{ "Event": { "published": true, "date": "2023-07-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-07-16", "timestamp": 1689552181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d1170022-e432-4d8c-abed-4ddbd714f009", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64eacc1-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492741, "uuid": "35fb0db5-17ae-45c1-aaaf-fa75fbf54153", "comment": "Malware payload (RedLineStealer)", "value": "75571912929eb141751a428ad1437c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492741, "uuid": "57564e8d-9d57-4355-9329-989eca6ea42b", "comment": "Malware payload (RedLineStealer)", "value": "007fb0d46d22e2cdfe1f61fdfd799eb4464df2ebfab12f9e2ae95314f7106521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492741, "uuid": "df65027a-b712-4c24-a8db-003534f8cf16", "comment": "Malware payload (RedLineStealer)", "value": "b1f93f91b68f90eb4f4c781fbfaa5434de89d398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492741, "uuid": "f3348a18-c544-444d-882a-895769ea829f", "comment": "Malware payload (RedLineStealer)", "value": "0a03a76c6ef9463b898f4d1b1a2d9a3c38bd618418cad35fe2f36776fbbdd89a8b85e7be0ef01790bb318bd3dd375474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492741, "uuid": "e22fb51f-d17a-4773-ad67-6c0559713469", "value": "T19944F84392E1FD54E9198B729E2FC3E8760EF6508E497BE5322CAE2F0772172C563614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492741, "uuid": "de61d624-66bc-4659-9dda-3a89cc0d2f33", "value": "c55238e8720aed638c6e29c3199f0503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492741, "uuid": "39f9eea5-5b93-43b5-b544-39532afd3dae", "value": "3072:tILDypFWRYEq962Yycvgw7of6PSMKNzq05ITJeoaTSEjF:CLD326brvgw7wbTNzqVVtaTvjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492741, "uuid": "8f79c72a-ed81-46dd-b67a-2f172569637c", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492741, "uuid": "f8ab14dc-96b2-4b12-96ae-e8aae3daf1d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492741, "uuid": "0d2f32f3-2cbc-472c-be51-00b895cc3603", "value": "75571912929eb141751a428ad1437c93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124b6370-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689493673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493673, "uuid": "989fbd24-bc5d-4ab4-84f8-32bd60c49363", "comment": "Malware payload (AgentTesla)", "value": "62c4b94030cf11e76831c3371fd9afeb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493673, "uuid": "3f2bfe41-4385-4669-a71f-e2897bd0eb39", "comment": "Malware payload (AgentTesla)", "value": "009d49e4796fb9ff6421d922e6b7edffc61cec5a60bb42c7dfba0e392955abd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493673, "uuid": "f3a5e95d-0b37-4643-849d-fe0ec5b95bc9", "comment": "Malware payload (AgentTesla)", "value": "bfcc14f996891d6be3de46835d6eebabe5312bc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493673, "uuid": "1e22ebd7-63bf-472c-b7ef-0a979fe33451", "comment": "Malware payload (AgentTesla)", "value": "505fae6fd206b142430307f9ed8d12c07136cd4e1abfe3a041ab08523b79611daf58204cfe6dd68da0206a89bbe4b58c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493673, "uuid": "49670b26-643a-4853-b0ad-930c4e10843c", "value": "T1FF64030267FF5108B2F37B456A7A55A58F277EA6693EC59D408C190E0BF3E408C61BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493673, "uuid": "fdc1085b-337b-4e72-88c4-6c68666aa4ba", "value": "3072:I5n5B5XNsnd+b/D7NRcMxzakwLjvspRCDn4nZ4pelJdeBQh:TnGoMxzakjselJth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493673, "uuid": "d60f720c-8d60-4a66-8aab-9d453c7b789f", "value": 315326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493673, "uuid": "38c5e090-32df-4e84-a375-333116ae3f05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493673, "uuid": "f9b24133-85ce-4de5-ac45-64bcc2017a45", "value": "DEVOLUCI\u00d3N DE PAGO TT (Ref 437708000XXX).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268897b5-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689493278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493278, "uuid": "e17be64d-d7e0-430c-861a-00d0a603f807", "comment": "Malware payload", "value": "79b1404fc39367ccf012645f97fc35a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493278, "uuid": "449cefcc-a3e0-423b-86b2-41fe08737685", "comment": "Malware payload", "value": "0136797d142f9f86f4c2af6b5d871576dd342f6a796d42200e100e27208b0590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493278, "uuid": "952ac31d-e03f-468a-ba45-661abe1ff65e", "comment": "Malware payload", "value": "12b16aaa47ebd61a6977505dd932e8456076a49f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493278, "uuid": "071c077c-9296-470f-a9fd-06116b83122e", "comment": "Malware payload", "value": "a0e7bb80a53e2a59368ce8b9cc06d53cdea546183fa1bc34a834dca226b6974b68b8b7acf7c4afac738804163e3dea79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493278, "uuid": "acf14485-2681-4071-9112-303f53a5cff9", "value": "T1F6C3D030BCA0C472C8A3A5718074C296BB7E897213799A8B4F7819759F316D1637E39F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493278, "uuid": "1896a1c6-0dd1-44e0-ae5c-edc13750042a", "value": "3072:/OAL4Zg2SYf+q9mjHknJJRhVH7RbcMj2omHQVm5j1:GALQrfD9mIvhVH7RbNjpYd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493278, "uuid": "cbea0e6e-4539-4690-a5de-73e593c504e7", "value": 127286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493278, "uuid": "267db938-af74-46c7-995d-fec475efffb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493278, "uuid": "fcbf45fe-6d08-4e2f-8b15-35cad58a1809", "value": "79b1404fc39367ccf012645f97fc35a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ca4e14-2375-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1689469787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469787, "uuid": "fc5bc6bf-56d7-4640-a53e-24c8c68223f8", "comment": "Malware payload (Rhadamanthys)", "value": "aef5c6fec5ea5f20f0e71f34d3777919", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469787, "uuid": "f5d9f753-cd01-491d-9d06-02e8de975f8f", "comment": "Malware payload (Rhadamanthys)", "value": "01c7c28d8fcbded6bb906af11b34e65e19a71bc433fa3c8b5e615130f78028d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469787, "uuid": "28cf5ae0-2ecc-45b8-b4c0-4015af00ca79", "comment": "Malware payload (Rhadamanthys)", "value": "013c70c60334495904fa1e83a129dd3c369e6acf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469787, "uuid": "858eef3a-36cf-41d1-8083-30380d3b445d", "comment": "Malware payload (Rhadamanthys)", "value": "a273c479ae84bab168a08b55ce50c2a9f0f0577ad410447dad467c435166cda8c8a95f374e7b9e48c441976aa2237c42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469787, "uuid": "74333904-0cf9-45e7-b178-d4297b6b1259", "value": "T1D8A45BA5BBF2ADC4CE8D33F388046BA4069E477645F2D2C84D295952273F6A5CB0B53C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469787, "uuid": "6407622a-f12c-4b71-9dfd-9c1f2e9bcd63", "value": "fd020041ed8eb76ffbdb414a8b3716f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469787, "uuid": "c03d780c-4a2a-4460-81e1-893a0c817f22", "value": "6144:L/E8DIpjK28t4snQTlp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snAv/cgu4VGn6OaM+ucj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689469787, "uuid": "4e15436b-48dc-496a-8edc-4b9212083142", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689469787, "uuid": "a5c89c42-c799-43d0-bdbb-f1ce9fc7e701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469787, "uuid": "a3141db1-d80a-4a5a-9ca6-3ac9aa87a729", "value": "aef5c6fec5ea5f20f0e71f34d3777919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94950433-23fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526963, "uuid": "d5891d7f-f539-4e01-9ac5-0324b6622570", "comment": "Malware payload (Mirai)", "value": "34baf26c2f6e9a8f8dfbb3dc68293fd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526963, "uuid": "a2507f6c-3074-4a3c-9ec7-27021586f365", "comment": "Malware payload (Mirai)", "value": "031f1db369e41b86fb7adc6b750a5dcfc6a84931c23f77586ba5f3329df2a04e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526963, "uuid": "a7e028a0-d7c2-4488-ad84-931c83e6cbb9", "comment": "Malware payload (Mirai)", "value": "2bcaa5c37472cc3da87aec63ece97a12f8d1d1c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526963, "uuid": "ff3cd686-96b0-414d-bfe8-d10df3955953", "comment": "Malware payload (Mirai)", "value": "2ebd85f795ec5e0e31dbb390f1223a5a2b966d10d81d6aace86928419d190786a1eb10bc81f1c7e1e6e7c95daa0c31d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526963, "uuid": "64e03f3f-bcca-442a-add9-1d846c1ae001", "value": "T1A2535CC5B4119E7DF9CBE6BE85220D0EB921721150931B27BB6FFC83BD731A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526963, "uuid": "c0bfeebe-8f06-4aa5-b985-91686f6b085d", "value": "1536:UPKRgsFRTbSX5R5LepSGI3sFXMhO52QUpeqEXy48s:pRwviM8QxECa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526963, "uuid": "0fa4da5d-7477-4311-a6a1-85121250fde1", "value": 66500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526963, "uuid": "e9bb8f6a-cdbf-42bd-a4e9-3d2a9bc5767d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526963, "uuid": "fdd6a021-0b8a-41e5-9c2b-fcec0d4ee0f1", "value": "34baf26c2f6e9a8f8dfbb3dc68293fd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893150c1-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467244, "uuid": "5cca75c3-32e5-46a3-9cc7-83dc84d7dc73", "comment": "Malware payload", "value": "e9be4649dc7d76f5bd2c1353eb4a3817", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467244, "uuid": "cbafa1a3-57d5-4b4f-84fb-bbcd52ffeddc", "comment": "Malware payload", "value": "039d30d477511a374732afa1354251d22163663a81fc79a9c8dac157b2cc9ebd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467244, "uuid": "ae25ec44-93d7-4d16-80f7-18294272aab0", "comment": "Malware payload", "value": "e96aaec19343b89b4fc83331f4d7070ca11688e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467244, "uuid": "55124e9f-9c1e-4fea-9449-440ad5502af6", "comment": "Malware payload", "value": "3040802334fc5903f5d4e1d0dfac7accd5ca0e415fa9108749aff7dfc82b5905a36fda7cb65b7f0ac42b7d285b4c020b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467244, "uuid": "c118b4c6-3a2b-4563-8e18-39fc4aa76243", "value": "T13446C00CBB1389A9D386EEF9DE56966D37EA7ED3C5C4900BE2583EA70D70714618C0E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467244, "uuid": "11a8807e-f06b-4b73-aaad-f36308f04790", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467244, "uuid": "a08128ae-6157-470c-bf54-521af2f097b2", "value": "49152:VDGUmKMDbWwEEceEKZI3EaFjIJtZXX9VYKasd4607nL/sn88Znu+s8KuqGaX0To/:JN8RF/+Y0LMZndJBAUZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467244, "uuid": "aecaf863-70bc-4050-ba0b-4c467b8f0d6f", "value": 