49e6c", "value": "1f6b3bb9c0d1f261ba9cfd32b3710bd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965f159e-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697884543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884543, "uuid": "c9e56275-011c-4f0d-bd27-7c958bb362ab", "comment": "Malware payload (RedLineStealer)", "value": "1c6c126335ba60709c5fb546cfc03138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884543, "uuid": "d8d7c95d-39ae-4b62-b3cc-96f829ff5bcf", "comment": "Malware payload (RedLineStealer)", "value": "bcd9065773950a99f1adf67501b4e2da9c7cb4816f82c842476fb2256f464c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884543, "uuid": "c3b7968a-6243-4ab6-b43c-6641d5d64b16", "comment": "Malware payload (RedLineStealer)", "value": "6a4b5d16eece18b4f48f4f1d1755e2c0f3dd5b10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884543, "uuid": "bf260bd4-33c9-43d3-be5e-87155aac3b8e", "comment": "Malware payload (RedLineStealer)", "value": "0feddb495c8ce36940de3843b91c74731fe8e1ada3ec6e157e63b32b557e7e347ff63471c7c36d7be32764e576f92250", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884543, "uuid": "6ecc0850-71be-46d1-a661-c768bdcc830d", "value": "T1A6F41251E2CC6037E8B917B008FB07930D387CA25D78A72B3B946C5A4DB368566B635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884543, "uuid": "4f0d63cd-e2b9-40db-b0b5-32c064c0610b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884543, "uuid": "634cca88-932f-4be8-8e75-9e8e2421fb9d", "value": "12288:xMrmy90+fOYDmjokmAYQNXGncefmV19WikOS5EryOM7M232yJz8M/IVEv1JT:bysYEjNXGcefufm5tOM7M232yJz8M/IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884543, "uuid": "b0e0a05d-70e3-4e42-b32a-344389569a08", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884543, "uuid": "0ecf66fd-7785-4645-af0d-7488ffd884af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884543, "uuid": "0a0b21e1-1252-45b0-b50e-37c1891f2da1", "value": "1c6c126335ba60709c5fb546cfc03138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ace51e9-6fc2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697859210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697859210, "uuid": "db6eaf8f-ca22-431d-bab6-77c569f3ca9f", "comment": "Malware payload (RedLineStealer)", "value": "60f8c87422f9cc86fe58373d4d739f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697859210, "uuid": "8b524bb5-eca9-4efa-8d99-8f84b0d8634b", "comment": "Malware payload (RedLineStealer)", "value": "bd40ae0f9a2ee01b7156fb13219c0163738c64084eb5eba7ad69346918876c48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697859210, "uuid": "76e8ea8f-bedd-4083-a0c5-f24202115952", "comment": "Malware payload (RedLineStealer)", "value": "b888ded0c67520ea3c935ba5b4b37f10f517f7dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697859210, "uuid": "d2607031-d776-4bbb-af00-d4043591dffa", "comment": "Malware payload (RedLineStealer)", "value": "166481d891c44debccae27f2648d69b649dbb29d470e08661fa552ab18251c753e84b9657432f80a290b08170efbb3b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697859210, "uuid": "ba9d00ca-bd2c-41ba-ae43-4bf3232ac3aa", "value": "T156B46C33DC4861E1D2D71C7994A98D6558F9BA6123F16CE31E6C0B4FCA363D3EE29224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697859210, "uuid": "3c68d977-2c8c-4928-a4f8-71cb54c85837", "value": "bb8b51bfd9f71c7452726205f579a090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697859210, "uuid": "37f65cf2-32c8-459a-af0e-14c959a95d33", "value": "12288:hPdZgb7gATJhc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRhL:3Sb8H5rdV1sjwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697859210, "uuid": "5ab6ffe7-3e53-428c-aaff-462b7f25ae9e", "value": 517192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697859210, "uuid": "e781e9c2-5f8a-4352-b685-f08e53ab8bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697859210, "uuid": "eed44b39-bf5d-41a6-bdd5-27b9fcf7f297", "value": "SecuriteInfo.com.Win32.PWSX-gen.31982.16242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0073213-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Vjw0rm)", "timestamp": 1697884559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884559, "uuid": "e8c046fb-081b-416e-ad00-8e2fa365a2b3", "comment": "Malware payload (Vjw0rm)", "value": "cb4d973520751a756027af396ef263fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884559, "uuid": "742928f0-1505-450d-bf66-916ed0fadc3c", "comment": "Malware payload (Vjw0rm)", "value": "bdb89a48813d653020c80002b9993bf9e499200860f7158b4d252daa12cbb1db", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884559, "uuid": "50c7bdd1-5220-4f00-85e6-9a88c18a740d", "comment": "Malware payload (Vjw0rm)", "value": "c6d0ac4edf12a65eedbbe387d8add54a7c0798ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884559, "uuid": "48ac4cec-43cc-4fa4-a032-060226eb300f", "comment": "Malware payload (Vjw0rm)", "value": "34ea128e518d24f087af1495392df365d91b5cbdc76b47a2d21111ce1b2089a48e7e00f4ddd14497a3e7a243715d3454", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884559, "uuid": "f3b386c2-1026-4289-93ae-64447e7757b6", "value": "T190C1739D288A8A3913D23B8AC06DC10DCCF114B47F28D1A219ACD5C57A0DC7A87F69BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884559, "uuid": "85088d7b-8258-4d3c-bce1-3cb5a5efdafa", "value": "96:SABNo5Dyk2c24ZRMHXE6/BIL+Ys+fJ/nDdQqR7bJyKUxvUu/ingHXRZfzYMe/jFT:zSz2c24ZRMlBIaYs+fJ7fRfWingHXRZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884559, "uuid": "f2431ade-7695-4c91-99c7-38abee749458", "value": 5800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884559, "uuid": "a4a32433-e90f-46d6-a306-5f8a9b0fb910", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884559, "uuid": "5663e3ba-97e1-422e-ac90-f256ec98c152", "value": "Invoice PaymentPDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4d2fba-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697884531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884531, "uuid": "88cba430-6281-4e8b-b20a-49b32d5fffa3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "49c16d2635480bf2ff8692d87a82f8fd", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884531, "uuid": "b4983cd0-cbfc-405a-8e31-23446446ff5a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "bf33824e8033ca527894888ed25ede1c9f17ab6c159f4beff4dbc8216801b618", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884531, "uuid": "2f0151b6-e517-4872-b14a-4844184ca2d1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "665225e0c0696413966209041e7248ed14873e62", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884531, "uuid": "525b9c33-88d1-4104-abae-6bc64e55f247", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "947e2bf77359d0482a7042931d1579464e64ce860c2bd20c0176cb68cb96ac4207aceecaaa9e87b6b4b6c2b7d67da2d5", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884531, "uuid": "ca43073d-a94a-4858-bcbd-0223e25bf0ae", "value": "T127157C2139C18136EDF310BB87ECBA3A82ADD4B0071916DB16D857EED7606D27F32592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884531, "uuid": "73f98905-e30a-47cc-9dba-d171a1574570", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884531, "uuid": "634088f8-3b66-4403-b25b-fe0ae2183bde", "value": "12288:tdxlbCCPOHiJMRxxcZ541BYlLckufEjWky8ot1QyuG/yuD3rC0rhfGJ:H9POHiJMRxxcZ54bGcNfEjXU1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884531, "uuid": "d1508589-2f2e-4adb-bb42-57f0984b0c11", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884531, "uuid": "54fdc1f9-7150-475e-b337-9f6d9b286154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884531, "uuid": "1a11e7fa-b493-4acd-b628-6499a9b9b37c", "value": "49c16d2635480bf2ff8692d87a82f8fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c94d13f-6fb2-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1697852314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852314, "uuid": "9d873ff1-415d-401d-84bf-bba4664da9a7", "comment": "Malware payload (DarkGate)", "value": "de4cd45087a864576240af5d0cd33ee8", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852314, "uuid": "97158a77-7e20-408b-9acd-63b7866614a4", "comment": "Malware payload (DarkGate)", "value": "c12c6dd22bbdf170dffd8278facbb834c692c8f5b319e863097869fe94541ba5", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852314, "uuid": "05b70610-2e48-47d7-8aaa-cf8850ee5f49", "comment": "Malware payload (DarkGate)", "value": "5629b3684d406e431c6f41c5df56455c3b944c41", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852314, "uuid": "c47fe27b-d860-4aac-91e0-552ef9416b4c", "comment": "Malware payload (DarkGate)", "value": "f10f6674d9541f125e180d3ec6f69fd249610a6faa405b7f477a4f4a06e2cdf531d0daacc1f447f42eb886960188f433", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852314, "uuid": "358321bb-b418-4460-8eb1-f4d59903c7df", "value": "T182D523113BCEC23AE39E0A3791AFA7B5266D7C250B20C1C7B7D4787D59706E2A939311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852314, "uuid": "65970a38-3bf1-478e-9848-2e491b1d1acd", "value": "49152:GpUPLCQMukBtM5X1nMg1YkStdn6MfBDShK10/doJMzSoj1wPMkncgBWfQ8bpCrbU:GpAczg71YkDMfYhpFEMzHYMqcYWJbUrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697852314, "uuid": "ce86f97c-d73a-4cb9-85ff-0875e53887d7", "value": 2838528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697852314, "uuid": "ff9d0fd8-117c-48d5-9ecf-5eb1c322ddf7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852314, "uuid": "febd6779-0de8-424c-bcba-dce443c30df6", "value": "dddb28aa3fe22e34b4e6b948e64c2b0cc685a9d1280fcad5a064f5c4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b2eabb-7065-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697929208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929208, "uuid": "bfff1bd5-66b8-4cc9-81a4-e9905b64eea0", "comment": "Malware payload (Mirai)", "value": "655198f328f4a0210b55adb64ab66ea5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929208, "uuid": "107c39b6-3f7e-408e-b159-3a9af00184c7", "comment": "Malware payload (Mirai)", "value": "c134083510c3ab40a31606dc128a98ff9802d8b69210f2380bf5ab2e9792f586", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929208, "uuid": "56705def-499a-4cc8-b08c-6484e3dc4e80", "comment": "Malware payload (Mirai)", "value": "513bd6ab95771c5a06f2e7138935fd78ae74b8c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929208, "uuid": "c81c497c-aa99-4ebd-8136-4ea53d9c5011", "comment": "Malware payload (Mirai)", "value": "c6a936a699d549f492a940d6cd9b93bdbba6ad2ceb21c01882103259b43ed72b711c3c30a908a19b7666b52bbd7c41bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929208, "uuid": "3a40a447-2c4c-4d48-a06c-fe6e684a2467", "value": "T1E0C2D13097ED2CB5C6500631E2B86AC9BE530FBDEAFB3890114157FB3942D1529EA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929208, "uuid": "62e72fce-f067-4650-a1c4-49d20d32df59", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEfdBaUYhymdGUop5hg:A8soTAZ3alkXLvFh8nNEF0Ts3Uozy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697929208, "uuid": "3dca8854-03a1-4af3-bf9c-5d243619695e", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697929208, "uuid": "4288f957-2b1c-4968-8529-4640fecee727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929208, "uuid": "42f97414-8ca4-4dfb-8a07-17eddff895af", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264e1b5f-6fa7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697847418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847418, "uuid": "cb4dd9f7-e1cf-4c79-a8c4-4e7dda0bc6a6", "comment": "Malware payload", "value": "f54737da90814459138c5d1688c7ebb2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847418, "uuid": "d2c903e0-15ef-498a-ad28-f1393f413824", "comment": "Malware payload", "value": "c3d00fdbbc53b412e13657342144f7f0b5df9ff0e7e1211b938cbe9f6aef8e3a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847418, "uuid": "5fb4ace6-09f3-49bb-827e-a28dad7f69b4", "comment": "Malware payload", "value": "e423e05ef8a65f9a3f6eed1751cbf979526b6db5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847418, "uuid": "7eee9583-8b09-4976-bb05-5b96bb788038", "comment": "Malware payload", "value": "5aad451a7ef58160a37114b6d61104c9253cf372c16015a202f483ea01e489ea45c796c57e99d06cace4611afcd40661", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697847418, "uuid": "587fc44d-0669-4541-b100-0af147b29676", "value": "T1FC417B141FE52724F3B39A7568FAB311CA77B849DE018B8F018183882422215F5BAF6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697847418, "uuid": "b41c05dc-633f-4e16-9efd-8f66dae955fa", "value": "12:8AXUm/3BVSXvk44X3ojsqzKtnWNtW+UcCsvXTC6Cv0iDPMThbdpYrn1IlI5u9bOW:8A5/BHYVKVWO+/CWu6C8xdd79ds5ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697847418, "uuid": "1e98433c-4590-4004-a920-dac6d8c2238f", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697847418, "uuid": "ade13b5d-c385-42f1-837d-9162ce858e86", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697847418, "uuid": "288e582b-3698-4058-8b7d-3c88133b3ac6", "value": "bb5dee8e029b058bf1e913724e4281cbe00d821a632da6481e99a30f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8710a5e-7007-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697888949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888949, "uuid": "bafd338e-53ce-4740-8d31-309a4d026d3c", "comment": "Malware payload (RedLineStealer)", "value": "9698781475f1b54ad3b12be8112002de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888949, "uuid": "bb32dc23-46f2-4b2a-b2b9-01af22f4c96e", "comment": "Malware payload (RedLineStealer)", "value": "c454abdc581957189592bde41ef58f216e3a5495960ac162ab21a6380495c0b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888949, "uuid": "ebcefb21-c853-43aa-b464-9ab40b0120db", "comment": "Malware payload (RedLineStealer)", "value": "5af998d9d3ca5cffaa35b9f615a67ff237c036d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888949, "uuid": "57af2fb7-da76-40b9-8907-425a08208202", "comment": "Malware payload (RedLineStealer)", "value": "ad846c785ceb0259e4c585f10963585dc7ed067d0af87d1c835d08a77a9325da9a7f41fa926351b64b72827aab113e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888949, "uuid": "877ff67d-d5c4-4c90-9352-bb39b1221e81", "value": "T191B45C33DC4861E1D2D71C7994A98D6558F9BA6123F16CE31E6C0A4FCA363D3EF29224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888949, "uuid": "36206bfe-da2a-43db-9f38-259cf2c08821", "value": "bb8b51bfd9f71c7452726205f579a090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888949, "uuid": "86255def-c80b-48b8-b7a5-60f2ddfb3d87", "value": "12288:/kdZmL+3gTOhc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRxL:s4LgQ5rdV1sjgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697888949, "uuid": "2d7df566-0c8f-4f70-a1f4-0388d6612bda", "value": 517192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697888949, "uuid": "d244d0a4-04a8-4b4c-a935-36f5a2ae241e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888949, "uuid": "11b882ca-6557-4389-80a6-c960c623bb9e", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.663.28425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5926c071-7007-11ee-8907-42010a9c0042", "comment": "Malware payload (TeamBot)", "timestamp": 1697888735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888735, "uuid": "1303af5f-0b83-4ca4-b73d-5fcff1c4fc2e", "comment": "Malware payload (TeamBot)", "value": "59886aef0425a547da2dec3883354ae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888735, "uuid": "879968d1-0fd6-4d3b-9c62-18e016f9fb2e", "comment": "Malware payload (TeamBot)", "value": "c50c7caece0e3f17500d2f69f5acfff1d45b1f3319ad17462f0df8e7793a2567", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888735, "uuid": "bc8e8be1-743c-40e4-9e0b-96e55ef2d81e", "comment": "Malware payload (TeamBot)", "value": "a8afdf39b223ac011a974c7bf2c71f91ff8f1e8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888735, "uuid": "722b9769-1626-4f4e-a25b-bb335c73ce73", "comment": "Malware payload (TeamBot)", "value": "868172568b086472e013f9e3a4e01835332021b6cfb105589ed12571532af59f7a32bd40ee68fa6dfcb41d935793342d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888735, "uuid": "b0259595-783a-424d-a036-6c5bb60db857", "value": "T16444C0217690D832E4725A355870C9551E3BBCA3EA7541CBB7983E3EAE313C19B62F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888735, "uuid": "1a6c2e65-269c-473a-833f-cbade62ffc49", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888735, "uuid": "733a2dfc-6fa8-411a-b7c6-fed72f4285b3", "value": "3072:KfyBNtIxAZzM5N3gOEGgi9NyciM95bS4PyArZyKQPX:KObGAZY5NQvevyxCbzdxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697888735, "uuid": "79f7ae70-0d8e-4e7a-8e15-a21c84d6f19e", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697888735, "uuid": "e7c3c98e-cced-4394-9f39-8a324431b515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888735, "uuid": "2c272014-7b11-46ca-8f55-bda7631c0e64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b05748-6fdc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697870184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870184, "uuid": "a62b6ab5-c8c2-401f-977f-72a16ad35daa", "comment": "Malware payload", "value": "0954fa3267d391b318a5f48e50fbfff3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870184, "uuid": "616006a9-5fca-475a-b90d-4e8829970620", "comment": "Malware payload", "value": "c5c3e038217cc6eb73f1ab315051faa71aaeeb880c6b186b4d0d35fa12e188b7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870184, "uuid": "e30beaed-c4cc-4c6a-8575-cab607079c7a", "comment": "Malware payload", "value": "8a07ef78ca1f8f30458af72eb6ce9901bd76efdf", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697870184, "uuid": "e1a83e37-22c0-4b23-b8f7-e65348edc5b3", "comment": "Malware payload", "value": "3397c848f935105516ac37137b91554abe1272901a879e1d0705ebe7d4595c96370021342c7ebc0f2d4b5b44135a9690", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870184, "uuid": "0a73f493-d088-436e-85c7-82980e0f4b3f", "value": "T15136330BBF5C4A9DF61FC87A10150C537929A6EC8682E22F02B1812DDCA3D95875DFDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870184, "uuid": "2f7403f0-f1b1-42f6-8657-a8742fe8c4a9", "value": "98304:8pTt9k58xahrx6+NU5Su9X+r8ARIqG83lax77cgOkCIX8B:oyuxqO5R9Xi8i9xwX8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697870184, "uuid": "58f8acdb-8f33-4318-934d-c8720b4eb7f4", "value": 4920855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697870184, "uuid": "c9319a61-9dd8-4f5d-a917-cfdbf811ca16", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697870184, "uuid": "378071b4-a9a3-47ea-9acc-20226223d40f", "value": "forge-1.18.2-40.2.10-installer.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d926c932-7007-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697888950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888950, "uuid": "85b6e670-237f-4b76-a841-f06d342cc516", "comment": "Malware payload (AgentTesla)", "value": "f461b5fbcb1ebcf6cf9d881dc308e222", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888950, "uuid": "79ac07f5-a974-4a4c-bb9a-c43a7aea81dd", "comment": "Malware payload (AgentTesla)", "value": "c6efcafa1919f03c1c4039960fe44a4c92c93e53ec8497c7e192f002470aec30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888950, "uuid": "0f7a241b-666a-430b-8e29-4fa800594552", "comment": "Malware payload (AgentTesla)", "value": "3af8050714023b699268fcc09629492b3b58babe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888950, "uuid": "97864910-c91b-44d7-885a-c39ba05f1ff1", "comment": "Malware payload (AgentTesla)", "value": "3cc7c2eedcc191cd891ea19dc43b5d98a888afb6c04b4d948e25c67f30922295ba54b6ff0d6c232d4d47299f1d64f899", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888950, "uuid": "8ee6a5b3-4435-448d-a8d6-3a93aa59b86d", "value": "T12305E1BD31EB6495F476EBF1C3992B8D8B6BF3F5212F77162C8102138421D82EB125A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888950, "uuid": "7def7972-0737-409b-910a-62a7e79521a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888950, "uuid": "e1b299f8-c14e-4e09-861c-472f59e9ecd6", "value": "12288:03C5Y7HHuIhOBpeyCnmKLAYgcO6qGOkyhz89m4JFkEIYTAXUOdyGwNJdtMUmkOKE:m/bHzh4eyFKL+cO63z06JHOUZGrUmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697888950, "uuid": "91a4ea87-1ff5-4a95-83a7-ba015089d029", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697888950, "uuid": "707092e1-c037-4cc5-b63d-3554bf1febd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888950, "uuid": "a966df76-6bfa-4b96-8d20-155e5fcc2a86", "value": "SecuriteInfo.com.Win32.PWSX-gen.11921.16258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a775484a-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (QuasarRAT)", "timestamp": 1697884572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884572, "uuid": "8b9a87ea-463b-4378-8ad8-15271a6ecdad", "comment": "Malware payload (QuasarRAT)", "value": "0f80a2828ab176a16ded0177fea53764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884572, "uuid": "e6473b11-3a6a-45e4-b398-e4618f582a21", "comment": "Malware payload (QuasarRAT)", "value": "c7550dc220b264239f7250607d6af8a0123107be4c377a3c94e5f8e63984b17d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884572, "uuid": "e3e244cc-a862-4685-9bf7-8762a6e0deb7", "comment": "Malware payload (QuasarRAT)", "value": "9931cbbf78f55a0118c9c1deb5a7baa41450a97f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884572, "uuid": "694d49dc-e43b-4237-9b5e-cac195e74d7b", "comment": "Malware payload (QuasarRAT)", "value": "b1db6c0d897c13af4d89a54d888c6591313e444e67d2eaf2316f07587eebbb173cce785f562661d20844af133a594108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884572, "uuid": "d64f68da-4c07-4b5f-b5aa-82c55b5b7c8a", "value": "T1D8F55C1437F85E23E1BBE27395B0081667F2F81AB3B3EB1B1152667F5C53B4058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884572, "uuid": "68b74cc2-c9e2-4812-993a-a271ade7f476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884572, "uuid": "f2a31c03-f642-4604-bfdb-89d85c8e3952", "value": "49152:QvXI22SsaNYfdPBldt698dBcjHXxOEMkrk/JxEoGdLQTHHB72eh2NT:QvY22SsaNYfdPBldt6+dBcjHXxGe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884572, "uuid": "369f280f-e304-4823-aa48-fcec88cb5b6f", "value": 3333632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884572, "uuid": "b5f540d6-3ed3-41ff-b2ba-6a480c699292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884572, "uuid": "9ecee68b-13f8-4e5e-a49c-e942e95d9b8f", "value": "0f80a2828ab176a16ded0177fea53764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16be1f9f-7024-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697901079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697901079, "uuid": "23e68bf6-d988-4a86-b0dd-a76d3ec59b5b", "comment": "Malware payload (RedLineStealer)", "value": "0d6c7b15bf3a3c0858ffc2b36a221926", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697901079, "uuid": "c47713ac-3ca5-4bc4-ad40-8be60245ec58", "comment": "Malware payload (RedLineStealer)", "value": "ca09c4f29fe69c9cc1dca4cf640967329141a2ee7105cdf078abccf14c8edb58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697901079, "uuid": "06176417-63ef-46f7-bf99-5be897b1d153", "comment": "Malware payload (RedLineStealer)", "value": "3e1569f9bd2df7947a31450b61a505237819e357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697901079, "uuid": "88868929-ecb3-450f-8ae4-78c054d09357", "comment": "Malware payload (RedLineStealer)", "value": "4f8fb2673b0562d26f0479ec998442615e8e913355be6e7e1d271808b3987fca56fd33ba90c659b8516eb52adec0cac3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697901079, "uuid": "12d89374-156e-424a-b16e-5a066dec4831", "value": "T1B0847DA9B10DFF39DB8F0DB9E98568AC59347D6C3B52688F2B880F42473D785D53810A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697901079, "uuid": "b53d7e90-ce5b-42f6-a48d-613515aa1020", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697901079, "uuid": "3a1ee3ef-ce1a-4654-abdc-ea9bf6456477", "value": "6144:Ln8rmeRB7msDTIEhNvJTi3wjNYmpUKAAAAAArgAAAAAAAgAAAAAAAAAAAAAAAAAq:j8KGB7mwXZnxp1AAAAAArgAAAAAAAgAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697901079, "uuid": "c3d954fe-be0f-4df5-b824-ed1e76749212", "value": 385608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697901079, "uuid": "9d02a270-029d-4fd2-bce0-dcdc375ee560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697901079, "uuid": "76ef0e31-90b7-46ed-bab4-aab90ccd6f39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954a9dd6-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1697884541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884541, "uuid": "e41e1f40-8c7e-4e4c-bded-a627569619ee", "comment": "Malware payload (CoinMiner)", "value": "f4ad1595e0ee0d85660ee8e19bc61090", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884541, "uuid": "be1a7600-f649-48d9-bc72-507b465e655e", "comment": "Malware payload (CoinMiner)", "value": "ca15fea47002214d74f7cb7958944a1d3db16252488c4dd5b4108a8d213f940c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884541, "uuid": "cfc62dd2-fc41-4acb-8977-6f931c9a14a6", "comment": "Malware payload (CoinMiner)", "value": "fd8b1472942122f805c4d48ec3694e858e19bea9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884541, "uuid": "d6a19334-b434-4cee-9822-0d1bf2e99c71", "comment": "Malware payload (CoinMiner)", "value": "9334145b8a2303db907a98c5b1c5c7669244019f4644f35631ba88de0af42c9175d2fef80163ece223b9e28dd0da5f56", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884541, "uuid": "293b5b7a-be1c-4d8c-afe8-b0b9b78687d8", "value": "T159652343A3D99534DAB63F3418F7054316387CA2DCBA835E6685D8D84EF3A6061B873B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884541, "uuid": "1a299d21-8f50-49a7-a0ed-2357c306b561", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884541, "uuid": "34a7626b-4ee6-415f-bf73-2878fbdac2bc", "value": "24576:iyKV2X1aTH0cmX5XBtcfZJjNk2FIg5OlGJXz7h7ZjfIi6FQtp3h:JcgaTH0TVByZ9NDIiPzl7Zj6FA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884541, "uuid": "585e2e8b-2730-4f20-ba18-5d6803cf33e9", "value": 1513984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884541, "uuid": "28e13a0c-264b-465c-a381-389b0ae0b327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884541, "uuid": "365b8631-fb0d-471a-8f4f-9670f9e7b1b3", "value": "f4ad1595e0ee0d85660ee8e19bc61090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9291ec2c-7014-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1697894415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697894415, "uuid": "87bd1811-5efa-4cdd-a85d-dcc3eab776df", "comment": "Malware payload (njrat)", "value": "9b806dabd9cee3dad40a97c3c71c1d2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697894415, "uuid": "baed544a-6d11-4102-ab90-dbfd32b543e1", "comment": "Malware payload (njrat)", "value": "cbb9ae140aadccf6839319b557cbd196d8991b59066f9934e9d7320721abf7ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697894415, "uuid": "809e0b33-85ea-442b-ac0d-278fff3ab353", "comment": "Malware payload (njrat)", "value": "cd248e8db6d3deb00a98f2e522cb43831ba2a81e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697894415, "uuid": "89bc0c8f-9708-4bf5-9d57-616675880d12", "comment": "Malware payload (njrat)", "value": "fc6f2fc405572f40f4e1d741f06f0495b10d466f44fcdb5e520a27716bdfde45eddf49f41a5c1c14ccdf1c8f464c25ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697894415, "uuid": "fa3dd6c3-9e47-4198-b66b-25db97c2be27", "value": "T1C033C58EFE0509A5C34D0A3AC0A764C452FDD59F2727FBF789E46DF41AA68DE480A160", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697894415, "uuid": "47a99eaa-5257-4fd3-b648-d2312a93c23e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697894415, "uuid": "d3cd38df-3d3f-4e7a-88f4-ff8ddc5347b7", "value": "768:lCs0QlROKEL5SoPlJxKq0SWb5/TcMCglQkRwwJqno6IF:gs0QlQTL5So9deTcuDJqoTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697894415, "uuid": "db69c7f4-13c2-4801-a8d2-dd070ef1cd0b", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697894415, "uuid": "3c3eec3e-cd5e-4d24-8533-146179d4413f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697894415, "uuid": "ddd9031d-623c-4b1b-b06e-40b998ee96fd", "value": "9B806DABD9CEE3DAD40A97C3C71C1D2E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60714ec-7032-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697907359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907359, "uuid": "043d133a-d704-449b-b5d2-feb2b5ef0f85", "comment": "Malware payload", "value": "dd1c6dffd07f2f84970cb708df0736e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907359, "uuid": "8365869f-313c-4cae-bb64-88586fd6f5f0", "comment": "Malware payload", "value": "cc96e4be1fa09744335ecdb37bbcc6a805a9f924ee2bf91b49395aa28e7b397a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907359, "uuid": "2a880f20-32c9-41d6-87ce-a7324465c59d", "comment": "Malware payload", "value": "b4f951bfb0860c512f1d9f715b3b49b95d76d4e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697907359, "uuid": "fa7b8b80-cb53-4102-8efc-ff2e6845e1ca", "comment": "Malware