5610396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467244, "uuid": "1940bf2a-bfdc-4f97-8ed1-37e4833bec81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467244, "uuid": "59741d0d-76d8-4e79-ad0b-eb04207fd7d8", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.13761.8565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d4fb93-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493038, "uuid": "1574e1ff-3f83-4ac5-a0da-32d17654b57b", "comment": "Malware payload (RedLineStealer)", "value": "a9741a57497aa2fbb2ec1bb25a805226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493038, "uuid": "ea0be157-bc1e-44b8-afea-67e024a7fae4", "comment": "Malware payload (RedLineStealer)", "value": "03baef8c20e065d1b72a1f9151ca6e140e71b23c3bb4d54da4b22b2a410aa522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493038, "uuid": "622219d5-1865-4015-8167-1992f00c55ae", "comment": "Malware payload (RedLineStealer)", "value": "40a96d22e4f16453b1a763184229fa294472ea39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493038, "uuid": "b29d5f97-53a3-42b8-8f9b-410e3a4af92d", "comment": "Malware payload (RedLineStealer)", "value": "0f6cc0a6bc18f2a7c34ff116a78e5342addaf84049eb334ffc58fda4e0bd89bd026eea9a4c262e79fd2df83f953077f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493038, "uuid": "9c6260ad-4713-4b49-9517-2f4d56786a4d", "value": "T12E4523369BD88462EAB817702DF719C31B367CF28E3442673611D99A6DB22C0E1B5377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493038, "uuid": "57b6a829-0871-46a9-85f1-1d10f1a7bba1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493038, "uuid": "ea0edcad-b6f2-4505-a5da-383bb7f41201", "value": "24576:PyLawZ6vchCrHMUBpC92NPLRjAInJukiIuOUDQXs:aLaS6TMeC92tNjn6IuOUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493038, "uuid": "3a21114f-51f4-4d4a-bcc9-9adfa6e195be", "value": 1211392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493038, "uuid": "7a93da22-8268-46ea-af60-d11a5fac0afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493038, "uuid": "167f414d-0654-4a3a-9548-0bf79203df7d", "value": "a9741a57497aa2fbb2ec1bb25a805226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5c6e57-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689493157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493157, "uuid": "868dd1e8-3aed-4cbf-b766-d74441b26560", "comment": "Malware payload (SnakeKeylogger)", "value": "6d8869c65002902bc6b72a7aa996a7eb", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493157, "uuid": "65de84a4-4f39-4722-ab20-1da48a4b25fd", "comment": "Malware payload (SnakeKeylogger)", "value": "045b8d75d54e46b8273a4cc1329a7c6fceb6c61417d36a08bc528e9e90cb8c05", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493157, "uuid": "c95959f0-e79d-46d9-a6cc-fe49c8b4a4d4", "comment": "Malware payload (SnakeKeylogger)", "value": "f9d5fcea09a1017ea3e8decca06ad633f685d215", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493157, "uuid": "7f9f989d-4e2a-4436-add8-a638a1c75bbe", "comment": "Malware payload (SnakeKeylogger)", "value": "4fc7e11cdb53cda88377dcb1414f6423957ec1b13b8c859c9c2541b91bf3ed5daa744429bf8917525b68a40952a737eb", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493157, "uuid": "b63805aa-0232-46e5-bcea-b61d892ac4cd", "value": "T1C5C4BE4573306E22E86DC2B9241925CDDF78B03E64A6E0165F2A38E56E60F7B371F643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493157, "uuid": "6d6b0911-c88b-4393-b385-1a65c4c88f89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493157, "uuid": "4142594a-affd-4431-8f2f-e354e6d2f69b", "value": "12288:nWethnAViFzP5O8maeR5vAVqffw9UyW+sLUiFI:h3AViFzRO8mr5gCyUj+AH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493157, "uuid": "9aace7d5-4a29-4678-9184-69d30a1de38e", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493157, "uuid": "fb90b7c8-3549-4c8c-b499-0e0141880f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493157, "uuid": "0202a023-6048-4f9f-880c-fde10a0d8309", "value": "Confirmaci\u00f3n de transferencia autom\u00e1tica.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef87897-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1689493856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493856, "uuid": "3a032572-c77b-4a8d-b9e7-1cdb2414d43d", "comment": "Malware payload (Fabookie)", "value": "b9d6c29ba190a9bff6f11728fe80adea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493856, "uuid": "264784b6-62e5-4c14-aab7-3263344d6a27", "comment": "Malware payload (Fabookie)", "value": "05699ec51985fd8b24daac09abbfa873c129b98b857e040e276022797c24a8ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493856, "uuid": "8e9ba3bf-7e45-4c7a-8ed8-606167ff79ae", "comment": "Malware payload (Fabookie)", "value": "3c3ec7917ad7c4286083e21dcb77b0034c94cc7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493856, "uuid": "30b6ec25-08bf-490c-ae40-cfef10830391", "comment": "Malware payload (Fabookie)", "value": "88fc025497869dc9f320bcc6837303d35f16b1baca3899566c38c1d047282499a3265937573bdf165e1e9f0fb0c1fc39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493856, "uuid": "e3e310c8-e0cd-48e1-97dd-348ca36f6d90", "value": "T138D47D51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493856, "uuid": "0130869b-14fb-474e-beb9-00a2e8b218c6", "value": "20a03a21823d3b586003fbd55dedc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493856, "uuid": "23a73c9c-d8e1-45bc-8e88-c02a3b8be486", "value": "12288:Tee9CNmn1yjnivHTJBxPTXzGwDJcqMuGEPnW:qe9imn1+uJBxPTjGwSqMupnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493856, "uuid": "6bcdb183-dc07-43f3-9efa-97201ed59bee", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493856, "uuid": "5b43f746-b4c4-4cfe-83fd-c699899947d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493856, "uuid": "43390984-cdcb-4270-8744-27b600a162bc", "value": "b9d6c29ba190a9bff6f11728fe80adea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec326a2-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492996, "uuid": "b3f4d809-8b08-4eba-8c51-db8370924a9e", "comment": "Malware payload (RedLineStealer)", "value": "b5474354992c920bdfc7445f27dd8667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492996, "uuid": "93e8fc0f-8564-462a-a9ef-fbe595371a40", "comment": "Malware payload (RedLineStealer)", "value": "0760d7d14be4bfd9507e6dab6e76652ff4fa096bf8b2af898fb578d1f1ab8e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492996, "uuid": "1481741c-057e-410a-a6fb-0374bee78546", "comment": "Malware payload (RedLineStealer)", "value": "de62a8b845cfb44549f6faa6dd018a127da86cf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492996, "uuid": "345080ea-efcf-44ed-9ea8-7f27767dd2f9", "comment": "Malware payload (RedLineStealer)", "value": "a4bcea89a7bb65b7d55e636a00a5c2cd4ef902d4f9e30f5ab82eb3daeff11a502c4fded7d269a79f10d73ffdf6312491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492996, "uuid": "9d412754-18eb-49db-a1eb-e9616b8fbf01", "value": "T1B3F41205E7E98432D8F517B15AF20B830A357C619A34937F17427D8E08B2ADABA71737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492996, "uuid": "671cfe73-d7f1-4891-b283-802b51441a5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492996, "uuid": "a990e19d-92e8-41b5-b963-52728cbeba63", "value": "12288:pMrfy90MKIGy8Pelc10nGRxydxSttlGYj+VhRTiSJpYpCVg2:6yAHy8mlURxtnYjgSJipCVg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492996, "uuid": "19356891-156a-4f48-bc38-cba5b209aaf8", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492996, "uuid": "1d5422b9-21b9-45c4-8730-5fecd13bcc9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492996, "uuid": "33f752c1-479d-41e0-b648-6c0faf6a5e0c", "value": "b5474354992c920bdfc7445f27dd8667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2fc5ae-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492380, "uuid": "bdd7dc09-8193-4f0d-91b3-ae5987c2665d", "comment": "Malware payload (Amadey)", "value": "65883b4a8135be962bb33cbe7124a601", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492380, "uuid": "792dfd3c-6653-4d0f-92f0-a14e5af2864e", "comment": "Malware payload (Amadey)", "value": "0938a999b8caf4ac0b0ae0df1eb9b0b22dec4dfbfa3b4cb4ac6b6fdd35c3f7a3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492380, "uuid": "5987318c-cce1-421e-b1ac-c5ef8c3859e4", "comment": "Malware payload (Amadey)", "value": "003fcf5786e5ba85e4947ce59abbadbb9cb22ba4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492380, "uuid": "3105bd4b-aca2-4646-96d8-20d0f23e2c2c", "comment": "Malware payload (Amadey)", "value": "00974a64b64a8325257ba1af51c32f8398e75e070aeff692295d31fd101fe290df11f520177b88523222a4ff4a60fc77", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492380, "uuid": "d234d47f-3cab-421c-9806-6d6ed6bcf852", "value": "T1634523436BE44873C8B0537098B60A972B37BC7159AC92AB2716741E1CF3AC4B1357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492380, "uuid": "3d3e119f-1149-4fe4-86fd-6ffdd167482f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492380, "uuid": "af549f38-aa1c-4f24-8549-b495931ffe08", "value": "24576:PyuI+YFzqAmOH7ZZBGLaEBupcGi7HjvapU66B49AxQml:aGYUAmGBGLduSGSvTJ4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492380, "uuid": "ad32b712-5ea9-43f4-999c-8e1fc25d1b1c", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492380, "uuid": "252783e4-3605-45f3-b283-0a4f63d5c78d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492380, "uuid": "9c9632b9-59d6-4f0f-b46d-302d43e238d3", "value": "65883b4a8135be962bb33cbe7124a601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f524ed-23f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689525910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525910, "uuid": "3f2911df-8834-438d-8d18-6baaa6121300", "comment": "Malware payload (RedLineStealer)", "value": "265995fcf5af5963e48a541be876f8bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525910, "uuid": "23189c1a-6b52-4d48-8ab6-6e89609ec9dc", "comment": "Malware payload (RedLineStealer)", "value": "095ebbcc503976fb277cee068d6629ec9fd78b993eec1d0c6093d6028d2ab960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525910, "uuid": "5efa1e90-3d35-421f-be7d-54fb27826753", "comment": "Malware payload (RedLineStealer)", "value": "0cd045069343beea60264c7a15198bd2eac28a45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525910, "uuid": "c8fc86f3-d3ca-415d-a845-f8b1f778185c", "comment": "Malware payload (RedLineStealer)", "value": "90df716b7a4e6113742fe066fadfbc8e6ecb6083860aa9f6caae77d05a8bdc69aeb837d104f2d5107cb1efc3042bbd43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525910, "uuid": "36205af1-e637-4af2-b77f-8785cbcf16d3", "value": "T19EA4294392E17D4AEA258B779F1FC6E8B70DF6908E4D7B653219DA2F00B10B2D163B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525910, "uuid": "3fcb0226-32e8-42c9-8501-f4c1851f446c", "value": "326441378ca815656cabd6c06990bf3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525910, "uuid": "f5eafaea-93f5-4bc7-b715-52c29c0772ae", "value": "6144:JLl2DboiZqWjagkfPpCiu2f3ixkjy/UVob9obBJAzCOPf1jFG:J5KoRKxkpLfSyjy/UVsiLAltjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689525910, "uuid": "441ebbed-15f6-4668-b2c0-f37eac35b973", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689525910, "uuid": "56195380-6efe-4e45-bacc-83b6134b73e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525910, "uuid": "df1d96e6-3327-4843-a990-f80a963b5173", "value": "265995fcf5af5963e48a541be876f8bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6e966a-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492404, "uuid": "c067fc3d-5b0d-438b-ba86-00bd10c04ac3", "comment": "Malware payload (Amadey)", "value": "73c42ebd7443a2e23341b9c0e1541e42", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492404, "uuid": "2d082513-832c-443e-a11f-3666d52fffee", "comment": "Malware payload (Amadey)", "value": "0b7d76e81a2d0b0aff600ebed3a5d66fafa3f2aa9f61d4a958485ec809c206c2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492404, "uuid": "88174de1-bbf4-482b-9feb-a4092df00862", "comment": "Malware payload (Amadey)", "value": "41e479eab57b2d8e488439703713597dbaef0d5e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492404, "uuid": "1594181a-97ed-46b9-b66a-2dd05184a725", "comment": "Malware payload (Amadey)", "value": "684a00e79ed70ce03dd71ceac2bfbe2ed9491c96fd4c74aa9b5a388dad0b2987167e921ce603b3754de79f7f07e02792", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492404, "uuid": "8dad0204-6c6c-45fb-bacc-dc2fc0bd283d", "value": "T176F41242ABD84473DEB17BB418F902A70B367CA10DB883A62B8549560CB37D4F5727B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492404, "uuid": "7a260a0b-9264-431c-b424-3a2790adcfb6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492404, "uuid": "bcb32c00-fcfc-46dc-8233-127ed3c1d719", "value": "12288:KMrMy90Upi87P7u4e+6NxY+wMkyTV41sU6ySJLL36GoUaNoyq2KDrO9dsjKOz:ayFsqPczIMHV41suSr6Xiv2KDrO9/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492404, "uuid": "94c1a597-f442-4141-8935-4fe770837a8d", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492404, "uuid": "10567624-bd3d-4c57-baec-e793238d57b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492404, "uuid": "68b6bc8c-d4c9-47b7-864a-56701c6a7ba8", "value": "73c42ebd7443a2e23341b9c0e1541e42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957785a0-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493034, "uuid": "949c6a82-61e9-4ee4-9c4d-7800ee8cf6ab", "comment": "Malware payload (Amadey)", "value": "83983590f04276062fbb751213a5c3d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493034, "uuid": "19044ad5-9069-404c-9862-bafcdf49acb3", "comment": "Malware payload (Amadey)", "value": "0c18e49a975cace6696587670064dde6fe0766a4d2a42d5663627501347b32e4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493034, "uuid": "6332ae27-f6f8-4f61-a85d-708f53d2b7d4", "comment": "Malware payload (Amadey)", "value": "77db70695e41b2d177112f151eb924064fa5efc6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493034, "uuid": "4e33666f-417c-46d2-8976-039012968ff3", "comment": "Malware payload (Amadey)", "value": "f870d86e14254c64b756f11a4a7a69cef5f3e10ce5636d149eb2e06ac69c3b1b18aa0fa95711c1ff63482d2e2c00e470", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493034, "uuid": "a634fb72-1afc-4776-b73e-254ba82c015e", "value": "T154151282E6E58577E9B2277114FA12D317377CA209F8871B331AAD480E72BD49436B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493034, "uuid": "d7c85b46-2ee2-425c-9f4a-eb8e4fbd1e62", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493034, "uuid": "d0ee836d-6af5-40de-b96f-63b27f917faa", "value": "12288:8Mrry90iUDJ5Wt81gsupGh+TvCr7FBI4n8d80gBeFgg9mvnmLJycH6G1uHl5UgXT:vybybNbPT90gf48YkcHT4HbJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493034, "uuid": "a5d91a86-907a-4844-b3f0-9f7b6f124bd7", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493034, "uuid": "0889cb06-a3b8-4981-a02e-f279dbff71e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493034, "uuid": "696cb470-8184-4eb1-b28e-cb266dea99d2", "value": "83983590f04276062fbb751213a5c3d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b20dcd8-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689491675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491675, "uuid": "ea7cb891-d1cf-48b5-8d11-255325f0cf0d", "comment": "Malware payload", "value": "33313cf667b79176519e8f5c9136b2f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491675, "uuid": "874fb170-c42a-4e58-876c-c23802fd4e43", "comment": "Malware payload", "value": "0ceb65ad9392a2e898b0133a757840a880fbfc541e9079a1c277adc3c146fa35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491675, "uuid": "52b29882-e4cd-4ad0-9060-e4ee33b04ca3", "comment": "Malware payload", "value": "099d9a90c5b11ecc67dffe0b3583e9e938805623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491675, "uuid": "55db3d70-9467-4d79-94c9-cf206dddba2a", "comment": "Malware payload", "value": "f2675a9b09f91a96152ea47013f0b4fc781282c94df8e65360fccaa40fc036bf735096d40e1f33ac33e7895cbaea698c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491675, "uuid": "993f9f79-93e6-4f2a-a8bd-c97ef0e59436", "value": "T1E4D45B10F85F7271C9AEA0BB8BDDE720539CE8A0331A05DF679847F9C6271F16A32645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491675, "uuid": "6785f1ae-dbfc-42f8-bd45-1cf5684b3d77", "value": "57423b5afae18340d4d20251213d0ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491675, "uuid": "1c286e3e-dfff-439b-b5fa-933c603d8754", "value": "12288:tSuBTTZDpCZ+6VPwEiuHcciBdu9B/uaetkQrP:4wnEiHpO1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491675, "uuid": "c0ff7c5e-7c4b-4edb-b1e9-ffa13e9ba70b", "value": 628964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491675, "uuid": "b204b25b-3ac3-486d-ac89-451b0f0d6e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491675, "uuid": "a16f4b7e-e594-4b38-aad1-2c8884280ea3", "value": "33313cf667b79176519e8f5c9136b2f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951a52ec-23b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689495611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495611, "uuid": "22ff103b-ce53-4b94-b0ff-b192a0fd49d5", "comment": "Malware payload (GuLoader)", "value": "5cad52271422b36941487ad44a7ade44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495611, "uuid": "61ce9319-fa42-4175-865a-e35d28c08735", "comment": "Malware payload (GuLoader)", "value": "0cffea5daeb941cc6235f4de2fe2ba348ff08742d196ffc68bc8d7f1109596fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495611, "uuid": "31752e5a-5798-4ab7-9f8d-180106a5edc2", "comment": "Malware payload (GuLoader)", "value": "0fa6ba3c9799301fcdb529abcb5d7098c5c3fdba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495611, "uuid": "fa356284-9e01-447b-93a4-e8bcad9c46b1", "comment": "Malware payload (GuLoader)", "value": "f73d8dd0e45e16d4782ed31c97f335b4a302ffb4d66389247ba1580ed45786f6b6f3722babcd66aa9262136406b1ba8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495611, "uuid": "e38bcd5e-8b00-4d6b-b594-a74224bfa344", "value": "T1C844232265D2E8ABE5D04DB2FEA3B29AD1714F801231DB5B97407F74352ACE68E07306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495611, "uuid": "027fb3c7-5663-40b1-af96-1285ce910f8b", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495611, "uuid": "8609897e-aaa2-4550-a4b1-658913019138", "value": "6144:RC2fT8maVl1F4rxzEc2qauQpeLXsS9ECZXQE3yH:pSv4rxwc2qweLXsSpX3yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495611, "uuid": "fe7ad5ee-e6c4-467d-b67b-84d937d7bf2e", "value": 261560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495611, "uuid": "8b14f3c1-133d-47e3-9117-89aa0c9c505d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495611, "uuid": "b07dcde5-66cf-468a-913c-f67dcd4f71ae", "value": "5cad52271422b36941487ad44a7ade44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8258ecd0-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493002, "uuid": "d29923d9-f296-401b-92b8-f13e33c3aafe", "comment": "Malware payload (Amadey)", "value": "d14146ef47fac73e7e6899d55450ccce", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493002, "uuid": "e4eaeff3-db0b-4500-a7f2-76cac14ab8ce", "comment": "Malware payload (Amadey)", "value": "0d8318e3c9a234b693891cc4653b57ca147f93c98bc8ffddaafd3f6baaf1be24", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493002, "uuid": "1d9b6916-d1cc-45d3-a1ed-c481a8f745b2", "comment": "Malware payload (Amadey)", "value": "2949d4530041859cebb1c1457ddff90ffc02eeee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493002, "uuid": "36a65b7b-01d3-4261-8d76-622faad49330", "comment": "Malware payload (Amadey)", "value": "93334f39f6212ea3c007bf724b00577f561f615251d2a9bbedfacc121b387e828a6b389ad5c2f67374a19e5f4a58c023", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493002, "uuid": "9a75104d-dafc-4e7b-9a38-cf2b07561aac", "value": "T1CBF4234697C48072DDB64BB428F716C30B367DB19D38C66F2389949A1CF1790A63A73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493002, "uuid": "63d3084a-a15b-4ae4-9a12-3a783741989a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493002, "uuid": "ed2b91ed-2a4c-4597-aa3d-4292ed7298ad", "value": "12288:aMrmy90bc/ogltGEczmrUPqt6gMgKzy3qGDZzadHZqoSCukU3voMHVGpntc7E:Yy9z5rUc6dby3q+uz9S+U3voM1o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493002, "uuid": "b9debb22-5110-433f-9fad-e1c3d1436327", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493002, "uuid": "e62a3e03-ab0b-4d6c-88e7-404b20940bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493002, "uuid": "789f0dad-7a34-4511-949b-044424a1d53f", "value": "d14146ef47fac73e7e6899d55450ccce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6f588f-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689491654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491654, "uuid": "c6c127b2-9749-4321-bcd1-6012fa7a85d9", "comment": "Malware