payload", "value": "8331328481b8850531b8cbcbc749cad956384d86d0b5ec7e6e8d6b119533f35b1918bc7f2c82ad664a3a1bc4c237873e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907359, "uuid": "06215b41-e34e-4b24-8bf3-5cb19095c90b", "value": "T1EE44C011BAA1C832E56769364C74C6A51B7BFCF2A66441CB37443E3DAE312C09B65F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907359, "uuid": "1782fa8c-9942-408d-9acd-b7ecef8a315d", "value": "e917b644331755ce8f3ab54716b5cd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907359, "uuid": "2f589520-fe46-4ae7-b037-ca593170dc9a", "value": "3072:CyBNp7KlAKHISn3qMS2CvzUmB316bQ2sa7imKtan6J:JTQAKoSnaMSvvwmBF65UdAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697907359, "uuid": "63594abd-3b9f-4d5b-80c1-cc1ead15abe2", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697907359, "uuid": "bee6e106-c643-4b5f-8488-ffecde56cacf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697907359, "uuid": "46d81176-1e66-4083-9c2f-281d2cd21413", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f816bcaa-6fe6-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697874829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697874829, "uuid": "b9d70d07-cf4c-49bd-95f9-41f9bd3e8f47", "comment": "Malware payload (IRATA)", "value": "408ea6437135f2cc441bb1c61de5675e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697874829, "uuid": "5d58cebf-2783-4347-a76b-35e1fe33b270", "comment": "Malware payload (IRATA)", "value": "ccc50c7f11f368ca4d1e03d50700f15cf441d6cff89ec603a9c37cb6b8a2b27a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697874829, "uuid": "85400c9e-1ec0-459a-89ec-2c7da6435261", "comment": "Malware payload (IRATA)", "value": "9afb0948f4f5134aa17e43cb7027e9c2fd87ce8c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697874829, "uuid": "b7c920e1-27c1-4e28-8ea7-5d4511696553", "comment": "Malware payload (IRATA)", "value": "cad360b2dca4d0a0fea439ed96ee7e61655c7a6a24bef36fc44c906ca46d24fca2ae4ca87109c19341c24fec5a9065c2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697874829, "uuid": "1f270cbf-9122-46f0-b322-65754b2e2060", "value": "T15C753382CB9BF443EB8FD13EC1482657D59EAC996225F9C6ADC5409C0AE1D006F0FD1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697874829, "uuid": "87b29219-4d96-49ca-ab2a-f66467d05cde", "value": "24576:hvjozgLGNNUVqIYMWClxFiDB5ySEV0KmK6mH2r/uB5RfG9sFxxnq/o3s:hMKSuVqqvLFYFG0rK6C2DuvR+9sB62s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697874829, "uuid": "8e5812fa-35a8-4b31-9144-a4f39e7a7d0c", "value": 1626710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697874829, "uuid": "ced8a9d9-59eb-4e6a-89b1-79d75c0f2c47", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697874829, "uuid": "1b5e6c16-9723-46da-ae6a-869626cbc947", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9885d025-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697884547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884547, "uuid": "fda8d11f-e0c9-4399-b6a8-c4a74ec47195", "comment": "Malware payload (RedLineStealer)", "value": "1ff0284354e1725f0c1edbd8773fb76f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884547, "uuid": "a58fcc5c-5caf-42ad-b3d3-397d115e2200", "comment": "Malware payload (RedLineStealer)", "value": "cda77d164862f1eae670bec24559c78a690e6a332249fc0a8a484d5c1beb78a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884547, "uuid": "a18169bd-d520-4d8d-8812-e2ed8ff36be0", "comment": "Malware payload (RedLineStealer)", "value": "1d152775ce18c56f474168ae0a78f36bafc199d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884547, "uuid": "9f09c26b-cbb3-410d-ae01-dbfb4ff41903", "comment": "Malware payload (RedLineStealer)", "value": "a77e2a7318b90c6001b3fe223e76b4b53d81095ec4ac007298fe81e9aebfa9491ce69e8779a703d3a736c2b7cb2074e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884547, "uuid": "1ade1151-37b7-4d1e-ae8a-d1af19899aac", "value": "T10004AE1574C0C8B2EE66283607F0EBB14A7EF8740F506B8F63984B755F202D1B63996B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884547, "uuid": "a38d9c64-6a6b-4492-9942-29f05490088a", "value": "e918dcf0d250c75ae82a52aae1d3b862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884547, "uuid": "fb51cfb6-63a5-4135-af9d-21ff522c8284", "value": "3072:0DQouQ+Z1e+nLVhFt7WxBd1w9+tuwyH8KSI+fzO+WwlULHGVobgeiw2fW6:0OZrUxBda9xwyHlCcm2UvfW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884547, "uuid": "9257a0bb-e7de-4608-ade6-88db08f6dfee", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884547, "uuid": "43173e8f-0f1b-4a79-ba1e-2cb68ce12ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884547, "uuid": "a632328a-0964-4d6e-8a53-be7241c60645", "value": "1ff0284354e1725f0c1edbd8773fb76f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc281bb-6fb0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697851615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851615, "uuid": "bfab69e7-8690-422a-88a2-cf6c2be37b6d", "comment": "Malware payload (RedLineStealer)", "value": "0e83f05439ae9a269025a3f6e383ce4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851615, "uuid": "f8c37a3c-965f-45a8-876f-582ef9dc728c", "comment": "Malware payload (RedLineStealer)", "value": "ceebaf2c19c02ac36e87dd081fcb20a4bdaa2dc3e64afcd5d781c7ad23b441ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851615, "uuid": "25e75b2d-492a-4bf8-83fd-55e8490fcd8c", "comment": "Malware payload (RedLineStealer)", "value": "c17ecb58d1883e406bc6ca39cd57739408699796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697851615, "uuid": "e3667722-d5b4-4935-b688-beed70d8aaf7", "comment": "Malware payload (RedLineStealer)", "value": "ec0c017104facf075f97c0e491b203a7f0e787e24456f174bbfeda7762dd20a506df54c45b6955430ed7277b895c06ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851615, "uuid": "c6c21a34-9a20-4277-b7bb-7016c04448ce", "value": "T135652347A2DD5433D8A03FB04CFA56A3173A7CA3A576CADA2350D49D0CB2868D5B137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851615, "uuid": "22fa7f8c-ab5b-4b12-b1e1-d5da0928a594", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851615, "uuid": "044dd2da-ba13-41e3-9c4e-45ee1635c1c9", "value": "24576:3yF53kiuvXVEdZzTyLJAkLr+ZVMi1JawnojZtgQcrE2AZebFbOn6LD34qR/nC3:CFpk5XadZzwAyreMi1JZnoYQg2kOnevo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697851615, "uuid": "0c50be53-4c51-4db1-9a0d-98a7a96f1f2d", "value": 1516032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697851615, "uuid": "b0020657-11b7-406e-9c22-f3871e0f5919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697851615, "uuid": "2be99c9d-9962-436a-a571-180c061517b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e898aee1-6fa5-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1697846885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697846885, "uuid": "442af290-cfd2-4d8b-876d-9fb670c81084", "comment": "Malware payload (XWorm)", "value": "1f7de37e3fa4fa057f4ae70d41ee2fef", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697846885, "uuid": "8e2f2f36-7cfc-4f7a-964c-fd0a0c4426c6", "comment": "Malware payload (XWorm)", "value": "d0354d9dba1229815a1c14067e84ac5c113bfbd398d95e5847de76592e03602f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697846885, "uuid": "61242db5-6535-4044-aa58-a2322461cb77", "comment": "Malware payload (XWorm)", "value": "8ee62d017054f990967260d0f9de3a13629238ca", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697846885, "uuid": "7f74d150-9775-4753-94f7-40186a9f383f", "comment": "Malware payload (XWorm)", "value": "1ab9b8bbc5739273836141191e45dae626347a098fa7b8a1d7bb943353e6e5ed11c7c139fcec8b5849fc18ce3309e361", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697846885, "uuid": "4701c144-0622-4cb6-9ee3-baca74b4d4fb", "value": "T16D55F7102AEBA08CB2B37F635BD93DEA9EAFFB91275B205B3445131B8516D40DD60B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697846885, "uuid": "00c237df-21f0-4be8-9d25-7f103e5429b2", "value": "6144:rF+EEbr/V/ctC4B1PvIIIIIkkx6T7IIIII62FXIIIIITdorIIIIIotIIIII9NkIL:rFFEPlc449kx6Tx2F+EaNfpwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697846885, "uuid": "0cfd73f3-1f7a-4fda-b509-1a60edd929ba", "value": 1303244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697846885, "uuid": "fc1147d9-c17f-4ef6-a79e-d5d6ec5927eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697846885, "uuid": "e7882a6d-7aaa-4557-aa6f-e8b349983f3d", "value": "2623c3aaa917cdad61ad5780f47eef7265585688e12519611fe0b7d3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d65447-705f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697926692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926692, "uuid": "42806d7a-f65f-4433-b9e9-c073b27a21db", "comment": "Malware payload", "value": "eeebc32c1d8724545c289c7453b132f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926692, "uuid": "04ed08bc-6c51-44aa-9d61-900e4c6f8da3", "comment": "Malware payload", "value": "d2ae84496d52e4c21c7a363f21427ccf2e81ce8a520a1b96b96b6a37b9a3e6e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926692, "uuid": "ad0d5a42-d463-4285-9fbb-d009b6bcebe9", "comment": "Malware payload", "value": "70ae56450d63ba11650375a51271dedee287d62b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697926692, "uuid": "63622071-aea4-4a74-af51-06e15ce4d93b", "comment": "Malware payload", "value": "09b11a55eb27daa14c462cb1aa62d0e8c34250c7d71866f11dfb31d97d6cf759a9f7add964a2108a15431b9057a20e33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926692, "uuid": "eee0f2d4-edba-48d7-bf95-c642c71696c6", "value": "T1FFC55B10F361BCA6F8B301B689BE6378592DE661172554CB50C824DE4E617E27C32EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926692, "uuid": "82b464d4-4176-49ae-8ae5-110031a80cea", "value": "597742240c4581a6deae31a391f239bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926692, "uuid": "3513b6fa-b46e-45bc-ba2b-bf90e3dbae13", "value": "24576:iTuxNaehAOfPfm0Um0LDUforZfsEgSw3bqAe1lThkCOOdg:iTuKehZP5Um0Lprge1lThkMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697926692, "uuid": "a4646f22-c024-4b3d-a5e1-342b857b2341", "value": 2540544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697926692, "uuid": "408e62ed-f342-4436-97f7-a424b8f8eea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697926692, "uuid": "89c117dc-723c-4f95-bf2f-1ca63a9b17fd", "value": "Contract Agreement for YouTube Partners.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78afc9c3-7007-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697888788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888788, "uuid": "f9460120-11fb-4179-ab5c-600f2881e347", "comment": "Malware payload", "value": "3571a9e7cc832331f0f914f9b5e6de0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888788, "uuid": "fd653a05-44fc-4d71-86c1-d19a84e71d19", "comment": "Malware payload", "value": "d2bdbe121774d186eaab95260beb2f8c5dc831464f1456cb57a7ce4a6239b8fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888788, "uuid": "592dfdc0-5fbf-4278-ade5-51bc1d1646b7", "comment": "Malware payload", "value": "5911e6337c71ce80bb9d898af53226ef56aea109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888788, "uuid": "932645d1-b01b-432e-8767-6cf7c960581a", "comment": "Malware payload", "value": "26b158191a7938a7dabab1fa0d12f4b08d3552a745ad558c82143243792334b9a6d0d3b4f77fe843dfb2d0e09f53434c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888788, "uuid": "0709cb5d-945a-4030-9f86-62781579e5bb", "value": "T143A602DF73703BA8C46AC4344523994EB6A2352F47F449AF35D976806FABAC08915BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888788, "uuid": "adf57b61-e513-4343-be46-1443556032bc", "value": "62c66ff7dcda8f634504d4a495a0d2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888788, "uuid": "31602c8c-efd4-49c7-b29d-b38abefe1e22", "value": "196608:8gE599pl+Ubj4m129RHc07RjS8OVsrvukPJs2MRyKKn4V5z5Emo:M99T+Ubjxv0x5eBkBJKy7n45zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697888788, "uuid": "bfbb5359-211b-4be8-88a2-848d3a0a40fd", "value": 10189824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697888788, "uuid": "eea92bce-6c8a-4deb-a76b-6dcb2909f915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888788, "uuid": "760df20b-5875-4e32-8359-a7fb136460db", "value": "A1RMqnseyw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83997cca-6fbf-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697857883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697857883, "uuid": "8498f50d-9dc1-40c3-bc48-7a961c15726d", "comment": "Malware payload (RedLineStealer)", "value": "c5f569e291684ebbb8befc41d3bf77a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697857883, "uuid": "6b88d852-1723-44dc-bf50-bd6cda3cbb69", "comment": "Malware payload (RedLineStealer)", "value": "d5032cb2bc27875a36fb41fc5737ca0c679b5d7003a162f25ff6ba4ca57614fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697857883, "uuid": "2971abbd-172d-446b-aae3-0d4326e4a850", "comment": "Malware payload (RedLineStealer)", "value": "a02b3e28e633d805310c56b410e731afba33077a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697857883, "uuid": "75c52d65-8eda-4c23-9a0c-fc7f40c96ad9", "comment": "Malware payload (RedLineStealer)", "value": "a14188523189c121ed988b8fafd0edfe8ec403f156b60755121242216d2d01aeec1f40f103ea461f2dd1d043dd54041b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697857883, "uuid": "29d96ec9-9652-441b-8797-4aa42c76e5cf", "value": "T13144C010BB91D836D46329314830C7A61B3BFCF2A66585CB77943E2E9E713D09A26F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697857883, "uuid": "a7cc7e52-2c74-4b87-a3e8-8bc48fadf0e0", "value": "0cce327fa0253e8d26487249a6cbdfb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697857883, "uuid": "6f427acd-eabd-4c62-b70b-becc946888fb", "value": "3072:aP8BNI7GUrCoRvIZVU/R+fvot5NnKI0P9oVG/y6K1t1:ac+hrDRvIHUJ8Qt5JKNGVGqZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697857883, "uuid": "f42ba3c8-a703-4ce4-9b94-1db19c7ac726", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697857883, "uuid": "b131e033-f3b5-47f0-b819-8743bfe4a8b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697857883, "uuid": "498bc04b-369b-40ae-a414-17aaa0f10285", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27257e5a-7011-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697892946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697892946, "uuid": "d930ac37-e9ee-4b1c-8a20-0462b0a26ca9", "comment": "Malware payload (Stealc)", "value": "0cfe3b0625b96d850f70294022cf4224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697892946, "uuid": "1fa48f82-2e72-4a38-83cc-a8cb0a61cd4f", "comment": "Malware payload (Stealc)", "value": "d7481847f525726ad977ea91fc9e458901a5f5e00d92b8f94bdd74d076e31521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697892946, "uuid": "85f62a14-b5c1-42ba-8ebf-29d15449c254", "comment": "Malware payload (Stealc)", "value": "da63f2da8f74b0391e1c9d0e026c8e21cd6da1b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697892946, "uuid": "106020d0-6176-4a50-8dd7-e2f0cc10bbc3", "comment": "Malware payload (Stealc)", "value": "531bacc3affef187327186edcaa2d026bec49aa740c874153f76533e4ddc578a8e3566bf9494e37d97b88bb80eaeb9cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697892946, "uuid": "a9b6a0a1-c8f3-4140-bfc9-80de04d2600e", "value": "T14344C021B690D832E06369355970C6561E7BFCE2EA7481CB77943E3E9D302C19B66F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697892946, "uuid": "837bbdaf-a6cc-43be-a314-077daa4fb9fe", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697892946, "uuid": "e172e029-b2de-4704-a348-028f8767c103", "value": "3072:wyBNkIxAmzF5J3J4WlafjDijs9c8EWk88xMT0g0Khz:DqGAmB5JZyfjDijs9c8o88KTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697892946, "uuid": "c15d5614-b2e2-4549-ae4d-cf51a2dfc2be", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697892946, "uuid": "8af15637-0638-4610-bd72-d6d9e90f2005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697892946, "uuid": "b069882a-f6bc-4058-bbfc-584fdc2ad778", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff645dd3-7016-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697895457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895457, "uuid": "e1b4f43d-e22f-46ee-b7e3-81d679c6e742", "comment": "Malware payload (RedLineStealer)", "value": "38afab1d1b574d984c50660b0dcd3e7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895457, "uuid": "187b72d6-73d1-43d9-a858-96e9e90b0cf3", "comment": "Malware payload (RedLineStealer)", "value": "d781f6f19875584b6043d51d112fe18986a24d51718bc2997730b1d08f425af2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895457, "uuid": "c5891a1e-3b54-4738-8dd9-e3bb8db2b081", "comment": "Malware payload (RedLineStealer)", "value": "f1b74976af1eea37d7930e7ee9c1afe5f21c9c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697895457, "uuid": "05572fff-9b40-41b2-9a86-3f86a3286eb5", "comment": "Malware payload (RedLineStealer)", "value": "62cf5414b00344aeb797837b8705094ec640af25bb8eeb4d3592b4cbc7317092ff08eece9fd0210e3052cc4a1ab22bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895457, "uuid": "8ef0bf36-0ebf-4908-8bff-6e7af7aed7aa", "value": "T192A47DC873E56472C2B602761CE5D22CD834A7907B93DF9BFBB0699B5D14682B32046F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895457, "uuid": "ed4a85cf-cf73-4858-8592-78046157cee2", "value": "1134c477873f65e93095a249b0d63bdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895457, "uuid": "0f0fa669-5ca3-4878-a6cf-f95f33753f41", "value": "6144:Uu7LIbAgC/o/wJrYR+wrQTZLAOeyVIKrvI48VeudjOsQ4zcZS:Uu4bAgC/rZ0EIKrvI48RosfcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697895457, "uuid": "bb9718b1-7551-430d-a66d-bc8af0c8e978", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697895457, "uuid": "b0515552-35ba-4622-ac17-2ea199358a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697895457, "uuid": "07b1a0e5-32c0-4392-8941-35dd99d1c990", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891ce24b-703e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697912438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697912438, "uuid": "a598e8ca-d8d7-4a25-a63d-1763a3e2697d", "comment": "Malware payload (Formbook)", "value": "8ab3974f4dd041968f06564aaee94dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697912438, "uuid": "ae8d3c62-9c2e-4b38-8841-2f437bc0472a", "comment": "Malware payload (Formbook)", "value": "d8e885dae12354b2d2850361a6d3c64d4faa7da412330eb4c29856dcdef3e88d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697912438, "uuid": "d1b593e3-cbb8-4142-90e5-e54c69cf51f4", "comment": "Malware payload (Formbook)", "value": "9f4e3e559001a752eb72cc32981a303fe75e5f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697912438, "uuid": "8fd1f203-c6cc-4bc9-bd34-75806ad1c08e", "comment": "Malware payload (Formbook)", "value": "7c14d3377024a0be2855d4b82c493364035888b95a8c57149513f14bd854f6e989998b7f01113ebc49e177a2aea028e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697912438, "uuid": "8b2828c1-fb9d-4085-a8b0-ad41c848ac1d", "value": "T17B752347AAE545A3CCB857B0ECF703072A2D7CE18A34E7262799AD052F71BC4A53131E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697912438, "uuid": "babf887b-bc30-49b2-a36c-a08ccccc5d47", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697912438, "uuid": "888d3c8f-a4f2-45ef-89f9-0d12c3bbe26b", "value": "24576:PyO8kBOskUmuIgAw3MuB0I38xbx3JLZplUNuSzjuIM9o3HoPYwWRTKf9YrT:aONBOSbGw3Z1MxlLUQQuINXoPYzKVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697912438, "uuid": "e12fcdc4-5efc-42db-ba79-f7edf7429f70", "value": 1608192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697912438, "uuid": "40ff6c62-2c34-4b1c-9baf-ac177c7be861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697912438, "uuid": "c1e5e937-afa3-4b56-9143-5cef9f5cdf31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a5b5b6-7065-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697929204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929204, "uuid": "46d6329a-bb73-4476-9479-4047c979a48b", "comment": "Malware payload (Mirai)", "value": "33dc62d58a72ef691d6b7b45497bc591", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929204, "uuid": "559cfcaa-1f02-4750-858c-ec583add4d1f", "comment": "Malware payload (Mirai)", "value": "d959dc3aac16c3e51de5c481a0162042e716ed99fb65160b8b834646b03bb759", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929204, "uuid": "5582126c-f025-46c1-8d84-562437c5d822", "comment": "Malware payload (Mirai)", "value": "f63af2564ec681f54f7d43c1ea5bb91934e841b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929204, "uuid": "991b6153-ea28-4cc8-ac35-51eea94b301e", "comment": "Malware payload (Mirai)", "value": "675ea5022860c22abc4ae7eb0af727c98291f4a668d3300c068d7b59eb1c1eae341ec7eae9ee1a37448f3390dd71c9c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929204, "uuid": "36e3d57a-8f4f-408c-95d2-f58b32866764", "value": "T16333027267AD29E151B09773FC33EC1A969C17E89D67309B2CF0691977C58024FF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929204, "uuid": "65fcd7d7-e3f7-484e-bb83-5434b6e507ed", "value": "1536:s9O/ZMAXIxNUk0W60LcPqF1aBexo4opKZb5:s9O/ZNKyK60LGqFUFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697929204, "uuid": "bd9e5308-d718-4467-8db9-6398591764f0", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697929204, "uuid": "10f965dd-548f-4dc2-b238-73f204ceac13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929204, "uuid": "000983cd-d8f3-41c9-bc6a-41cfb94dac07", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503d8868-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906330, "uuid": "875095d7-b167-4152-b970-a73df56b38d3", "comment": "Malware payload", "value": "ea608b0f00e0d16aa2c6f7fef627ff47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906330, "uuid": "0e65b150-2585-4ab9-b7fc-9673dbdf409c", "comment": "Malware payload", "value": "da2ff5f36ba27ad16babb9cad934ed067dc3cf532c38561335da1f064ae7a551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906330, "uuid": "c196bfc1-da25-4bd8-ba73-4d5a8acf1b88", "comment": "Malware payload", "value": "c144a455038d39a205629f8fc3c7c2170ce4ccfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906330, "uuid": "314b13c9-3c63-4256-9bbd-09ecec193e32", "comment": "Malware payload", "value": "17f6ea9c5c80100cad898c9a923b707b06a67360f4d66c3eba1ea4d3beceff81a8cf06c03ccbaa1182418e266dff8f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906330, "uuid": "ad91c64b-f2c1-40ae-af48-006c824dc153", "value": "T12EF12C93EDE1C8B3C559C9BD5D454938F5326A3176E2A2D36FAE5C0DCC252804BBCB12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906330, "uuid": "1a47fc52-f903-4451-8733-501a6d95dc5d", "value": "192:nfxfRq8HebguuREnZXbzNbotbFtZKN8lryo:H3HqsREnZX3Qt02go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906330, "uuid": "0410cf79-a9f0-4594-a538-ad8cc37c0307", "value": 7539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906330, "uuid": "039fe5d1-bf40-4ed0-b8f6-be41f6f51652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906330, "uuid": "c1c6e934-3956-4a16-9d14-a7b219f9aa3c", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.20078.12844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb64ed1-6fb8-11ee-8907-42010a9c0042", "comment": "Malware payload (ConnectBack)", "timestamp": 1697854709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697854709, "uuid": "76692ec9-2802-41b9-ac89-3dc3602dbc4d", "comment": "Malware payload (ConnectBack)", "value": "ca08b146179aa62b3faef34c981c9c9c", "object_relation": "md5", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697854709, "uuid": "88fb6e19-1a12-4e08-adbe-9507a16ac9a7", "comment": "Malware payload (ConnectBack)", "value": "db678619a27ae973082e190a4347ca9222703cb3ff45db627d0fbe1145e2e1b0", "object_relation": "sha256", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697854709, "uuid": "66e0e141-556b-4cf4-8817-c881ec471916", "comment": "Malware payload (ConnectBack)", "value": "12e8463c14313737f7a810a47c803df50f1c244b", "object_relation": "sha1", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697854709, "uuid": "d7f172d0-e0ff-4408-b63b-782642a02f37", "comment": "Malware payload (ConnectBack)", "value": "bec759bc3e118f3061bc4136c9d52cf4a52fe0c9670c8f09ca62be2149e010242e5ed6d195d60768f128bdc9fad9340e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697854709, "uuid": "5649fd7d-4bfa-4d5c-b3f4-fcaa6d7d27a4", "value": "T174D080330F0A40DADED4063F6774595CD77B8D76574962310950DC011C096445F52C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697854709, "uuid": "4df66036-0090-4906-a2cb-803788406a3d", "value": "6:BnX//In8/r1uBxHocmT5eZQ3RQdygg5XJYD:BvwncrAH3mVP532D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697854709, "uuid": "23536e49-0a05-4e44-9c69-b03080228914", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697854709, "uuid": "e5e837b7-74cf-4e55-955c-7ca7ffa7ca4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697854709, "uuid": "05eb4cde-9ab2-4d2b-9cf1-f0c4f79dffc6", "value": "8900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17afe212-703b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697910959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697910959, "uuid": "67e961e8-bef2-4395-8f00-f18c9deefca6", "comment": "Malware payload", "value": "e795b12278ab3bc8367c692a232601f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697910959, "uuid": "369f4b2d-9ccb-4011-a156-5555774b5488", "comment": "Malware payload", "value": "dc75f67978c257aafa02d3b62da80cb125ec301354a99389620a759ab7daf9cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697910959, "uuid": "168b57f9-16e6-4e71-b145-04f8c22d0dd5", "comment": "Malware payload", "value": "3e162259aa68216a1a8aac5b2dd9e15fcffba17b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697910959, "uuid": "77cc2941-b874-4384-b4a1-27ae69db588b", "comment": "Malware payload", "value": "7fdfca573abaf05ff39e531f14ea2a7198cbc7c510930aa12c560b6877478e21a2b9f26f3b73de277cc82a2b40fce764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697910959, "uuid": "29468394-6895-4c75-abb3-5c0ec6c11d41", "value": "T1507523029BF59233C4B1277468F20E472A7ABCD69E1103EE365999C85DB2AD0ED3035F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697910959, "uuid": "394c2cdf-c794-4311-8b33-e2a2c40d4550", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697910959, "uuid": "07a2de1b-8f68-4918-bfa7-45ec674d0eca", "value": "49152:EHOw+4rehkiEWAtganTDg72CP3oTRnNa:Bja9RtZT0iCP3oBNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697910959, "uuid": "3102e3f3-6672-4221-b929-5b40b1eb66cb", "value": 1602048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697910959, "uuid": "800f0933-3244-4f82-9aed-7c9ad94544e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697910959, "uuid": "949e2116-e089-438e-abbf-c8ca0095c129", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc150bf1-7034-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697908255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908255, "uuid": "d2174155-da55-45e3-bf20-6d0beed48304", "comment": "Malware payload (Stealc)", "value": "7d87353402ba5273c31516cd71d49a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908255, "uuid": "6452d65a-c049-47c2-921c-a6c760cd47cb", "comment": "Malware payload (Stealc)", "value": "dc77c54cbac01f61a5abc98d7b8ab3762e41fb05e9ffada26250ed2bd5211af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908255, "uuid": "c47c6f2a-f800-4ab2-aba3-5a131c9e8e11", "comment": "Malware payload (Stealc)", "value": "9614860a8aa8e7723eb23d88559c0e2423a683e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697908255, "uuid": "73966114-35c2-4670-a675-408ab0e41f75", "comment": "Malware payload (Stealc)", "value": "20ac00499ccb984d6648dacb4adc38fd39bd81d226aea447ba8d36a3cce6a8b8583954ef0e0e1c819abe3a0dfe4b85b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908255, "uuid": "67e45674-e925-4a45-8b68-c7e8ab309f33", "value": "T12344C02176A1C832E06729355D30C6965F3BFCB2EA3581CB37943E2EAE706D05B65B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908255, "uuid": "0df1a131-f058-468f-9e0b-5b0baca91d65", "value": "e917b644331755ce8f3ab54716b5cd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908255, "uuid": "1731c9f3-bbfe-4dc0-a687-b13801aa2cd3", "value": "3072:CAyBNpgKlArHISH3h7DFQ53+pLpcg0qD6KzOPyY7hiGGBIKpllzvJ:a4QAroSHRdo3+pLpz6KzXjVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697908255, "uuid": "4df80aa8-2f2b-4a59-acef-e13dba7a87a1", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697908255, "uuid": "72356314-05b5-4076-be49-57d9a01e7406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697908255, "uuid": "07ad695f-76b2-4300-a03d-10af5d682141", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37358736-6fb7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697854319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697854319, "uuid": "edce52bc-9682-4317-9405-8e4273ed55e6", "comment": "Malware payload", "value": "085b9aedbf1dfcb5ab356b1026e727e6", "object_relation": "md5", "Tag": [ { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "SharpHafnium", "colour": "#5EAADD", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697854319, "uuid": "98fd1eec-4a48-44d9-ac8a-cc86b024e6f4", "comment": "Malware payload", "value": "dd39c64eae91e0b4cefac8a2ed66f5ca8bf6a0445830253d1325fab4d5c820c1", "object_relation": "sha256", "Tag": [ { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "SharpHafnium", "colour": "#5EAADD", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697854319, "uuid": "92397d69-5d39-4ac6-a6ba-96f4a4082aaf", "comment": "Malware payload", "value": "5536a482ac3d71c903c3fc08d45779d3ac7587e6", "object_relation": "sha1", "Tag": [ { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "SharpHafnium", "colour": "#5EAADD", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697854319, "uuid": "d1b96ef9-d039-49b0-a939-26b9b21b2247", "comment": "Malware payload", "value": "7568776e078554df3675ee49d718b750c2b5d7d321985c5a06b73435c4d1eac9898d11d2ed13555b7fba9df9b4077f53", "object_relation": "sha3-384", "Tag": [ { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "SharpHafnium", "colour": "#5EAADD", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697854319, "uuid": "e6edc924-7dff-4fab-be7c-754ec440fcc9", "value": "T1286319C91298EFFBC36765AAD7F1D6298E1102608F340CB1E7DE811F958582B4632F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697854319, "uuid": "34df7cf7-0430-4725-846c-7da2591b5ba7", "value": "1536:YYZzFuOVGBpVVagmXf0oqyhuy1zSzD5bbQMJwejxzAn:RvVGBprvmXf0oqyh8pjlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697854319, "uuid": "9bc4d3eb-02af-4986-9c87-7384afa5cd13", "value": 72385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697854319, "uuid": "979c8ae5-d1d2-4ef4-8eea-e0535858ddae", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697854319, "uuid": "76f0ea2e-1abb-4d6f-bdc6-c0b314059c5f", "value": "085b9aedbf1dfcb5ab356b1026e727e6.aspx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee9cb0f-704c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697918541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697918541, "uuid": "6f9c1f6e-2860-4ce8-b93b-5b83c65f4cd3", "comment": "Malware payload", "value": "38b99e22ab88aa5243496a1c5e564022", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697918541, "uuid": "5c7f276b-ce3a-41c3-ae21-447d1f083964", "comment": "Malware payload", "value": "dea1a541d370799777391cfb2cf661e96390bfc98308b4b83f14acfddee4c75b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697918541, "uuid": "24cc82a3-d3ed-4bc4-98d6-e12befeac184", "comment": "Malware payload", "value": "9d756748bfdb7d0920944cdb7c9f94e2a046e2e8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697918541, "uuid": "e008f7e5-6239-4e2d-87c3-144bceff3dfd", "comment": "Malware payload", "value": "8fde6eef0adefeb46b72c82cd8e8fcf4115c01097df5fa166bc6815717102f74a422750bba13f91f9942579d334570b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697918541, "uuid": "83897919-e63d-49a1-9c68-5f880f609a75", "value": "T11714136F15057BF687B84D21B8C893B84C47D4EFBE095E4F02C76AAD5A4D007A61F2B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697918541, "uuid": "0c3f4bba-39f7-41dd-b7ca-098241c6f2eb", "value": "6144:PeOgCY9ZkR2tdG6qklH+tTtB5oYuleEXuZ:PeOgCY9+2uJtTt0lNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697918541, "uuid": "64957626-e19f-4334-9385-28bb6a0a77f2", "value": 207931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697918541, "uuid": "46bfc974-f3f3-4d07-8f31-d115ed9f5221", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697918541, "uuid": "51d12af9-e6db-461b-b839-b7dab6b4fc3e", "value": "10c13e76c6e55ab26691f6f8517d9b1541506ed88d56aaf1b48930c4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b4895b-7008-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697889055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697889055, "uuid": "ea679d13-b507-4cf1-8fef-ad308c534f17", "comment": "Malware payload (Amadey)", "value": "a8fe52a06ea4fb8e8bfc2731543e423f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697889055, "uuid": "22b6b524-17ea-44ca-840f-c3e10407933f", "comment": "Malware payload (Amadey)", "value": "df6bbaa979807509106e5ac65ac4629bd1319c1162e12050f814e4d250bcfa8c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697889055, "uuid": "d0addcf4-030f-40f9-b29c-3963feaf9aec", "comment": "Malware payload (Amadey)", "value": "6d9b9dc6566d5971682bfad03e66b4fa712b1bf5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697889055, "uuid": "c0f808e4-526b-477a-ab45-767ab1137651", "comment": "Malware payload (Amadey)", "value": "de8b7c3e57b39790fa8662cf410d2172b0a43fcc703e5cd6bba445e59cb8cf1b517bd0e831774786a1977792fea9a25e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697889055, "uuid": "8f19f0f3-96ff-4c5e-9dec-0436d8a20796", "value": "T1F6452397A7E92425C9B427B414B603E30B347CF0D83DD75B2796B48D0A339D4E8B632A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697889055, "uuid": "efb11cd1-bdee-47d3-b514-e5a1b3e9c763", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697889055, "uuid": "9c96c4db-d0b7-4a11-97d6-214bee99f9eb", "value": "24576:WyVexYMCz3RXA4vkgiK+9PPat2/JhqnBzZtVgk66BzckIsXIRu6f6JkYc7:lVFFdZMgiKYPPat2/bqnpZAmzrIsYRNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697889055, "uuid": "ed742629-6a1c-4024-849e-6eee22dc49f7", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697889055, "uuid": "1f0a7df2-dcf8-42ea-ab85-7befb84d32ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697889055, "uuid": "29f3954d-77ae-461c-9db3-5978aec247d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfa7697-701d-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697898056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898056, "uuid": "add9349c-d7fd-4417-ae92-c64e16f097d1", "comment": "Malware payload (Stealc)", "value": "0b88c32dc722b815d813e478a74fb587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898056, "uuid": "5e5c5d01-5789-4458-b570-9790e1a7fcb4", "comment": "Malware payload (Stealc)", "value": "e001f23726cc6fcc38a9866482764774f7345c122c944db82eca7a7894c8fdba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898056, "uuid": "48fe456c-b092-4d86-9d01-ae3e7541ae40", "comment": "Malware payload (Stealc)", "value": "f1f5585a63762cfc82b4d8a277347162356dd33c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898056, "uuid": "6bd995ba-b59e-4625-a84a-e770b94bb865", "comment": "Malware payload (Stealc)", "value": "dd8545a016119a828e9c43d4cb6878d43f3922008f221d2d2c81797db1eb9ce05e66d09534b8122dfb3203fac568f7e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898056, "uuid": "bf1913c3-a82a-4623-93c8-1b908de585ee", "value": "T10D44CF11B7A0C836E47219365870C6961E7AFCF3AA6081CB33943E3E9E716D15B66F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898056, "uuid": "a5b4649c-6a35-45aa-9de4-62a18c75549c", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898056, "uuid": "2dda976f-b763-4e32-96ac-7a0c01788e9e", "value": "3072:RyBNbIxAwzq5p35iLKGPmZfyJK892hSmlknmX8eBuTKB9J:MlGAw25ppieGPGf2K8khSmLtzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697898056, "uuid": "6729f81d-5b7e-44ec-95a6-150a6b48beb9", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697898056, "uuid": "f6c7cf27-afdc-44a4-8430-f348ecfb90d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898056, "uuid": "c2272abc-dc89-4e52-8070-2874ff0e5040", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbf9b2a-6fc9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697862279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862279, "uuid": "ec8a4d9a-25b4-4a7a-91e8-66ea14115339", "comment": "Malware payload (Mirai)", "value": "96400cd200bf538fb4765c72c524db0f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862279, "uuid": "eaec37b8-5b80-4041-ad9f-3fb968fa4275", "comment": "Malware payload (Mirai)", "value": "e0afa1930301ee30fc8b7d7d704fcf4490f9cab5c98cbfed6d813f038b6b0466", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862279, "uuid": "35fc096f-b89f-4926-8412-9ccd98c17100", "comment": "Malware payload (Mirai)", "value": "736c261b18d06fb49b0444bef99ff2b4ffae736e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862279, "uuid": "436d7343-ebe0-4ef1-a857-f56c735963b0", "comment": "Malware payload (Mirai)", "value": "09f11f1e26e9ec4cd334a31cf43ab7bacef09ab1f6c9d42e4ec1e1213e128e16460c43b2b6b201fea5bc948dc78e4dd5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862279, "uuid": "da1e1d53-0610-4696-b089-e8ee5738a6b6", "value": "T134E30A56F8819B12D5C111BAFE1E124E37131B7CE2DE7202AD246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862279, "uuid": "99bc49d1-40fc-4c9f-9efd-704d2db84869", "value": "3072:ZUIK7PuUPMNrbAXx0Kfw0aHI5yjwDCO32ZRpk:ZUrqUuAX2KfFa8nH32ZRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697862279, "uuid": "92f7fd64-c9ce-4ac5-9df9-bd3361bd7795", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697862279, "uuid": "8865cde5-135e-4301-9b43-bd050c92365d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862279, "uuid": "e5f147fe-5653-42ca-aacf-384ed08c84ca", "value": "bot.arm6-20231021-0424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c866db0d-6fe8-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697875608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875608, "uuid": "c276199c-9975-4524-9b5f-aff5bdd52798", "comment": "Malware payload (Smoke Loader)", "value": "e5d080f387067d97192be6e62233a28c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875608, "uuid": "a305b2e3-fba8-41fa-8863-7691066a37df", "comment": "Malware payload (Smoke Loader)", "value": "e1b7b5b2dd672e8a64a7ab4dfccc0b2396850c6c32233ae364e752ca833c9273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875608, "uuid": "895ccecb-3f26-45e6-a026-ae4337fe6cf2", "comment": "Malware payload (Smoke Loader)", "value": "07aeab0fff1c9f7449153ff63c8e01801ac10695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697875608, "uuid": "0763b6aa-a9fc-4080-9607-747f85a4084a", "comment": "Malware payload (Smoke Loader)", "value": "7832a8d45b6e8dc311f3b8d778cbe90a5b46279edee171685a544988639c958d631674f067be782ef009e614649ac60a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697875608, "uuid": "cda43603-ce10-4132-a900-16c013ca91d9", "value": "T1D465234752D55032E9F537705CF702C2093EBC945DB892AF2296B4990EB3A80F2B67E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697875608, "uuid": "ae93f254-24e5-4a59-8581-ad1978f9b19c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697875608, "uuid": "e23622e9-7e43-47ed-9395-23e4239a1c42", "value": "24576:lyMFmt98TUFrQQZyaEJNEQQjhfQAd3T03wrQjQAnDyH2KnQZ3ivDWPyNH:Az7zFr7ZJEJNEQQh3tT03wrQjPnDyHFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697875608, "uuid": "4e953667-1177-4ebd-9827-793b10b9b827", "value": 1515008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697875608, "uuid": "6e0dd357-44e9-48a6-8522-164ab53ace8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697875608, "uuid": "ca7dd72f-1d54-42a1-a57a-19dbea112c78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cedc52e-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906324, "uuid": "d98c3057-7310-4f49-b507-81415540c5d8", "comment": "Malware payload", "value": "6fad9128dcad908eb5d1900a30bce0ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906324, "uuid": "a94f9790-d97f-4534-acae-d8a6c829d782", "comment": "Malware payload", "value": "e3114192d93850cfcb2b2344da6b5dd4569a7a865fa4e038594b603f4de3cc92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906324, "uuid": "6fcdc6ec-1d83-49ee-bff6-dd7545933dd1", "comment": "Malware payload", "value": "c47394f116a8d16a5e0a1ef364a7ddd6beacca5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906324, "uuid": "d557c0f6-d14c-40f6-a302-24796b859023", "comment": "Malware payload", "value": "4e6ccfb76a1e057cbcaeaffb91bc5a43caead80e9fde08f6e04d31067b87b00f89b6211d575bd43eb6b70470ab125a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906324, "uuid": "afd0741e-c903-4b2e-b192-a458b0b86a4e", "value": "T1C055AD27F5934492E2411670198753356FF4EE890B3ADFD36168FEBA1F731806B3A2A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906324, "uuid": "b2496122-85bc-480a-be5e-55c57a1f8cd2", "value": "24576:8TvnIteqmZQ3VLtzzwY3JzIQUfBWU2G3:8M6WVRwYZzd82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906324, "uuid": "19fa5aac-f515-4f33-b231-1a6562a76895", "value": 1384448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906324, "uuid": "5a6b6d9e-5024-42ce-93d4-032e179a71cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906324, "uuid": "2d0c01a0-1e11-44f0-884f-6c25eaa44d1b", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1S437JY.12495.29252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967d7448-7018-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1697896140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697896140, "uuid": "8392d304-d160-465c-b5ed-39b9b790d360", "comment": "Malware payload (Tofsee)", "value": "f1e58d64b14cd0780d8a9f6a18818f1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697896140, "uuid": "9938eef1-a646-4bbc-bf44-47903b583b5d", "comment": "Malware payload (Tofsee)", "value": "e4cb9f1a53b2c5674a81c402c96e5892e0bee2bbba56053c92be4c85e66e353b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697896140, "uuid": "cca75bc3-4db6-42e2-8c50-de9531bf838d", "comment": "Malware payload (Tofsee)", "value": "a7dd46ec3bef91ca1331f6a110549f542625f70d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697896140, "uuid": "c623fd7e-406d-40f8-bcb9-7515983f9c39", "comment": "Malware payload (Tofsee)", "value": "1a52c1d7d4175abedadd041abe3c2f1ffe8fa7965f16b9e433448ac7804b60b46f486db603b63d7a2e0fb881029d928f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697896140, "uuid": "2cbc9e6f-8900-448f-b0d7-1606ae3ab8c7", "value": "T1DF44CF11B791C436E56729351870C6A61F7ABCE2AA6181CB33983F7E9D723C19B25F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697896140, "uuid": "cf871139-74fc-42b9-a7b4-3e35c0ff13c9", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697896140, "uuid": "b4eee912-3888-45cf-a45c-fba380ffcaca", "value": "3072:syBN2IxAfzi5F3AAOUcekXJ1XSDhixgdoTtmc2QKv+D:vgGAfu5FwJUKJM9ixgdoH62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697896140, "uuid": "cca298b7-ebe4-435c-a329-26390aa062ec", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697896140, "uuid": "df5cc37c-bfe2-4d18-b885-4313af43e6cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697896140, "uuid": "452e1d4a-14bd-4315-b9a3-a2edcd0b904f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f018984c-6fb3-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697852911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852911, "uuid": "897733f9-0ff3-4dbd-9397-d25ce4da6ac8", "comment": "Malware payload (LummaStealer)", "value": "3882b15b6f2bfac1b4ddb747ac27c8ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852911, "uuid": "23868eb4-2f90-46ea-b6a9-ea350103ec3b", "comment": "Malware payload (LummaStealer)", "value": "e4cf1cb71a41a7805bdeda515d01fb9db491316f02956a96300210dffa001893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852911, "uuid": "8c0a7cc6-0e2e-47a5-a8b9-87ef5d32d323", "comment": "Malware payload (LummaStealer)", "value": "4f2034554fd668dbc5d5164e822d85a17474a954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697852911, "uuid": "3fd17920-b103-44ba-92a5-842b9f5ceeef", "comment": "Malware payload (LummaStealer)", "value": "bf198e2e9a2d93e97db57b38683b453319f481e10b086b927beb8a6c771c6eed17c63b9a9e24eb5fff23f0e762808e56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852911, "uuid": "1d8d405d-3a48-4332-b826-608c071e51b4", "value": "T1D4B3380176C1C161E2641839ECA5EEA04D7DFCF84E2F5977BBA4076E0EB01C0B6E59A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852911, "uuid": "d4df66cd-2ced-4cc5-8679-5f8ca875e9ca", "value": "ef3e00221deafc51d5fb98ac8666ebc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852911, "uuid": "0dd5cd28-b847-41eb-a2c3-5bdb0ab23c07", "value": "3072:W4/rsLds7vRy+kjtxkYEwi9yeXb7vB0Y7+xhC1Hl6lQJx/0lh/aaW91aRKMATWp7:WUyeLebxhFw/0v/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697852911, "uuid": "64c6eb1d-f896-436d-8dcd-517e92d18fbc", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697852911, "uuid": "b73a505b-f59a-4ab8-baad-feb10ab14aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697852911, "uuid": "7d1c6c8f-6019-4cf7-8929-6ed8e2dbfd9b", "value": "e7d3372066f8806d14a6d0f5ce72d5f62c9b9d5baee5630aad73d144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512a1024-7030-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697906331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906331, "uuid": "912000eb-1428-4383-ab5e-0a8959254bf6", "comment": "Malware payload", "value": "4efb462004ac8c9fa3b78f2746797e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906331, "uuid": "567fde5f-4f8a-4938-9897-16b065c3bcc5", "comment": "Malware payload", "value": "e581dffd7a1ef501451e91075e113bf859e72a5f572b48befb8e288275a523ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906331, "uuid": "30eb1f59-96f2-4dc9-90f5-efe6dc706439", "comment": "Malware payload", "value": "e2c7e1fb19c5bef76c082516fb122f936f2db378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906331, "uuid": "9b7061ae-5fcd-4e1f-9c93-8f0bec599ac0", "comment": "Malware payload", "value": "84f4669834dafadcbf23401aa52632c65d060a3bd215ece39126f9c012f2a07de4f6ec15a124dc9d731dfae9168c900a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906331, "uuid": "ab3a2b3c-b562-4724-9b4f-4f4442a4c564", "value": "T19C058E11F5C3C0F6D729153005AA3736EAB59A560B24AFCB9364EE7D1E321819E3732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906331, "uuid": "e5aa2a2d-f46c-4c78-943c-d57ca74d1f9c", "value": "54f5f2cb11b5ef33874fe1d6acd08068", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906331, "uuid": "7cbafcb3-7d9c-4594-8bac-e43dbeedeada", "value": "12288:NDmVliCNbZD5aDE6Fl437gOWmkG96oi8jVArPeDiI:Ni3cQ674kORN96H8jVrGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906331, "uuid": "df5f0794-ca82-4f72-816f-6a2b6ef30897", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906331, "uuid": "db41a44e-f9b5-4758-9b9a-9e7c48833251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906331, "uuid": "9e103a65-607d-4ad5-90a8-a74cc317603c", "value": "SecuriteInfo.com.Win32.MalwareX-gen.542.31232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b83154-7023-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697900994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900994, "uuid": "ebe3950c-deea-4476-b6de-cb0d2835ecbf", "comment": "Malware payload", "value": "555952e4e7aeefe2c5fe2d0abd62eca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900994, "uuid": "a5612f54-9d8a-4d9d-a26e-85b95391690f", "comment": "Malware payload", "value": "e5a1cc6dffb54249e0f4c87b81bcf401f95218743709e3600861e85ac300696b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900994, "uuid": "fd547de4-b797-460f-88bb-d757670af86d", "comment": "Malware payload", "value": "4a02863bb288cf3a9a75d6113d3555bd9b753f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697900994, "uuid": "8bd2d218-3c65-44d3-ae96-1a79127eb9ee", "comment": "Malware payload", "value": "fc92a23c7002335109c8f70036aee6a8090d01f62181de8a098c9988febd69ba6133017b609b7edc94bb6b4cc02965bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900994, "uuid": "cee5c918-fa0a-4a4d-a69b-9e768ee59afc", "value": "T1FFD4B40177F98226F1F36B70DEF54255AA37BC919A35C28F120066CE2971A81DAB3737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900994, "uuid": "d061ea8c-7573-4158-83a7-40e6122fe74f", "value": "ae30e7bff465b34645e413bf3c20e58d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900994, "uuid": "7d3c36f7-07b4-4436-803e-77fedeaccced", "value": "6144:XpShgYcx22HYpDW1Y5VQzSprPW2CVEvOckO:QSYm22HWC1dzSqVEvCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697900994, "uuid": "3f3ebb16-78d8-4a70-98c2-9462dfbda263", "value": 624512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697900994, "uuid": "4caa8384-c37a-45e8-8d40-38d670105c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697900994, "uuid": "f5598d17-1de3-4044-b7cb-86b06edec2cb", "value": "28cbfdd79bb6b413b4cd290cf7a1402fc854515bd506ee80c814a498.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8ef385-6fd4-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697866949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697866949, "uuid": "c575483f-928b-4eef-b862-65ae91f90351", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3b67243cada8d68e902941f0ef55a26d", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697866949, "uuid": "8ed40d6c-7450-485d-9926-715ad4e11985", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e7c81b5ba0cbf288bfbe3a24dcf8be9dfac0a4f2f69dda1d66111fedbffe6add", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697866949, "uuid": "d2ce18b6-621d-4a24-99a0-ef72b289ca66", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4714c6b400d56310493adb0b9504ba076aa1d95c", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697866949, "uuid": "f63cef5d-77a9-43b1-bbed-b960daa10ab7", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "530d63f848bb8abe8423462e12993cd0a905754ea4d053f6be01a0506624ff2df1176aa7c67b775242448948dc6bda80", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697866949, "uuid": "29885558-ad19-455f-86eb-f31ef6eacc89", "value": "T12765231A97D59123DDF427B049FA03830FBA7CA625B49B993312B8CC0DB21C5A27577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697866949, "uuid": "8d388696-0142-4e87-b2a1-92e2fff38787", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697866949, "uuid": "d8283085-023b-49a7-b438-d2acde30107c", "value": "24576:Wy/VFb2xW07lcfmgYj3Kx5Lq32Z9iPWREBxf5fC9rljanDo/pLGFEPE:l9R2xr7WfmgY3+LqpWRo1C9ReD6LGmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697866949, "uuid": "cc6933ee-03e6-42a9-aaa1-9180d88c9b1d", "value": 1514496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697866949, "uuid": "0caeeb9c-8b4b-401d-af52-f4f274248fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697866949, "uuid": "3b55980e-4797-4886-8af1-e94954b9aca6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d581c3e3-701e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697898822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898822, "uuid": "986aae9d-bf6e-4683-a174-bd5c46386ed7", "comment": "Malware payload (RedLineStealer)", "value": "f33f01bc62fbba598c77e416ae1e9793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898822, "uuid": "b2fbde7d-017b-40a0-8088-bff66e2776fd", "comment": "Malware payload (RedLineStealer)", "value": "ebdf1ba0807f3f5053830d8c3cf663cfd0d4c01b30c7b3bb01169f4a89d6a7b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898822, "uuid": "dded6f2e-c150-45a8-9990-0dadfe8d0aed", "comment": "Malware payload (RedLineStealer)", "value": "d475d966bf13d51e4d08925655810b5550da839b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697898822, "uuid": "198111ae-de88-4127-a3bf-143885e7fbc2", "comment": "Malware payload (RedLineStealer)", "value": "7e3ab688831e05574feb5f0680f23e00a64a0f6520a30e37e9c53af35fa852ebe782318f9a4f475d15f6b1d225a84803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898822, "uuid": "3f016b5f-fa00-41b9-96e6-f1ef2da375f4", "value": "T1E9B45A51B0094F2AE3F2087CEACA5DAE4D507EED6F530B8F36C14B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898822, "uuid": "fa5fb9f2-7e10-4f88-8710-be561b860512", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898822, "uuid": "d0889dbb-5b15-4753-ae2e-9fffc723321c", "value": "12288:K8+t0zQQB2o97Hr62k3n/+pLsv9+eXUeF6y1L:o0zQQkAr62k3n/+pAv+erL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697898822, "uuid": "b911b15c-c5f9-45b0-8e90-81d0ae057515", "value": 507976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697898822, "uuid": "6f829447-6e34-413e-975c-b3065604d21d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697898822, "uuid": "fddfb3e2-d593-467e-b46c-2c8e5a72dd4a", "value": "SecuriteInfo.com.Win32.PWSX-gen.14603.16088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53d5e44-7006-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697888460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888460, "uuid": "3185ff6f-5400-4ed6-9654-3151a314ec6d", "comment": "Malware payload (AgentTesla)", "value": "a5e2855d36d6ce0be8ca37e320b9fc5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888460, "uuid": "2a60691f-749e-4ed6-9ad9-6bd7ed8687bf", "comment": "Malware payload (AgentTesla)", "value": "ec3c5f87dd51127d36272f399759f9e7493a81e37844827b4b1a99685f8340e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888460, "uuid": "8c3bcbfd-f894-410d-a114-cddaa44f3ec2", "comment": "Malware payload (AgentTesla)", "value": "f245322d30a9940e8cd90eb6c9a62970a0163223", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697888460, "uuid": "06af4e38-30af-4be5-9c78-c2d12269545a", "comment": "Malware payload (AgentTesla)", "value": "a99afddc7bd1f7393a5872c8081d5a70e7592cbc5c8fb24c5cf7650e04b2fdf4df51a07eb40fc20766c7ba26ddf97a88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888460, "uuid": "d0bc2970-793c-4a15-847d-8e613c8b1a7a", "value": "T1EDE423633A14CBFBC56C19FB0454F4C42BF06D31260CE3ED2E90F1DAA1D2B926A65667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888460, "uuid": "895eae46-5376-46c7-b928-38fe10a2e087", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888460, "uuid": "dd62d7c0-aa7e-43c2-b0ad-fddf3951d694", "value": "12288:l5b5yzvbYmBH/NBNfkhOp84xsyVjurAgNexeSlZyMg1WgoJUdaJX5dznbeEP:JebY0fNBNfkQp8rSiU4OgoJUM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697888460, "uuid": "e6afbd27-5e59-49fe-8417-ed3948e4f155", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697888460, "uuid": "72ecb1d2-d4e4-4764-852d-c980953be14b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697888460, "uuid": "dda98bb8-5e8e-41af-bdad-72c751397bee", "value": "IHFa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81aad68e-7029-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697903406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903406, "uuid": "1e4cfe89-272f-42c7-91ed-cf8439518651", "comment": "Malware payload", "value": "fcda7ef35685898c48d21a35919cd255", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903406, "uuid": "9d4f2ce0-6730-474c-a3a0-8cda56f49daf", "comment": "Malware payload", "value": "eeddc6fc207c2dd3d54735c2cd4a5467fa104ed5d6a4c2888da67c6d50a8ff8a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903406, "uuid": "3998d480-d954-4950-8723-fdadec141efb", "comment": "Malware payload", "value": "c8e3990a5d3f0b9fbac9f32cfa7b8cccd9294e3a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697903406, "uuid": "17e36751-1c0c-40c1-bfe5-21a3f51171c4", "comment": "Malware payload", "value": "5d98b385dcebde26c7d762aa9dde1e5681f761cc7fdf5eb55c893e7c66a790a4fcc4fbc815cfc086a80992cb9ed170d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903406, "uuid": "9df3d972-8fc2-43a4-b631-758f71b83f63", "value": "T1D8936BC5F783D0F6E95205B1517BA7329733E43AA02AEB42C329AD36DC52910DA1F76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903406, "uuid": "f5e618ef-c157-4414-9bfd-c2d4e15f1ed7", "value": "1536:7FC5g7zNYl+YOyiqwT7h+gkHYxWhgfGSdRXX9:7FCCNYldDx678gjxb/dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697903406, "uuid": "9804c5e8-1b2f-4cb7-8cf3-7255340b85b9", "value": 92108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697903406, "uuid": "59e33e83-2e62-4428-b1df-147e4feb972b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697903406, "uuid": "0867799b-f12e-4bb6-9f43-48a1f58dd3d8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557d847f-7040-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697913210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913210, "uuid": "d3b4b2ed-231f-44e7-af57-ad30032d679d", "comment": "Malware payload (RedLineStealer)", "value": "1e30d69993c7788ef94fff3de9d32542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913210, "uuid": "c8b0c4d7-2109-4a6e-95c3-e0640c170655", "comment": "Malware payload (RedLineStealer)", "value": "eee7d05a5e19ec44e398b9446808d00350e4527d95dfc4bb3e18ae78e0e310a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913210, "uuid": "1c103848-eac5-4565-8af1-5d0e96f5bbe6", "comment": "Malware payload (RedLineStealer)", "value": "5281db7edf6c1bc174ef67c0c1fa99faaf48bdae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697913210, "uuid": "a26e3f57-f9e9-4406-901b-5144c8e1d32c", "comment": "Malware payload (RedLineStealer)", "value": "ad3e2d6dce1a1ad6d958186b1e8baa360c6719a3513dda2b8f4bcdda7d1bf20ea51696d046aabbfb10bdcbcea781caa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913210, "uuid": "2dda9858-98ad-4b75-841d-4750ee99511b", "value": "T171752387EAF86232C4B89FB05CFE46871A767CA1597053671A48B65E5EB1A40303373F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913210, "uuid": "4021d299-acf7-4838-9e17-d9de0c45006b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913210, "uuid": "9bcdf951-0039-46b3-b688-199babbceeb8", "value": "24576:kyutBO2h4IiFt40WQJsZYg3Bo/Yy3pouidbdysdUROGbxbM0FW9V+f2:zutBO1IqMQKZYi20byGGBPqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697913210, "uuid": "569b08d0-e5f3-42fa-b15a-3310272c4afe", "value": 1603072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697913210, "uuid": "f6439967-9432-4111-9ad6-ab4d8b940593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697913210, "uuid": "c9148093-d0c4-4632-884b-0a81ebb16bda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fb19f7-7063-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697928323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697928323, "uuid": "c1f4f7e5-ab2b-4cde-81db-96ecb5234d4a", "comment": "Malware