payload", "value": "9ac319de9c016d54937652f57164ccbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491654, "uuid": "2b717def-403a-4fd7-889b-f6ffc7753a40", "comment": "Malware payload", "value": "0d9c840e935d2641d9f0c2736bb309fe25d233dd0cd1f3dd468610580125f94d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491654, "uuid": "e802ea6a-3239-47eb-b605-c15c65de72e6", "comment": "Malware payload", "value": "01ed6f707f0f5176c79122f1c7dcca7a3cd3f099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491654, "uuid": "4eb5ad34-3345-4a65-8e32-721eb3bd4e67", "comment": "Malware payload", "value": "4b19ae9027f6a6bcc6adb921541ccb50338e186dbeae453dcd90d8ab520d65137765f883a9613fdcc0ecead6b0756a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491654, "uuid": "7702765e-b5ab-432e-95e3-800008e98dcf", "value": "T17A44E113F6E98032DCB96B7008FA42D30B35BDA15BB847E71741AD9A5CB26C4A43177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491654, "uuid": "ea9a7c7c-531e-4e42-9761-dc32034d61b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491654, "uuid": "4389709c-9771-4b58-b0ef-05d2375ec0f8", "value": "3072:RD/Ier13d5GWp1icKAArDZz4N9GhbkrNEk1DiWZvkBceb6xg+O4gHOr0uo0+n9ml:1Iexp0yN90QEwifQ7vgur1+khlzWBGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491654, "uuid": "de2f58c2-c2b6-4e52-b002-1c8fcc37c956", "value": 278551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491654, "uuid": "8d9fdd1c-9d89-4688-bb30-e092d659f993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491654, "uuid": "184de3fb-0412-4999-922e-af445b7d74b0", "value": "9ac319de9c016d54937652f57164ccbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc5fb59-241c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689541712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689541712, "uuid": "fceb7ba9-8e06-4712-abef-ee64cfffdfa6", "comment": "Malware payload (RedLineStealer)", "value": "3d579967bd0dec621aaacbf89c2157e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689541712, "uuid": "1a74461c-e053-412d-b8e7-76a27ae62a82", "comment": "Malware payload (RedLineStealer)", "value": "0e2d4edb43a6e1c32702a7a63771aa1af3f56966294eacb41de0e76f6e73abea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689541712, "uuid": "aacad4c4-244b-435b-a500-3d80c72ad2e6", "comment": "Malware payload (RedLineStealer)", "value": "46b1c22a0bf32a6a4be9cce0b9200d80854000b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689541712, "uuid": "6617ac17-bde9-413b-bd3b-180f661364c8", "comment": "Malware payload (RedLineStealer)", "value": "74f153fc313184adc9994ad01f03b14559fbf1a0695af1b5bd6c5ed72daeb3a648d4499ca218c63aee11480538c6ba33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689541712, "uuid": "9d5e141c-6267-4bf3-9b77-3e2a7222290d", "value": "T19AE44A6475948522D8B230FA8BECA52D019DB3B107171BCB1D882EE9AF635D07F36D8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689541712, "uuid": "2cf0ca2b-5e51-4512-8d00-711a84cea54a", "value": "366b889fbf8b867e33436fbbbc4d0c58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689541712, "uuid": "37910280-55b5-49f4-8f84-a659e50361c8", "value": "12288:U/FMd2Z/ZyKB9UyTLrY1XLIcVNu2qg4OFSq76XZ:au2Z/7rYbVJ4O/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689541712, "uuid": "3dfca3c8-30bc-41f7-861b-ad3dc9667dac", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689541712, "uuid": "d7cedd10-f106-4263-b7ed-901426156c83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689541712, "uuid": "805e370c-fe85-44b0-a3c4-6372eb0d5868", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fb8819-2383-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689475716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475716, "uuid": "e6bb4f80-8146-4ee7-b257-9499d8a39954", "comment": "Malware payload", "value": "8f9a495469a4f838dcdfebec29b01642", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475716, "uuid": "97e15949-4c79-4cfc-b681-c348f0ab1ddc", "comment": "Malware payload", "value": "0eec6daf96ec6db19a49253a398e47ee885719ffc233084436194df5977307b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475716, "uuid": "99018c69-4f41-48c6-91c5-c1e212272ef7", "comment": "Malware payload", "value": "5b07eb95541dc8edbdb61af7716b3f1363d2ce80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475716, "uuid": "ce1d549b-ee48-41a1-868b-a4b0bb771e5e", "comment": "Malware payload", "value": "d4c4381c2577d747cedec0640a307a669aed990e30eca2c42760d846d4601dc29fa2baa131c9d3bca3359341ddb35f77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475716, "uuid": "d8355787-0bbc-4516-8d56-c654b0b8c014", "value": "T158F2E130A94B3537D4F32CB19D7F8A02739D4FF4D6DD36B02589675A2F0E848AB91841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475716, "uuid": "6e3b839b-5562-45ce-b31b-0d0b4b7d6272", "value": "768:SlEeVg38ifFZN4kSO3wEmGZLSp3QP3clF2q3U7r0:SBUN4kSOABMgQPclwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689475716, "uuid": "3eb61483-fdc8-4c84-9a7b-7409716423d5", "value": 37072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689475716, "uuid": "2f5a9aa8-4e98-4d85-9446-48986d7be0f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475716, "uuid": "31d32905-8f26-4a30-9ca8-4e63dc1b5e61", "value": "8f9a495469a4f838dcdfebec29b01642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8998ce1e-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493014, "uuid": "7e0e81f0-c81a-4467-88bb-139643392094", "comment": "Malware payload (Amadey)", "value": "d25c9842c7d0de73e025d2524255227c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493014, "uuid": "2419e26f-bbab-4f94-b1d4-0970e24fe920", "comment": "Malware payload (Amadey)", "value": "0f25331d60b7c7bf88055632e15873a3caf80f3df1efef5982d9135c6a43b58c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493014, "uuid": "0b0a7f58-748e-41e9-94f9-ab4b4eb8fb77", "comment": "Malware payload (Amadey)", "value": "3c9f0d4dca25189b6ce5ab04e1bd51b2a8f0e2c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493014, "uuid": "90cf1ab5-fbc6-459d-b87e-b94005049045", "comment": "Malware payload (Amadey)", "value": "29f9e79c7a0e5982edfe12f3558eb7cb3b3be2f010bb6d88c07ff3e3058f06f0db499ad19665944654753eef45ca80d4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493014, "uuid": "a31cb406-ae40-4003-8bb5-0f9f770f5d73", "value": "T181152242ABEC4033E96917F078F722D71636FDA04CB8975B26855D6E5CB3280A4367A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493014, "uuid": "d5ad4572-ec87-4f8c-ba61-634b9989921b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493014, "uuid": "43737a3d-1ce1-44a4-9fd6-0438758e072f", "value": "24576:WysxaJ6SDMyK7ovHLETE19e8oVFeaj4AYCh5:lsxaLMy0RTE1/seyYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493014, "uuid": "306cdf6d-1f55-4561-8a08-ff9076d5206a", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493014, "uuid": "f7a65fdb-1ad2-4089-9244-b435c0dafad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493014, "uuid": "b060aebe-9eef-4761-82e1-8d3f2739a199", "value": "d25c9842c7d0de73e025d2524255227c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b448201c-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491798, "uuid": "4f892c3f-b13c-42d0-820a-bc6fc773d148", "comment": "Malware payload (Amadey)", "value": "398fa7a57b5f1897b88881f88c0214b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491798, "uuid": "1c321e55-a45c-4521-bf34-1cc3a52fc832", "comment": "Malware payload (Amadey)", "value": "0fc3fec69bf33cf4af03a90bd20061c2fa05bcf09286d6fb7dd7c6e4c2cc34c9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491798, "uuid": "1eb57d91-f388-4aac-8155-970c4d97aaef", "comment": "Malware payload (Amadey)", "value": "85cfb195f3e6f1dd5e4d0ea15f739ec20ef86ef2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491798, "uuid": "01377aef-b969-496f-adc6-e4615f659b64", "comment": "Malware payload (Amadey)", "value": "a063399273babc83fe2bbe756f090af8ac35d2dd4a046238112b76fa11a6090b0925302bfb88167f37460993ba1aae72", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491798, "uuid": "1c19ad0a-4f40-4ea4-bfdd-abb5899dea95", "value": "T1E0F41302A6E49433E9A217305DF712531B3CBCE14D79876B3186A94A1DB3BD8B472B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491798, "uuid": "30aed989-7c8a-46df-9c9b-999068111730", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491798, "uuid": "8ae853ab-4b17-492f-be9f-2d8ca9c16bd2", "value": "24576:cya43U6kfdgDO65JTH+UIx4LC4F0nWwsmOU:LbU6kfdT6nTH+UI8C4F0WDmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491798, "uuid": "bea8992a-c3b5-4ab2-a50d-fbb81d89c0ce", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491798, "uuid": "7fd0d4cf-f2ac-4cd2-bd2b-ecd483f8c596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491798, "uuid": "e4959f20-1c7f-4106-ba48-78b620e0a3e8", "value": "398fa7a57b5f1897b88881f88c0214b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187275d8-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689493684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493684, "uuid": "61727c9f-2a12-4385-bcef-d0f21b82a34c", "comment": "Malware payload", "value": "1e4994937b2105335f604ea23a3dc03f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493684, "uuid": "2ed8e574-2f78-4567-84e5-bc8a2c1160b6", "comment": "Malware payload", "value": "0fd0e6e3c12a17433d352a73ca41b46743c9d181f5526bf8b640a0dfb1e6b3ba", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493684, "uuid": "2fb4a10c-1efd-4051-a663-0b375ca0d209", "comment": "Malware payload", "value": "f85118011fef40df44bbacefdc0437a66222a285", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493684, "uuid": "f1fdb06d-d9ed-4223-8d7a-1006054db0fd", "comment": "Malware payload", "value": "7c80a055e01c2283a4c0dda6cfb16ab8b5f09f585336b6c524f1498192411dbc4f1fc9724cdffb71eb9ec17ba9cc5af7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493684, "uuid": "c163ef24-213c-4811-a46c-72871b6d9395", "value": "T1B063C03757AE5525FB115F3201434922C67B6E9DAC2EF38CA643373C28794E288E2739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493684, "uuid": "92058d20-2c7b-457d-a58e-5ea9297c7104", "value": "1536:GDPdM+b9NUA3p7fvF5X2H0x47GqyNPAcjAPbip5ps:Gn5ZF5m77GqiRjAzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493684, "uuid": "aabac3e7-8519-4f31-946f-ba0ad67820ef", "value": 67288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493684, "uuid": "8ba6586f-8eb9-43c5-b23b-6b45a30f4af2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493684, "uuid": "0de28578-c392-4b28-a174-b35fc54653a7", "value": "URGENT INQUIRY RFQ_PO18000btu - PO24000btu.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0126ee1f-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1689493215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493215, "uuid": "277344b4-ba86-44fa-9cad-2190df048e0e", "comment": "Malware payload (Meterpreter)", "value": "b270508a8a3eb5dfe22df76f3cf59f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493215, "uuid": "e0cacc83-d475-4470-93c1-d2707cdc49b3", "comment": "Malware payload (Meterpreter)", "value": "0fdcd7983076fde019d68d43cd237d65b6036e3fc4aba49c2fc06ca2bf7ef2a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493215, "uuid": "ee7888b7-4de6-42f0-bdb2-1cf4a2b30642", "comment": "Malware payload (Meterpreter)", "value": "ab3d84b39843edb23daa60d2071f86e52c14a191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493215, "uuid": "ee6fc7b7-aaaa-4871-a5a1-6f79208ef193", "comment": "Malware payload (Meterpreter)", "value": "69ebe0bcf8cc727dee4bdbb8f4016bea1ba73c9877ae055191838346c3f9d9a4348ea6403e0124092ecb1bd311552d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493215, "uuid": "ca332977-5bf7-4b12-8f21-cf36ef73e0dc", "value": "T14A45227E6AAC5FE2C3AE06BA40D31F416778411846C7E30F845409FDD9613EBAE2295F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493215, "uuid": "99e27410-691d-43b6-99f4-3fa8347b9e1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493215, "uuid": "f45c3ddd-9729-4e92-b6c1-414455ee88dd", "value": "24576:yvflz2QUhWN9xk6lios8tErp+I1oUnTsRTh1MdtTQnA:DhWRFI91qpRN1MdtTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493215, "uuid": "b9832db1-3ce3-47d6-8054-6517fa732cee", "value": 1266688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493215, "uuid": "8de72a94-0fbc-4bff-9cd1-69fe030aaaaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493215, "uuid": "43b813cf-21fc-48f6-91f8-9f39ec040e63", "value": "b270508a8a3eb5dfe22df76f3cf59f3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d477edc7-23f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689524064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524064, "uuid": "931eb5ac-182d-4981-87bc-023cd99f3a98", "comment": "Malware payload (Mirai)", "value": "e26702e11abf902469d8f7cfc39bf012", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524064, "uuid": "5b9d1fad-cfe2-4685-a5c5-7725ba1dbcec", "comment": "Malware payload (Mirai)", "value": "10864605dab9b8322407c1aedc28d0de6f556b018b054adc2ef0e29c158ce554", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524064, "uuid": "88c05146-639c-40a8-b6ff-16b4c7b9b8af", "comment": "Malware payload (Mirai)", "value": "859d6900aff35bc064aea96c0928d7a31780d648", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524064, "uuid": "d81f632c-ff73-4db1-8083-7f1200d75aa2", "comment": "Malware payload (Mirai)", "value": "0ad894eb5f31d7f2701b1279ed4003391185d56c61c351faadc56f2fa973b9932bd6dfe1f6cd6938eff2d94a2d82dd66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524064, "uuid": "3a857d4b-c821-4dc3-a594-70f0be3bfd9c", "value": "T18D33FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524064, "uuid": "8d4679f5-3664-4e48-a673-7119a378c15f", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGr:r/hqaJMcjeqK806MHdMfQXoHuCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689524064, "uuid": "a535e51a-eb68-4a49-99ae-b29e29b1e281", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689524064, "uuid": "3a8a20de-b5f7-45fc-b7da-43ccda466c6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524064, "uuid": "e7bb649a-4c5b-4b21-9a80-903b993ed161", "value": "e26702e11abf902469d8f7cfc39bf012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e3b7d8-23c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1689502650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689502650, "uuid": "07dd45d1-12fa-4bc8-aac3-c681f20880cf", "comment": "Malware payload (DCRat)", "value": "27e28c0509f0685673ae9435e44f163f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689502650, "uuid": "c7ec825c-1c11-425c-aad0-a248f6bb8883", "comment": "Malware payload (DCRat)", "value": "122f5fbdf16a82a90c358ec2e39933e8a5ef43d76cb4fd63ae68863023ecfa01", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689502650, "uuid": "1faa2e4b-a5f8-4226-8269-74131b529454", "comment": "Malware payload (DCRat)", "value": "384c365e6ceff71f94038c19d6dd72451b128576", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689502650, "uuid": "59f84eda-63b5-452e-a364-d07740700341", "comment": "Malware payload (DCRat)", "value": "b0a74c364d54a495e91f19b7211043f8f9d7c8570372c4cf8aafcad6f71931e4652d1b0db32c9c6a5fd56d64a8c709b6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689502650, "uuid": "47984788-384b-4bad-86b9-3883de18faa5", "value": "T1111529027A48DD02D0A91737C9EF901447ACEE427A63DB1A7E9F3BAD65413A71C0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689502650, "uuid": "a63d725e-a950-48ed-aa88-c36729b6b6f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689502650, "uuid": "ce61523c-a966-4114-bae8-ee0fe7bb48ba", "value": "12288:jpLIRXM1We9wDdtSF4j7nvLaMfUyciwQUXUtqRrjK2QSaDcy11wZPiAQqn4:CtUkqRrQH3wZW+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689502650, "uuid": "c82ca685-50ad-43b1-906e-25b10c2ad0a1", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689502650, "uuid": "7c0c9f5a-9cf8-4686-928c-ff4adce4879f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689502650, "uuid": "1cb4844e-3c07-4520-8d8c-869306186c40", "value": "27e28c0509f0685673ae9435e44f163f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e3803e-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491473, "uuid": "8e4b24b0-e6da-42b8-9114-fe362460f28c", "comment": "Malware payload (RedLineStealer)", "value": "15a66b0dbcfb940814f615e4ee68aba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491473, "uuid": "65517f02-30e3-4a6e-9697-a59ffa3b86d2", "comment": "Malware payload (RedLineStealer)", "value": "1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491473, "uuid": "c78f832d-9828-47ce-9f44-5cdb79fdc5cc", "comment": "Malware payload (RedLineStealer)", "value": "176b68418045780c00cfd3d7d80bfbfbfc5d5c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491473, "uuid": "ce7588b4-916f-4f4e-ac75-8f73e9771af0", "comment": "Malware payload (RedLineStealer)", "value": "a10d12e4e54454e311dbd19082e3f4addc621a155196ac59d699dcd4afa461780b0cc1f0016420290c5b7c77f14dfcbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491473, "uuid": "70e61907-6440-45d2-bef9-09b54f52cd0b", "value": "T106152307E3E89833D8799BB008FB078306367C958D7853A76751B95F0CF2694AAB5327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491473, "uuid": "306c1738-64ff-47ae-a33f-0438a93f02f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491473, "uuid": "3d6e43ad-b4cc-48d5-b8ed-7485a06ac76d", "value": "24576:AyTpevOGPbwWB1yeCa0va2vLKpWF8XggzXjeMsP0upbt:H1TGPbceC7mpteM8pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491473, "uuid": "b108cffd-fd74-447b-a21e-81516a4c1480", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491473, "uuid": "61f650b8-dea3-4bfb-a3c3-2d9a30da70ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491473, "uuid": "71df5911-9947-4555-a838-19885102ee2b", "value": "15a66b0dbcfb940814f615e4ee68aba4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7913c3-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689493370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493370, "uuid": "16820287-f151-421d-89fa-caab9939b998", "comment": "Malware payload", "value": "899609862bcca28ec826a51df67d8281", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493370, "uuid": "615bf031-19c1-43b8-bece-cbadc8d518d6", "comment": "Malware payload", "value": "125eb618199657cc304f550654d76ebc9e91105e2ce6c5ef2591a3f94f6b5efc", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493370, "uuid": "d3989fee-c70c-4c97-a20b-7a69d52798ad", "comment": "Malware payload", "value": "131cd1aa9cd2c3b1890b81fb613636787ce9db53", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493370, "uuid": "13b595a6-1497-4e31-b24e-64f3b0ffc1b1", "comment": "Malware payload", "value": "19966ec5bca48c2b64bbc505def1e6edf0327a194f3aa7d903f0cf28211607669e4b0c3addbff9827ecd74f083dda2c5", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493370, "uuid": "b5a4841c-015c-4b11-9bf4-4a953781817f", "value": "T15C741224BA46D78AD047E53249B7A15E465AFD98CFCAA883318C7F4F8570F80E513A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493370, "uuid": "27bc5396-378a-441f-83b9-d7275106adf4", "value": "6144:sZoXunrZP8VNZ3ZP8VNaAkOPWxkQqxFASRyM/G6KYNH1FWRhg8P8XvTUIO7EWLMN:sZoiB8VXF8VsArQAFhi6KYF1FWoq8fTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493370, "uuid": "18a36451-fcdd-4e1b-845e-dda741fa75ee", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493370, "uuid": "1076d6f8-3540-4a8f-a466-b42232afef8b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493370, "uuid": "abd9d775-db92-4903-ae92-41ffa92581e8", "value": "FACTURA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b934d90-23b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689496776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689496776, "uuid": "938f673b-a50c-4ab1-938e-2bc505594fb4", "comment": "Malware payload", "value": "df229a8fb8d0418706b7f57212256ed7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689496776, "uuid": "06bb7817-65be-4e30-b6d0-81585fa014a3", "comment": "Malware payload", "value": "13034e530c5c0544bc69caebe012d2ced7cc82f82de77df34a026d268df62303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689496776, "uuid": "adb8beb4-8bc3-4c8a-ba60-5dc52728513a", "comment": "Malware payload", "value": "81d14af5494a969572d8217357717612061b58b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689496776, "uuid": "7838c0cb-9d24-410f-b37c-ae011e838a53", "comment": "Malware payload", "value": "ef295d4df06baafd8838b934c4343be6e40222583ca3a6669a1aa2a4da9191c02cb839498c94562f9b0f1c457a90019f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689496776, "uuid": "48d3882c-ac2b-4352-8d6d-c5b0ef3dff0f", "value": "T1C173F746E9419B02D4C321BAFB9F514933536FA8E3FA71129D249F6013CB9EB0F76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689496776, "uuid": "ebcd1298-2abe-4eeb-97be-0661458d0732", "value": "1536:hWnPwc6X98EpXxyMnjase9Lgqbv1ruGlPyVFiZ84kbfzY710av1w6:+wc8SEpBDnjase9LgqbZA+84kbfzK0J6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689496776, "uuid": "f28b7a67-fd8d-4011-9513-632629bf6c18", "value": 