payload", "value": "f6b0ccf0029bcd4ad27952f7a060e235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697928323, "uuid": "4a9904f5-3e30-470d-b32b-6893aa56d7cf", "comment": "Malware payload", "value": "efd9bd12d3c988e85154452e4958bffcf2800e9333e56647d6f1c13faff8627a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697928323, "uuid": "b6827172-61e4-43f1-a8ff-bf0f44325669", "comment": "Malware payload", "value": "165ff67bdd05a598e2910fc5eb2a8d1fd7f93459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697928323, "uuid": "66172f15-4786-4970-86d0-67676bf8e32d", "comment": "Malware payload", "value": "b6f81da0d136b898810cc6198c242f456667a48fb84648c285359d617b7fe3a12c5d373d553bc3b5ebca445cac5133ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697928323, "uuid": "d1736d87-dbe3-453d-abfa-4c9414b6cfcf", "value": "T19D652343D8F466B3E9B627B00CF657530B38BCB259B45342378C9A5E49B3228D0B576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697928323, "uuid": "1de2397e-1758-4873-950f-eaddbeb240fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697928323, "uuid": "32afe733-1de5-4fbf-b927-f018c272fdb8", "value": "24576:nySUXxOPMpjc7gBqfOACNmswyi+YS5z6eCCnI9QKR0by5I7yGYv0a0LU7AECOo3Z:ySSOPK4sBfpNHwyD56eCCnwQKubexGHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697928323, "uuid": "53600136-430d-4f4a-be67-2432da0410e1", "value": 1482240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697928323, "uuid": "5f45c850-7e96-49a1-9ffc-85ea42265764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697928323, "uuid": "9376556b-8d65-4791-b85e-720336b8036f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2981e6-7030-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697906326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906326, "uuid": "9e43d237-a053-410b-ac71-8f13bd66b690", "comment": "Malware payload (RedLineStealer)", "value": "fd44ef579f043b7834514c5978f93e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906326, "uuid": "307ae699-9f11-44b5-98d9-2cb6e6edf2a4", "comment": "Malware payload (RedLineStealer)", "value": "f15baee0f06e5af8b5895b57578c1c15649d95ade9e80d6a06c0ebdc57159e59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906326, "uuid": "acb72fc9-f14b-44ba-b2d4-da1edf539409", "comment": "Malware payload (RedLineStealer)", "value": "6f35184b825c03945d485a2cd9d69eb117ab181f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906326, "uuid": "7a4ac1c2-0641-4196-8571-a06d61537d1f", "comment": "Malware payload (RedLineStealer)", "value": "7c5ac023988d0a413bb35f305f97c05bfb0decc514b82dd298aa0167646298d9246d6a71129879835fe106858c1eecfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906326, "uuid": "8fcd7ebd-7a19-4429-ac3f-38b592957c69", "value": "T166B46A51B0094F2AE3F2087CEACA5DAE4D507EED6F530B8F36C14B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906326, "uuid": "ee370bf7-290b-4cb7-9f1f-41536eb09ad0", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906326, "uuid": "13e48f30-519c-4dcf-90a9-9b5a9f39cbb3", "value": "12288:J8k8MroQB2o97Hr62k3n/+pLsv9+eXUeF6e1L:KMroQkAr62k3n/+pAv+enL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906326, "uuid": "d0b0f7ff-f93f-449f-9ccc-3970be27db8d", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906326, "uuid": "911ebb01-a34f-4109-a818-f06268366987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906326, "uuid": "44471603-5f73-46a5-80c7-f06ae23f9385", "value": "SecuriteInfo.com.Win32.PWSX-gen.22180.27870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83803329-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697884511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884511, "uuid": "ad336ac7-6ee9-4ac2-8fd1-11e29fd71dc7", "comment": "Malware payload (Amadey)", "value": "17a676d191267171991da0b1bc1c5146", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884511, "uuid": "60ade69b-c8a6-4d7c-bd84-fad31bdbdc99", "comment": "Malware payload (Amadey)", "value": "f44e1ba7d3d81a75cb6f20877e056ad6b62b86e0c0006f47484b61e42b82ddce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884511, "uuid": "0bb0f652-72c4-4d9c-850c-bbab24a640fa", "comment": "Malware payload (Amadey)", "value": "92ac5d379fac8dcf59637c138219bdb916b6670a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884511, "uuid": "a2ca3c6d-f5a0-4621-9156-65842b7511e6", "comment": "Malware payload (Amadey)", "value": "e5fba7bf114b8b363d4799eb4c98f4cd52b8c15956f5751ed3403768eb39bb46068191593680121f22287281822483e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884511, "uuid": "fb474f7c-73ef-4bbb-a286-de115a223a67", "value": "T1D9752342E7D89076FCF627701CF60A930E327C71A9BC879B27A386466EB2154D472367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884511, "uuid": "20651a75-4819-47fd-a9d6-1dd6c0b70e2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884511, "uuid": "c5f482b5-32a6-4833-a625-5e26fb92de94", "value": "24576:hyxX+ANyvgUNFPkBAW6ribVOSFLgp8wkB/dArETjvj70ph0/76ZiUGgNmV4CK:UR1yvNYAWKClFLgcVAITjvj70ph02WgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884511, "uuid": "c532a10d-6b7e-4a83-a373-57d48aa53014", "value": 1555968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884511, "uuid": "dd7ff147-1740-408e-b7a3-e29e0bd3fb89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884511, "uuid": "5319828b-a1e0-47b9-9157-65333e54c653", "value": "17a676d191267171991da0b1bc1c5146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680ad0cc-7055-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697922261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922261, "uuid": "6305fb18-a43b-4a22-b0b1-d892060f109d", "comment": "Malware payload", "value": "e509fa74e4f0ffc76e4e41d5a539b8e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922261, "uuid": "472e1915-22dc-431d-b342-ee0a9788a3be", "comment": "Malware payload", "value": "f47465fb6f9d7c9b0ad483edab476326e1a08b6333a66da6229e6296478c7f2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922261, "uuid": "b83d24f5-8576-473f-9883-04037390a2fd", "comment": "Malware payload", "value": "b72b5009e570787b58348132aa9634121666d885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922261, "uuid": "705b0a2a-d65d-48fe-af79-3cfbf43a1998", "comment": "Malware payload", "value": "e9e88f23fa92966d91fc682a62761736924b56a9be1ff7f01eedb5fd1e562d073c955862aea53a78a40fa540fe2f0c3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922261, "uuid": "6fd8e063-58eb-416a-a46c-f1b7335fc18e", "value": "T13544CF2272A0C832E56759350970C6A61A7BFCF2AA3581CB37983E3E9D712D15F65F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922261, "uuid": "67b5c9f4-864c-409f-a4c0-cfe5963f2693", "value": "e917b644331755ce8f3ab54716b5cd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922261, "uuid": "a0db4783-1e78-477f-a9d2-245d0f7dc4cf", "value": "3072:cyBNZnlADMHc6w3sXCNqihnb6yoLBHuhGUmbEKM8d4J:/PlAQ86w8ygidfgN17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697922261, "uuid": "877120ea-7dde-4811-b542-22e7e17c52b4", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697922261, "uuid": "3e55e0ff-7de0-46c5-831d-ba29d17bc183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922261, "uuid": "1a0267da-0c82-4922-a39b-0b14c753cb37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa26f75-702f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697906025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906025, "uuid": "0e3de30a-fca4-42e9-aeba-1f67dd92ce06", "comment": "Malware payload (Mirai)", "value": "e311114a8e7688eca6ab1b924c13bdbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906025, "uuid": "e144055c-de3f-4f02-9363-b0597f4cdb4f", "comment": "Malware payload (Mirai)", "value": "f678e448cc031b7a7ac534e1e50b627ab3f6ae11f83f5c603ca2844d1c735b79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906025, "uuid": "d643600d-ab72-4cdc-9cfd-4e80aa065b6a", "comment": "Malware payload (Mirai)", "value": "ec591d868907cc9c5f4e65e74a82ce3a3171e3b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697906025, "uuid": "b71774e8-ed3f-4326-a58b-1c4da872bc1d", "comment": "Malware payload (Mirai)", "value": "2aee7a032cd367a5e01798f609b344dde4bd699b105a9dfcf21bbcfab20bbcbd56527a355816238b916b404addacdb91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906025, "uuid": "faed1118-1659-4daa-a51d-49a17993396d", "value": "T1F5C30945FC515B17C6C612BBFB5E428D7B2A17A8D3EE720399256F20378B85B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906025, "uuid": "f70af647-b3f1-47a1-8576-94b4e94e5ebd", "value": "1536:UV3xPbpp4E/AEFGAtN94Vm2kX5TJBMVX+j4jyBLmjK8l2yYwywTOxNJ6YpYoOMl5:UV3zqktFG24NkJFBMVXit0KuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697906025, "uuid": "1d29815a-2b90-4bcf-82c6-b011ed07df01", "value": 129420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697906025, "uuid": "a3463229-4ce9-47d4-90bf-36c00d38664d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697906025, "uuid": "2950866f-a0f5-416e-838d-2d98ef1269d0", "value": "e311114a8e7688eca6ab1b924c13bdbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad70c31-7069-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697931017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697931017, "uuid": "24e8f2e6-4525-48b4-96c4-947e2558c232", "comment": "Malware payload (Formbook)", "value": "556dffb5bbcc474aaf10f2cb14ef9e1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697931017, "uuid": "9b022311-c19f-4329-a2ce-9eea5b7c7f42", "comment": "Malware payload (Formbook)", "value": "f6d5f10ff1fd33e65ff41b71abd29dae0c86addf7c3d400d58bf53c5ea79d9aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697931017, "uuid": "5ffdb9b7-5ddc-4c12-a19c-68f4e9218f23", "comment": "Malware payload (Formbook)", "value": "d46275715ad005cc6347e31482ab18c7413f6081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697931017, "uuid": "1ada93dd-ea85-40e9-9e0f-db11e98272e7", "comment": "Malware payload (Formbook)", "value": "1f53d62ab9b2633445e1c6920606d96347b5c317aa0b3a6a4c1a57d83b21ececbc080aa6d285f43ea06f029cf53cf492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697931017, "uuid": "1a23c6b6-01f7-48d1-9baf-29bf50f663cb", "value": "T119157D2138C49132EEF320B787ECBA2542ADE0B0071915DF56D85BEED760AD17F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697931017, "uuid": "f0eb695d-dd28-444b-a17e-24fd701f8e23", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697931017, "uuid": "42be8d0b-5565-4c27-97b0-1054210d7a88", "value": "24576:g7mtwk+VoLIY2wHHHHHHHHHHHmGVTorjmPPwy:gm+VoLIYnHHHHHHHHHHHlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697931017, "uuid": "8e0bdb47-4c5b-424d-92a0-f09e40e8718a", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697931017, "uuid": "29a80e03-bf42-4efb-847a-ac61d47e7ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697931017, "uuid": "1ffcb7d1-cc0b-4f75-953c-5f2e32dee94d", "value": "556dffb5bbcc474aaf10f2cb14ef9e1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336ec320-6fa7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697847440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847440, "uuid": "e5545b0e-d226-4f65-9281-f33c720287d5", "comment": "Malware payload", "value": "dec4768eb64a7f7f0e419638ba9e8797", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847440, "uuid": "cbfab408-a5b6-4398-ac94-f18b64204028", "comment": "Malware payload", "value": "f9f6d87fddae95cd413c3613d404e787198cc8b460c29326e4c00c378b0ea732", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847440, "uuid": "f3b2f08a-1bb1-444c-8da3-d7d6523020bc", "comment": "Malware payload", "value": "a46d56962202569eacb91105d70b84d869bd67af", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697847440, "uuid": "731995ce-01b8-4d1e-a1c2-f71616135df4", "comment": "Malware payload", "value": "852aa1f7d15bdc09cf4250b8ab1a4db79abc4a6cdba41a3a7bdaa7989d4a49a40c1904e8ee5718da78461ae27856ee59", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697847440, "uuid": "b33c9b51-ef70-4e1a-bfed-5ff2510c54eb", "value": "T124415C141EE52724F3B39A3568FA731185777849DE018B8F018182482421615F5B9F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697847440, "uuid": "55105559-93fb-4e8c-8f1f-bd560751248d", "value": "12:8AXUm/3BVSXvk44X3ojsqzKtnWNtW+UcCsvXNCvsKMThbdpYrn1IlI5u9bOVn1Iv:8A5/BHYVKVWO+/CW9Ckbdd79ds5ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697847440, "uuid": "4285cee7-6616-4568-9a31-7a709947f27a", "value": 2004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697847440, "uuid": "53f68d80-df5d-40e9-9a42-b6911ccfc274", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697847440, "uuid": "af4657a7-ed43-475f-9c4e-3bff8ac91782", "value": "e8e5fbe27c1191e5013ad44a884d0e72097b614f7a62bb683e960fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3516d54-7012-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1697893611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697893611, "uuid": "4e50f90e-414c-41fd-95b7-dc97190190a5", "comment": "Malware payload (Tofsee)", "value": "572a8f8ae2b9147a829e565228fc37a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697893611, "uuid": "5c599a58-64d7-4b66-b80f-2f8835a99cbf", "comment": "Malware payload (Tofsee)", "value": "fa77af9bbb1aa81e1db1fb58ac2e7b5f5f972d4ec7e2594e165f6a6f836f5c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697893611, "uuid": "4ef093b3-2cb8-480f-a05a-a3dffb111ea0", "comment": "Malware payload (Tofsee)", "value": "dabaff873ac00d7324d3e79d80182b55e94c0ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697893611, "uuid": "11d518e6-1d38-45d1-9ffe-ac6a1a33a92b", "comment": "Malware payload (Tofsee)", "value": "3ab6cad92453ca70c69ded80bd94b3dd7408400ee55a94a2b83eb5b6abb30edb76483ab38eac6197e6558fcc3e4f2a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697893611, "uuid": "c8286353-a883-424c-80bf-efdd92dc2377", "value": "T13E44BF21B6D0C871E46759354870C6A62B2BFCF2EA7545CB73983F3E9E302D14A65B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697893611, "uuid": "fde806ee-bc64-4220-bc91-fda849996627", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697893611, "uuid": "c15c1fd0-be1c-4f3e-b5ed-182c8f0b7d49", "value": "3072:8yBNuIxANzh5l3z7dIx+C/ovJHTfDr4PPErbKqj:foGANF5ljhufQvJHbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697893611, "uuid": "85c6cfe7-b2a4-49d8-b25f-72f001a47814", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697893611, "uuid": "55fca74b-abfb-418b-86cd-6e1341d181ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697893611, "uuid": "a45faccf-adfb-49a9-9cb0-af6eab78b7fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1569ed-7060-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697927076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927076, "uuid": "1c61b642-fd37-4ecc-8c43-5013dcbbbd57", "comment": "Malware