78380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689496776, "uuid": "b9be9bad-989d-4939-8586-44c01f6166d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689496776, "uuid": "59848a2e-4795-4f2c-9b1f-63edb48a4549", "value": "SecuriteInfo.com.ELF.Mirai-CFO.20663.18006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bd3e17-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689493495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493495, "uuid": "5e95dd7b-a836-40ed-a375-afdae10d3591", "comment": "Malware payload", "value": "a76aa8e16e4ba0db945e6df0d8e945ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493495, "uuid": "79f403ef-76dd-4f65-b49e-71dac372a734", "comment": "Malware payload", "value": "131d1481b01cc718f79404878bb9822237c5c503ccd21d9839214c6f5d8d54e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493495, "uuid": "d662eabf-9ff2-4f1f-b464-c160efde6ab5", "comment": "Malware payload", "value": "be3310168cce7b5e1f941de0b217b8beebd46555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493495, "uuid": "09b501a8-f7ea-4e5d-bb60-0491fa9d6a22", "comment": "Malware payload", "value": "14a3e2535f0c034466dd04ee009d16095d2b1f2322614c1a341da8c999fd1b49e2933c3df0f3b128f45b729dec8d6366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493495, "uuid": "c2f92eef-d510-4c3b-a0f0-e0d4db570014", "value": "T140D423A303851D19E5B42AFB48451ECDA7A023D47A90066FF8F1526F9B3785D22B3DF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493495, "uuid": "b491760a-0d1a-4d81-a291-fdf8841357a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493495, "uuid": "7fce2872-024f-4ad6-993f-92facd29b34e", "value": "12288:Wv96xiNIpLhxjz9trg7XuGul7CoLPUHxSqG16OHxcb:WIcNIrxP3g7XuGu/bUR+1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493495, "uuid": "cfd4944b-65c4-4e3e-8b17-18238e42a9bd", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493495, "uuid": "560f4250-7aa3-449e-b310-485557fbc90f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493495, "uuid": "7ec8f27a-ead5-4a28-925a-18c2d5eb01ee", "value": "a76aa8e16e4ba0db945e6df0d8e945ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5171adb3-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529857, "uuid": "f30c9b7f-4c50-458c-8000-d25afd49b72b", "comment": "Malware payload (Mirai)", "value": "61154a3069d714e1dee638b1a32bc3f6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529857, "uuid": "a29c7036-28da-47a8-9307-48b2bd15a4af", "comment": "Malware payload (Mirai)", "value": "133120fc99b7a7e1832ea4311ad05735dd04c52e3d820efca6c5d86a49c2270e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529857, "uuid": "ab6f1b07-8a2b-415c-8bba-2b6a6703494d", "comment": "Malware payload (Mirai)", "value": "f3b39f08c2775f966ad1713bdf25615e0245b2de", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529857, "uuid": "54c2ee3c-3d2f-44cb-873e-9e35ba8105e1", "comment": "Malware payload (Mirai)", "value": "355a6a46672443daa1d7262b06fe53f981da57ca9b97465a57702aaaa9ff87dc22b924faf85d1ab874ad0edff7d7bf3e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529857, "uuid": "b3e0b8e7-3422-4029-a52d-f93a05b00a01", "value": "T158D2D0AA81E7F1B8C4EAA5B5043D07C5EDB67216C1295BB70CED3166DF130D94E30EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529857, "uuid": "bc22d992-181b-4887-ae18-7dc4fa8eafa4", "value": "768:SYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBdvrs0Sx0sA:SYJdJZiy1aBnQfTqBdTsPtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529857, "uuid": "e8ead882-a440-4801-ae88-f07e92b963e6", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529857, "uuid": "1036c2bc-03e8-4917-814b-af89ea485907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529857, "uuid": "9bcabc0b-8db0-4caf-8f95-025afe20ecb1", "value": "61154a3069d714e1dee638b1a32bc3f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6ab631-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492132, "uuid": "7f8590b0-643f-4c36-b9ab-ff17b2fa5949", "comment": "Malware payload (Amadey)", "value": "403f11948d871fa97dc5a76c28cc70e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492132, "uuid": "e06575db-572f-47cf-8317-ca6d95cf3b47", "comment": "Malware payload (Amadey)", "value": "13d52f4b0cc41efc7f2f4057210ff3b94f85cea5b210505283284f44d1a1c35b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492132, "uuid": "3f154abc-077f-4d0b-97e4-d054df9dda2b", "comment": "Malware payload (Amadey)", "value": "12dc466c38f1bba8f398104ea0dcc946a97b0009", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492132, "uuid": "b7464b6d-5d1b-4b56-a6c6-7d0a73a8f5e1", "comment": "Malware payload (Amadey)", "value": "e0fdce38101a7b3ffd7e29bd634cebd745355fe17de445f622451abefd55e933019bf714590674a14d67c278bde75b46", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492132, "uuid": "2b738211-d5dd-4d0b-b8d7-c34cddd47457", "value": "T1084408C392917C5CEA268B369E1FC2E8760DF650CF49BB6572189E1F10B5172C2EFA50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492132, "uuid": "bb30574a-8d23-435c-b53c-e86657564e89", "value": "171ca87c7d79f90a7375ae3063387bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492132, "uuid": "0ca8173c-97bb-462a-a7b6-ae7ace8ae196", "value": "3072:dOLtBb+tBuyu/Cd4NGW1kKbx2vZJH/5CFwlg:YLtx+tdGJoWUBKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492132, "uuid": "94a68200-0cf9-40be-8d6e-7a95bbce1eec", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492132, "uuid": "0da6bd40-faea-4717-a50a-200209d57c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492132, "uuid": "7c276435-6120-4428-b74c-9be063dbf8a1", "value": "403f11948d871fa97dc5a76c28cc70e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75980c24-23cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1689507584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507584, "uuid": "fb8fea57-6726-4b4b-ab03-5ca955ef6e57", "comment": "Malware payload (GCleaner)", "value": "f9a4befcf93140bc91d85bec5fa6471a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507584, "uuid": "877174ac-f200-4c81-975a-aad4ab1ce51c", "comment": "Malware payload (GCleaner)", "value": "14199a90887a9f26023cce0bee4b377a163424c38c48ea7ac3fd5085034fd644", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507584, "uuid": "627c510f-3986-431f-b01d-1c4143ff4a2d", "comment": "Malware payload (GCleaner)", "value": "f78a1dd1763164be5b98a50c92f0670493714ac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507584, "uuid": "7a399569-9dc1-4898-8a58-489f5bbd82b4", "comment": "Malware payload (GCleaner)", "value": "e4b2dbcd74f17d67bffdc306c35af18d9ceef2c1e5a5f86e14a26178d44ccfd26f72f17cb58c4255bd24a9f26e6ed2c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507584, "uuid": "e4c1ff79-d50b-4a3e-baff-389a163e6d33", "value": "T10C85330737A82AB8F4A09DB53FA1D65E67BFFD0BF435391832EC854D174EA498406B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507584, "uuid": "cc595cb8-8958-426a-98a1-291fa63976a8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507584, "uuid": "2cd767a5-0caa-4c23-9839-de7091e72688", "value": "24576:d2lWLzyNJP87HwWyqNPXf224+Vhe2HiRdeFtPQMl7z3fcnIRJUltIi+JhwubvEM6:d2YLzyPDWyqPO24LfkpQYHvBJaIi+RB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689507584, "uuid": "432bb4ef-b350-43c2-8b5d-5d6e3af66eb4", "value": 1721251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689507584, "uuid": "5bf3339a-7f38-4160-8bc9-8dd04b4cd127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507584, "uuid": "e56edd6c-4d6c-4686-a6af-d22949cc55ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f882ffd5-23ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1689508233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508233, "uuid": "d1ed44e8-8b5a-4fbd-ae97-2768dbb63624", "comment": "Malware payload (Smoke Loader)", "value": "0314f94cd8e7e09f8c8cc38b66583cf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508233, "uuid": "dd786323-4ae7-4feb-96a8-fb22b31a2dd0", "comment": "Malware payload (Smoke Loader)", "value": "1788b1a07815d0fe3a38efbb4a4706d9c4cff09ea145cef0e2b658217d95725c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508233, "uuid": "83435585-f1a7-4bec-80f0-4567cb019906", "comment": "Malware payload (Smoke Loader)", "value": "66c9985ea29ee86ffb6b051502143f181a3cd045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508233, "uuid": "a27d5060-c102-4d61-a6e5-c602280325a7", "comment": "Malware payload (Smoke Loader)", "value": "9f989bde374292d62f62d6d5b5621de91027330894ebd0e979b5c4bb7789cbd168e667aa2a6c06928660eda3bb73ada8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508233, "uuid": "86f6827a-0ae2-4e89-a0ef-75f785ac4f8c", "value": "T17E64834392E17D48EA268F769F1FC6E8B70FF6508F497B65B118DB2B00B1076D263A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508233, "uuid": "51af07f5-084d-4881-8427-4229290bd871", "value": "326441378ca815656cabd6c06990bf3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508233, "uuid": "0a768212-9a95-42fc-99e8-348d953a0034", "value": "3072:fNLzBkHRHKDdyzZyqijftTguE4oegjc5CnctgwlgZDGW:FLzl44b1247G38gFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689508233, "uuid": "049e73c1-adcb-499e-a02c-8fb35650d375", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689508233, "uuid": "979f856c-bbf6-4b65-85e0-b6f585458a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508233, "uuid": "5c561911-f419-4061-a470-d12914bc50a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0ba464-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495918, "uuid": "51b161a1-d4fd-4c5a-8704-aa7716fa1a69", "comment": "Malware payload (Mirai)", "value": "8a5af38810d318a6b29c5ac9b3e3ba21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495918, "uuid": "306ab871-b326-4373-bf11-1094101d4e10", "comment": "Malware payload (Mirai)", "value": "17d99cf566050fdaa10a59bed7840a606ed3d25983cac9986e2b91685fcf2446", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495918, "uuid": "adebcbf0-ec3c-4777-9a3a-2c17c18e179f", "comment": "Malware payload (Mirai)", "value": "9815277a144d066da375129b1d2d0da6ebba277c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495918, "uuid": "84233932-51a8-4546-9918-fb1e9cdd29f0", "comment": "Malware payload (Mirai)", "value": "57cd6ddab23690fd518565c97cdf7b5393e7042522b26d983d531837486d2bd2b36edd0b59acfeded432ef571a0ff78f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495918, "uuid": "d47b12cd-f5aa-4b71-ad2d-b905e2e2c190", "value": "T1BDE32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495918, "uuid": "338c5604-202d-4b27-b8b3-473fe36f0c7b", "value": "3072:Cv/WwsLgaq353qHiCOvhOphqkDQHbeskmhxQwoVSUNu:KPLaq351hOphqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495918, "uuid": "9cc5db56-8052-47d4-b130-da1a797f9e5a", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495918, "uuid": "52dd0b4a-7673-4a1c-868e-1e8d54a96edc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495918, "uuid": "0c9a2340-70d4-4f7c-8240-788dcd44defd", "value": "8a5af38810d318a6b29c5ac9b3e3ba21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707a3040-23f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689522608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522608, "uuid": "43fcfe57-79a4-4dd0-82da-3ed85de0eddf", "comment": "Malware payload (Mirai)", "value": "41ab7a308663491ad03698e15abf2c39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522608, "uuid": "f05f7e63-0509-4efa-8a0d-0828e1c10b30", "comment": "Malware payload (Mirai)", "value": "182105f05467b93086e18a2f319fc6bb32bc4af05e48d03c39d0f4c1ffd4263e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522608, "uuid": "745aa3f9-ff87-400c-af6c-f9d5774ef876", "comment": "Malware payload (Mirai)", "value": "58ca2725555bea31c7293017bc1cde60a8570c62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522608, "uuid": "8fd3e6f3-ba30-4cd5-b3bf-ea68ba2e77f1", "comment": "Malware payload (Mirai)", "value": "06428380a200e12aa9efabc492f4faca5a12cecac8370619beb896dd3efa8780d941ed197113926df8672b507a4334ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689522608, "uuid": "df5135d3-4921-4c01-a398-079a2acb3cc1", "value": "T1E7230271890E9DF124303C76EE95D79376E019B1C6673013D6280A3C2F797531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689522608, "uuid": "54e52ed6-34d1-4f1c-8461-055fe7c6c36d", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3CGY9q3UELbUXfi6nVMQHI4vcGpvu:DECFd+A6YHAxCyLRQZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689522608, "uuid": "b7d10a7e-4189-4b4e-b4c9-29e4789ea419", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689522608, "uuid": "3e06b3f7-19b4-4e61-8fcf-6c579a2c4e7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689522608, "uuid": "3a3b5aca-1c0d-4d55-93d9-6296efc8a0fe", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbfed48-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1689491704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491704, "uuid": "fa5fcda0-5c44-4697-a80a-d1f1dd45e9ea", "comment": "Malware payload (LummaStealer)", "value": "ab9327fce682d578e28456820e0d9baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491704, "uuid": "065c73aa-4e09-4c29-a511-75748e0ff1be", "comment": "Malware payload (LummaStealer)", "value": "1915d244bae2707f6531ea7ffc0fb7708f7cafcf2aa354223ea8112064b18eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491704, "uuid": "53e6764e-86ee-42c7-93ec-a8512b989325", "comment": "Malware payload (LummaStealer)", "value": "48696ea54a5960a3f9bbbf96819a150ad93c33c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491704, "uuid": "1bc09c7f-b82b-4f79-a833-bdc81db33930", "comment": "Malware payload (LummaStealer)", "value": "ae382f256a4ef4a663e28afde919b961e3711de621d9ecb2cc4034bdb8e43527454e400e661a2997b97434150dd6a095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491704, "uuid": "c7ba62d6-7d11-468e-9320-fd5c410c304a", "value": "T13A847C03B291FD54E915CB32DE2EC2E87A0DF5509E497BBD222AAE2F50B3172D163714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491704, "uuid": "d1c73e31-def5-4433-939a-7dc32ece3d01", "value": "c55238e8720aed638c6e29c3199f0503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491704, "uuid": "0fa23e84-2bac-41de-aed3-7558eb496435", "value": "6144:uL7hfgYIwTFqa6OL93LfhvWbU7VGz7VeCuq/WQomNaTvjF:uHhoYIwTFgaLfsbe+ReCuq/3Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491704, "uuid": "056003c7-c7fb-4fdf-8a95-7de8103fbf55", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491704, "uuid": "9be576ab-3a80-4a55-baa5-d4e62415b535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491704, "uuid": "0fe3821d-45f5-4df5-9735-90444abb7061", "value": "ab9327fce682d578e28456820e0d9baa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5ecb66-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492727, "uuid": "33a78e0d-cb9b-4488-a82c-2dccf47fe5cc", "comment": "Malware payload (RedLineStealer)", "value": "d087396942c0aa4b24ec66d846751793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492727, "uuid": "22725f56-c4a5-4b83-897f-4a91fdfeb197", "comment": "Malware payload (RedLineStealer)", "value": "19375674110f6fe0e4feafdf44cda36113805e23b4456a5968c157317989f6e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492727, "uuid": "67a34c7e-46fc-483c-85e3-a1f3a4bc704c", "comment": "Malware payload (RedLineStealer)", "value": "5f3285a899c11ecfb304a479d9524cb63e2bd580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492727, "uuid": "b8ba8a9d-2153-4cb1-8c29-5104f2507a6e", "comment": "Malware payload (RedLineStealer)", "value": "a42e866bd1a1c308b519badbd718f960b4a14b55cc4096153276380bf7838abaa26610275d73f9af4194cdaf894f31aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492727, "uuid": "23c78e69-7f53-4242-a551-7abac9d01319", "value": "T1AD152306F7C98176E8F01B708CF607830E397C628E79C35A2F58A95A1D726C1697237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492727, "uuid": "53bedc51-9905-4b9b-a446-7ea3e0090817", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492727, "uuid": "89f752b4-0f64-453e-a59e-5cb75c1a6cce", "value": "24576:pysrnuV6T/VBCLBAt5IUrLAKzbTbqvIZD:csrnuV6T/VBX5RjzbfqvIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492727, "uuid": "466e4a82-ecb3-48a0-bd21-3f2516d542e5", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492727, "uuid": "bd1f1ae9-21bc-440b-b273-098a8701cab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492727, "uuid": "8c918b4a-b45d-4d44-9666-fbccee794a60", "value": "d087396942c0aa4b24ec66d846751793.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aed9e0a-2397-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689484212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689484212, "uuid": "d2bf45d2-3dd4-42fb-8a40-fe286d3f7256", "comment": "Malware payload (AgentTesla)", "value": "6866244119d607e5bef5b9e649619f54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689484212, "uuid": "c4090dd4-e5ad-43cd-bafd-82fb9072b7c1", "comment": "Malware payload (AgentTesla)", "value": "19bacd1accc21bdc4d1c38668252c42c0a09ea36b915a66496cc47a07b826a26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689484212, "uuid": "dff125fe-0def-4a12-a986-f491c245dbc1", "comment": "Malware payload (AgentTesla)", "value": "56d4519f4bfe6edba39a10b6327008f38783d712", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689484212, "uuid": "3bc104af-96e0-49ba-9827-b98a0ddc2693", "comment": "Malware payload (AgentTesla)", "value": "3161b3a7a9cc8ffd61f563256f7c21ec4975e870306d7515d8c6adadf3491b02c86ae2576b587ef1338292a164d3a519", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689484212, "uuid": "340909eb-06fb-4820-a7f3-51e2cd6c3060", "value": "T195542212B6D8C89BF8EF2A7158BA62117EFDB61074B8276F33805F4D3CC6680C949746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689484212, "uuid": "8c5b89d6-7f3b-4484-a07d-21fbcfd93867", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689484212, "uuid": "49936597-2833-43f7-9b38-7d937303034e", "value": "6144:/Ya6JDLp+0N7jp+2LF9nsy7rUlR7czcBc9Lk9lcjsp8mZGdGELFNW9vn:/Yjn8yj02hzszdfRZGYELFNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689484212, "uuid": "632fa316-9435-4a70-9555-fe944adff8e7", "value": 300533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689484212, "uuid": "f4315e3c-2934-4178-a272-1071519c1693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689484212, "uuid": "153d6878-947b-4e78-8cc0-a8d1bb9c7405", "value": "6866244119d607e5bef5b9e649619f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d76a5a8-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467251, "uuid": "944e3f21-5079-46c3-b6bd-594d32f2b8a9", "comment": "Malware payload", "value": "6a53167cc1fc4cf1c68f592f9e5a428f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467251, "uuid": "14ea6f0e-8a07-40b8-8048-717d9cbac80e", "comment": "Malware payload", "value": "1baba422186830060f5297738ee0bf24b8f1fb4415f801a85446d27fda919e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467251, "uuid": "0b4dbbda-2818-4d2c-ab43-3c0ef06769a0", "comment": "Malware payload", "value": "72b552ae5fbc2278e2f6b46a8f0b8f76c6885a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467251, "uuid": "e7791af8-e3e9-440b-954a-ca397800987c", "comment": "Malware payload", "value": "a3d57360076e11b1b37165e9c37c696cd0692a72855600cfe8bb2cf3b8ff4d7a453e61996d9cb216c0d53a1baa498420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467251, "uuid": "a02496dd-86b6-473f-a1ef-dee4b69f9e60", "value": "T1E6849D373AA2C279D17121704F36A76676F5AC304C769903BBE40D9C9931DB2AE36326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467251, "uuid": "ef2eceb1-1a70-4940-8f85-39a1570a4a95", "value": "d5ecefde1649f9fd2cc6a39dc14f0076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467251, "uuid": "63e679c2-b5bd-4e56-83c8-e8cd641225c9", "value": "6144:guKBkP1+K0Jag6uxMaThEARBVET3hmRZ9T9ZXC+Udz7ADNl/A:0koKFTuKaTq7ccdgDNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467251, "uuid": "9ca1b7be-e8ac-422f-b302-73dcefe39bc1", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467251, "uuid": "e1c437e4-8ca8-4469-9c68-a53a2d77c560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467251, "uuid": "37a07b70-3e81-4005-921a-761645e027bc", "value": "SecuriteInfo.com.BScope.Trojan.Download.24464.15417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c803f55-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493046, "uuid": "13f8f62e-606e-42bf-ac46-5581cd2465ba", "comment": "Malware payload (Amadey)", "value": "ca1a4178d3e7ed91e93b3af5fba007eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493046, "uuid": "da89c259-ae8b-46b5-88e2-93f5b4f78aea", "comment": "Malware payload (Amadey)", "value": "1c0edec1d3898fb9d014caa5d10488f9e64f9cb4570d15553c65cbee9e0951a0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493046, "uuid": "acca8a8d-7432-4b05-b37c-f1ab1476419a", "comment": "Malware payload (Amadey)", "value": "5ab095a32b573f47611740a367859d5a7a814b94", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493046, "uuid": "d582ac5b-ae55-4452-bd9b-c737754f2023", "comment": "Malware payload (Amadey)", "value": "b7cf295056a65197fa7838ebaab5348e0a5c2baacb22316e94546da464e3d314cd6695c84616fe7d9382e42e40c8231f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493046, "uuid": "7f84fc32-efed-4f85-885f-ddc7be6690d5", "value": "T161452352F7F2A532D9B85FB008FA038727367DA2BC5843533786E50148B2699E97076F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493046, "uuid": "9a3552a3-0713-4039-8af3-f2b4102c24aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493046, "uuid": "97ef7fc1-8e00-44e6-94d0-7881bdce5159", "value": "24576:kyE92aPUXfOFKGbzEYIRhTFzR1AhPkk/ELiNJE9U:zE9tPEfOFKGbwLhfOhHsL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493046, "uuid": "adaf2b3e-5587-4d21-b0aa-5d2e2190b545", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493046, "uuid": "92be8653-97da-4e0d-b34d-47da68ef0289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493046, "uuid": "15a33d10-aeef-4a4b-8bbc-91f03b0e8cc4", "value": "ca1a4178d3e7ed91e93b3af5fba007eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250512a2-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492416, "uuid": "f1e92508-58b5-4945-9c57-b72e632f7ec2", "comment": "Malware payload (RedLineStealer)", "value": "87208319cd061386896a174f99bb59f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492416, "uuid": "f5d98d4c-7303-4812-879e-05ae37ce14a2", "comment": "Malware payload (RedLineStealer)", "value": "1d19268c9e4c8021357af9212150dd8ebf9f5520581d96ef43c7633c69576a79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492416, "uuid": "47f4b6b9-333e-4195-9ad9-149fe5e03df5", "comment": "Malware payload (RedLineStealer)", "value": "6a60824ceb67a5806d214b430f24c755a914a490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492416, "uuid": "b6f52888-05f6-462d-963a-1c9994796c0e", "comment": "Malware payload (RedLineStealer)", "value": "1614809e640ab41fc8cde15fb0aebe9fcec90a7b0ccbddde1adfe29cf952cdb2bc42455c5604e298ea5aade6f2704306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492416, "uuid": "dda0caa9-9a79-4342-887d-896b06841b9d", "value": "T159252316A7D44473C9721B7058FF07C3073ABCA2C8B45A14679BACEE3EB26946871367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492416, "uuid": "e3a2a90f-ed20-478d-9574-c21eec04f098", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492416, "uuid": "6f0074ad-9dfd-4144-b4b8-6177bff5a106", "value": "24576:HyRTF4cd0emnnE/wSqsdFq+AHAU0EGLmSUdLpgB:SzXdgCOHOEGLOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492416, "uuid": "664590b7-f935-445e-803e-ac6299838853", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492416, "uuid": "e48cec8a-bc82-49e2-92af-b28047009c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492416, "uuid": "b34002cd-1aec-4e67-8c9e-938a756e9158", "value": "87208319cd061386896a174f99bb59f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a914d8e-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493311, "uuid": "0607da33-f610-4bc8-85b5-171c79ac098f", "comment": "Malware payload (Amadey)", "value": "eaafafd538a48e326c24543e7c71fdc5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493311, "uuid": "99bd1904-f62c-4f07-93b9-e7902094b0e6", "comment": "Malware payload (Amadey)", "value": "1d27b30185b25321be419d3f83fe1ac7c233503a6036ba957f7e532bfe480042", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493311, "uuid": "013c0652-eaad-40f2-b3be-8590d93e5c49", "comment": "Malware payload (Amadey)", "value": "6c6b9803ab2ee1dccb2f34b986e9b8db45117770", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493311, "uuid": "671e625f-ef1a-4029-affc-4d372e9e94aa", "comment": "Malware payload (Amadey)", "value": "91b27b6bd0e1fec1d856dfa5bf844f81d4b84e4f87737fa3f0df192b40969ab5559acb2d4fedb524f7f48fc998924ac0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493311, "uuid": "5db54899-00bd-48c9-92b7-5ce608742b23", "value": "T13D152313EFD491B2D4B9677088F303C31635BC759CB4826616886A6E8CB27A0E977377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493311, "uuid": "eeb96035-1905-423a-8e25-6204a5a864f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493311, "uuid": "a4c4849f-361b-43e0-82a1-9c92219fe4e4", "value": "24576:7yMypcfnTVAf/PsxQUqDR0uT1IjMuMgS:uQTWfXsxQFuY1IjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493311, "uuid": "ea13ab0a-9b14-46a5-a52a-e0818071a392", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493311, "uuid": "9219f11b-3db5-4e20-9c65-02771909e995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493311, "uuid": "4910b335-fe39-43e7-92ef-cf61684a5da7", "value": "eaafafd538a48e326c24543e7c71fdc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86327ec8-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467239, "uuid": "2373d65f-a7c6-41a3-ba3e-871c69e8c332", "comment": "Malware payload", "value": "56f8276309db022fd6f72298709d87e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467239, "uuid": "f17d7c5a-84f3-49c7-b23f-9d75e73e3e53", "comment": "Malware payload", "value": "21057d8aa048b79e4d2a66ddef757636c3f9558a06922c05249783bb706cd7d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467239, "uuid": "f8849348-2767-41b1-915f-28bd68347947", "comment": "Malware payload", "value": "43a1a50dd67a441661495e400cdce92b56047f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467239, "uuid": "8ea5ec16-8904-44b4-9e27-1400e93a3e07", "comment": "Malware payload", "value": "7819ae3976905017002e7a9d51bd04dcdcbb77784cc813dec48c5ccf4ecad89d1848982cc4a6557492a415ea8923c6b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467239, "uuid": "97c38188-6217-4e71-84c5-a9d9cbb72a9d", "value": "T17966BF08F71385B5E385E9F4DE66577D3AFA7EA385D4950BE3A4BEB20D70310A2880D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467239, "uuid": "6817b0ad-a9b9-4c15-b5e0-7b00e334e0de", "value": "49152:s5gtqLxFuO1i40DGUmKMDbWwEEceEKZI3EaFjIJtZXX9VYKasd4607nL/sn88ZnK:dcLl8N8RF/+Y0LMZndJBAUZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467239, "uuid": "e54bdcb3-6a76-4a56-8247-44edc1e84147", "value": 6966784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467239, "uuid": "0f1d3cd1-03f0-4862-a44d-2486c3633a4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467239, "uuid": "42e90eb2-b9bb-484c-9013-877baa02361f", "value": "SecuriteInfo.com.Variant.Razy.578198.11014.32330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2bfb4a-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493042, "uuid": "b2827494-fba5-4fd2-bab7-880c2e808588", "comment": "Malware payload (Amadey)", "value": "e58b9a817894b2a2817290a02854611a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493042, "uuid": "66380950-357d-479b-b945-355ab159f931", "comment": "Malware payload (Amadey)", "value": "2110d08aa16f5bc839ad8d258c47cb25841f64ad5ea0f630af88640b650d8951", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493042, "uuid": "39f88fec-f9c7-4290-bf19-c9a02299565d", "comment": "Malware payload (Amadey)", "value": "6e32c54551e98cc1a0aa3a330301e2e9215d3747", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493042, "uuid": "1aef8ef6-eba2-465a-8b51-179ace3fcb58", "comment": "Malware payload (Amadey)", "value": "d902d56f6aca8041540994f4be88d3dfcb5667f2e06f82001296dde7f14a56ed7caa8123fbe2cf55d0c04a4fbfcbea4c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493042, "uuid": "e1a6b1d9-22d7-492e-84e1-681e5f0559fe", "value": "T12615238AB2D66573E1354FB06CF183430B397CA21D29975F2244292F4EF379499B237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493042, "uuid": "c7644c65-c89b-4230-a0f6-f73c6a3cafef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493042, "uuid": "8ce0bbfc-0d2b-414c-b4e2-a3c0f51d503d", "value": "24576:Uygq/rnidj0+xZz2X59l3gHYmD49s9OyK0:jf/ridxz2pGYmU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493042, "uuid": "2d183b2a-33d2-4862-b57a-814ce34f66fc", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493042, "uuid": "5ea5c748-bf84-4b81-86df-45100f2c774a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493042, "uuid": "5e88b246-ca7d-4b3e-a679-91a2b00b5047", "value": "e58b9a817894b2a2817290a02854611a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d25683-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492715, "uuid": "414c08e6-bac1-448a-b8c1-1226e2bd9af2", "comment": "Malware payload (RedLineStealer)", "value": "913372a73a1f952c41762a0ea1f91a37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492715, "uuid": "897bef7b-f2b8-452b-a60a-47cc5bd70e35", "comment": "Malware payload (RedLineStealer)", "value": "21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492715, "uuid": "c4cd7122-baf0-432f-a53a-36f1b080a577", "comment": "Malware payload (RedLineStealer)", "value": "d02ec459307a0847637f788a5e2e33c732f42f31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492715, "uuid": "608fae79-a430-4acc-9ddf-6b6e5fb73216", "comment": "Malware payload (RedLineStealer)", "value": "0c9ead2545d32048e762a5f961c0478e17cd133484f9ff162421591230c487ec264e1ee6f2cb7ccbf36a9391dd699a55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492715, "uuid": "89834a8c-c7fc-4adf-8429-f119b3687048", "value": "T11345235267EE1035FC7017B428FA03C34E3A7D167D34AA6F1720EC591DB29589439B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492715, "uuid": "ea7055b9-f633-44a7-b8a0-7c777abe2e21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492715, "uuid": "b2954d4a-4551-43f7-a461-ce46a67216c3", "value": "24576:yy82uVKaX0hGaGcr+Osx1QVB1ZyuItcIZ2v8i09g3K/03u:Z82qKu+9+fQVBOcIHx9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492715, "uuid": "029746b0-db97-48d2-a8d4-f9db0cc99981", "value": 1214976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492715, "uuid": "076cc48d-ed10-4632-a78a-d9a71c15031f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492715, "uuid": "08c19c98-a26a-446b-b2d5-11fc7e4d2344", "value": "913372a73a1f952c41762a0ea1f91a37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84638864-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467236, "uuid": "e227ebf6-2b5b-492f-9192-8f4994af7107", "comment": "Malware payload", "value": "4971cfae3e8a66e566ccda62c4b69777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467236, "uuid": "4e0c738a-fe94-43ad-bb9c-3d775f32f47c", "comment": "Malware payload", "value": "22b99ceeefc068386a2017a27ef889fe1c084d910da355416210195cdb59de06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467