payload (LummaStealer)", "value": "f57e102e6027b9d57c1f496597baa453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927076, "uuid": "49378316-c941-475a-b439-cb633c15a8d5", "comment": "Malware payload (LummaStealer)", "value": "fa9f7bd90ef7654544dac1a483617f3b1cc3fba674ff5991e3c90c65ebada260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927076, "uuid": "84de2194-0604-4323-b1e3-7ef694006ed6", "comment": "Malware payload (LummaStealer)", "value": "8de6a0636579fcb08866103c21761fe9d06eea28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697927076, "uuid": "8aafad12-88a5-4124-a0ae-7763434e6492", "comment": "Malware payload (LummaStealer)", "value": "110cd97c0f666b29f58ef5bacaab56d8e093c5cfbb08766707c30dce6995fdae16b5571591339d4045eccd258956f04b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927076, "uuid": "37c1257e-73da-478f-ac11-9429d1a6cec6", "value": "T14265233292D44833CAF6277054FE57A306363E618B74118B7B929CAF0DB26C9257B71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927076, "uuid": "c5194243-387b-4aad-90cd-2bc16a7207fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927076, "uuid": "e8d64a73-88ca-4075-be4b-90a64f0ce7f5", "value": "24576:gyv7qPSXZD+lOEhgoqzVuLklpDOzAogIGxfUsW8MOiNrFhpXc41At31K7gBbDt+f:n+6ZDYOYBYjyLgFxf5UXN1U1ws0bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697927076, "uuid": "bc83e240-786d-4731-9933-556f9d3cdefd", "value": 1496576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697927076, "uuid": "dfd9402c-c79f-4f4e-92a3-daf04997ceaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697927076, "uuid": "77a4a17c-921b-47b5-9a81-f2af2b0967d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812c2429-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697884507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884507, "uuid": "7ddedcd8-6d7e-44a4-a549-2252161ecbf0", "comment": "Malware payload (Stealc)", "value": "2272d1fd724998ca2962707b07db30af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884507, "uuid": "ca729197-59f9-4319-bd7a-2ab1f0d838fd", "comment": "Malware payload (Stealc)", "value": "fad272c7c89b882083723b28fe821e59e089863d5b2b1f23a1a531cca59c4e24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884507, "uuid": "279e3c48-368e-461d-850f-c203f86dda17", "comment": "Malware payload (Stealc)", "value": "06e34f84cc20f9c0a62e168e0abdac9e8d2b8873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884507, "uuid": "5fe33256-d697-4a31-9b8b-cb37b03a1be7", "comment": "Malware payload (Stealc)", "value": "ccfea34cff6f09fbfe527df31af4b8e62ac3a34ae0e4c1078dac2889efe90c68f06797ddf976e53f2f2e88898cbf33b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884507, "uuid": "ea855ca2-7ea4-4fe6-a7bc-1bcaf699cf26", "value": "T1F1346B0F92E0BC61D6264B769F1EC7EC7F1DB5508E496BE622189F2F19721B2D263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884507, "uuid": "f6ec50d3-ee15-4706-b4f2-b3e0e64c91ab", "value": "5f8224784d628ea670c9630686419bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884507, "uuid": "31e0c0c7-da63-45a2-b274-ce509147799a", "value": "3072:jHDSPeZ/hXx5OdUJiI72Q/uZmwN8ZQ9hGylv65TLvtdBit:PSmZPfJiI6J8wNlcL1dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884507, "uuid": "c4b5df71-7672-46ae-8e5d-35577fb55a7b", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884507, "uuid": "fa0c4209-f20c-47c0-ba5b-db19ce361b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884507, "uuid": "642b72fd-04a9-4ce1-953b-0467d9b7ce98", "value": "fad272c7c89b882083723b28fe821e59e089863d5b2b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93abdf6c-7065-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697929206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929206, "uuid": "219b7b81-7f4d-46b3-a1be-1c7123f479b3", "comment": "Malware payload (Mirai)", "value": "aa51cc0c43c301b736ccf801c28222c1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929206, "uuid": "3b1b6a2f-3de3-4dd1-a096-f1d28bb4ec0d", "comment": "Malware payload (Mirai)", "value": "fbc83f4a07e10f010a84ed7d587f33aa002b6fdb315dea87f11cd00b7aa45e1d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929206, "uuid": "78eeee5e-f664-43d5-bc24-36ccfe7f4655", "comment": "Malware payload (Mirai)", "value": "40afd196af99d826d3733ec413a24ab0970d91a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697929206, "uuid": "61bf660a-c8fa-4dd6-9483-6df661468138", "comment": "Malware payload (Mirai)", "value": "e54f16e6089cbf1f00a0ba3b0f6b61edb0b7e223e434253a8af2adc87d1028bd8e708024cb4250807084e27d1b122412", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929206, "uuid": "ec8f0534-fb78-494e-835b-01828a567df9", "value": "T1BEC2E1E67FB73997DE25103A346DCD338674F012D79E6653A244924C20072ACBB729DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929206, "uuid": "ccd77610-dc03-4b8f-a598-5b77b8289360", "value": "768:qMwoDZLFbBy6HQHRYfeAxdd8XLdv8j0N+:qolcYfe6KBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697929206, "uuid": "f0448f50-3f6d-4171-80e0-bbdaf6b69f81", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697929206, "uuid": "4ef4a8a1-9b48-4522-89df-fecf1a38cc5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697929206, "uuid": "1e79e5db-d8f6-4a29-a1d1-6cf161597b57", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ca9db3-6ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697884517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884517, "uuid": "1c15ad07-a7a8-4faf-a893-4662077c74bf", "comment": "Malware payload (Amadey)", "value": "a277207875ed5258e8a11b421fc1f8a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884517, "uuid": "685e9527-1b0e-44ed-a5e5-f980d3c7fbf8", "comment": "Malware payload (Amadey)", "value": "fc283fa4ac8ac1fe7916a702761fe246fc0437c62da63a872fa7097bc183abe9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884517, "uuid": "2e82fd5b-2199-4c67-954e-1f08f31285b8", "comment": "Malware payload (Amadey)", "value": "f7851735493967622e7141380247f81e4fe28220", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697884517, "uuid": "e92923e7-0743-4a68-a043-49e5342ef9d0", "comment": "Malware payload (Amadey)", "value": "6bf9f61890d0a78007b5d43d2eeaecd5fdfe92d771b8c9de88b22705ae9df67e24b3cfbe12564ee2cfe17197d68824c5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884517, "uuid": "afa5e3fe-5695-4b05-9498-5f254a5a06b9", "value": "T1FB157C2139C18135EDF310BA87ECFA3A86ADD4B0072912DB16D857EED7606D27F32592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884517, "uuid": "0c1a08e1-9995-4b4a-bb55-d41b2b0245ed", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884517, "uuid": "88b4437b-f000-4d6a-ba5f-336e1fd1e5d0", "value": "12288:PKKtxFlrG+wwJMRrxbhxJgSSBxi7wGez9OOdj83fj/zl87uD3ICKla7NOS1J:SCo+XJMRrxbhxJgSYFDz9OOuvjxwM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697884517, "uuid": "891e2c71-32cd-44e7-b7be-7daf13cedb90", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697884517, "uuid": "dcb86c25-ff12-409f-a703-bf720d015bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697884517, "uuid": "c10add7c-b390-4c88-b86f-c4a069e854f7", "value": "fc283fa4ac8ac1fe7916a702761fe246fc0437c62da63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9781b683-6fc9-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697862211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862211, "uuid": "e31aada4-9472-410f-b529-0d26c9555095", "comment": "Malware payload (Mirai)", "value": "09ab1e3f50cf2f83f53bd5c893b508ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862211, "uuid": "ac2fd397-0e4d-41c4-b364-d88b976c0303", "comment": "Malware payload (Mirai)", "value": "fcaf673bbb728e44c052c2aa7c65c4cd61914dde88e26b72f4adae65d0aad360", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862211, "uuid": "c5a303a0-aed4-40b8-b473-3d7a5fdcf99e", "comment": "Malware payload (Mirai)", "value": "a8986026122836283668b4001a52f05049191417", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697862211, "uuid": "f364eb99-dedc-4477-8c95-7d0c0be17179", "comment": "Malware payload (Mirai)", "value": "545212f4891520554db98635ce26f314ee4c63d724b50ba9b754409fb9ef26edeecac4335a6fc8d6d71c97f6ef10ab30", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862211, "uuid": "34c21f15-562f-458c-8f59-f1eb5dafe779", "value": "T17A936CC5F643D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA2511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862211, "uuid": "4cd5e82c-ee64-49dd-8714-7208c3f2c95e", "value": "1536:xpmWc2AcighsZ822JxfcH7HD1mSsM8meUigBQ9TnkISGtAdi0xZ:xpmX2riED22rfS7HhmLVUBQ9kVTi0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697862211, "uuid": "7207d7dc-0ee5-46c7-b143-a78beb2ec396", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697862211, "uuid": "178a3c13-a87d-4718-9eea-ce17422ab4cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697862211, "uuid": "32a80d88-b244-4ceb-8071-0f424a81f28d", "value": "bot.x86-20231021-0423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3f4fc3-703d-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697912125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697912125, "uuid": "301416c1-5fca-443a-84e2-04244e6c6481", "comment": "Malware payload (MarsStealer)", "value": "26cf6641153014117c4dd543604c7f6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697912125, "uuid": "8d9edcc1-71b6-4162-8283-8711a7dfacf3", "comment": "Malware payload (MarsStealer)", "value": "fd53294eb93852ae85bba6a87522055a7a963bb4f52210a671a6da44c4ec5f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697912125, "uuid": "cd7c657b-d579-4dea-9c9b-99e88578846b", "comment": "Malware payload (MarsStealer)", "value": "9ecad3571529d6943f3956938e98b46a59346b7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697912125, "uuid": "77f374a0-dc78-4d97-a4f6-99096a6279f1", "comment": "Malware payload (MarsStealer)", "value": "a4b630445b5dcb3fa77704a6107def71d7733ed3e5c2481ecb7b44c8de9dce93bbb5fba7291aed2120284a7d72017a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697912125, "uuid": "6d51a15f-a5d7-4146-ba77-0aa677f21d12", "value": "T17A44C01176A0C832E5A36D315870C5A62E7AFCE3AA7581CB37943E3E9E313C15B65B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697912125, "uuid": "81e5826a-9f97-4a9f-a1d3-b4e1895c2f70", "value": "e917b644331755ce8f3ab54716b5cd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697912125, "uuid": "f2ef2225-2fb7-4328-bc83-776fb0cd9f1a", "value": "3072:9yBNprKlAhHiSH36IB543kMBwNNTSojoudpyvzKc5eeGJ:oDQAhCSHKIBO3l+TNJFEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697912125, "uuid": "279d87c0-8156-4a7b-8a7c-c9f1c1164fdf", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697912125, "uuid": "689316bc-df94-4752-8339-ac349118276e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697912125, "uuid": "fb78baab-e40f-4e63-8643-d2e159ecd986", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93987a14-6feb-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697876807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876807, "uuid": "b63f2adc-9a00-4756-a1ba-5f8c858ed296", "comment": "Malware payload (IRATA)", "value": "b61c9a27622cf60e00c880d1188838d7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876807, "uuid": "1d808dd6-7815-4017-aba0-72ab006de423", "comment": "Malware payload (IRATA)", "value": "fe0cc3bd23a91360b6b06d46b67a3e2da7edac98ff2e94b788c3a21421a5f02b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876807, "uuid": "0bea296d-d437-49cf-b858-0966a921502a", "comment": "Malware payload (IRATA)", "value": "7961fdc1556f223e408b72e638d29f64df82b9b8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697876807, "uuid": "682efcac-50b5-4fdb-82a4-275f174e4162", "comment": "Malware payload (IRATA)", "value": "14000acd7393637761a28b6ac2257011a052c2aceca13fb39927fcb32ec2f4ec5dc2e2a719150dda28e43c85a6a6774b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697876807, "uuid": "cba6e8b4-8551-4835-851c-4f66784ea72c", "value": "T1DAA533ABE0437563FA3FD2F2158721C151661F04CC8BA8497A3E372C567B9DEA34B4A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697876807, "uuid": "28cdd01c-c68f-4470-9089-36dba416bc5e", "value": "49152:ZETKhcjgEwWH/z7t/DZrVpejkB7pnjaLiC6V4TlCQnb:ZiDUDW/vfBFnjjVWtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697876807, "uuid": "f70eea36-3c1a-4de4-a53a-07067e82a7d1", "value": 2206939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697876807, "uuid": "f833cca1-e62a-4b76-9bb9-f18a99c7b442", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697876807, "uuid": "3122f02f-4d94-4946-a1f4-ab02194d49c5", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f152276-7056-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697922568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922568, "uuid": "8975f6a7-2583-4df0-a20e-95e57ad929fe", "comment": "Malware payload", "value": "5e7a021c29d2f00889a466cab0689334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922568, "uuid": "7f2c218f-8899-4a7c-800c-54b940422feb", "comment": "Malware payload", "value": "fe3fe76ac852603106cf5f7b967808db8f92beadbff1302c14f336e7bc145b9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922568, "uuid": "851e304c-ebb3-4e4c-8de6-62d538f7d9cc", "comment": "Malware payload", "value": "d9a2c48755fc36a62e028005eda6c9d6beb8a716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697922568, "uuid": "d0ebf8f5-48ea-4e6a-8be3-d0c3f0fbd2ee", "comment": "Malware payload", "value": "612edba5903cac293d1a8604c98b1196393242702968e578f903bcd12cd515d1bf9e08d66f85d7863d97cb8a7ad77500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922568, "uuid": "8e163274-03f6-4db9-b8e4-058da09e6347", "value": "T1B244C01276A1D436E5A319351830C6A52B77FCA3EA6581CF33943E3EAE716C09F65B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922568, "uuid": "5f5bd206-f44f-4e02-abef-f03f1e560d58", "value": "e917b644331755ce8f3ab54716b5cd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922568, "uuid": "1d7e58f7-8043-4593-95d5-8c40c69fbdd8", "value": "3072:GyBNfnlAGH06Q38+qPl4RGX4VILHNxI2DkAavKMaQdJ:N1lAGU6QMGEIV2DkAJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697922568, "uuid": "be52dc77-bba3-4c91-a440-a12bde64ed44", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697922568, "uuid": "9742d5d6-840f-448a-af82-9a65b1dbc757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697922568, "uuid": "8112e0b6-8a54-4824-865b-d2bb684e7ffb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }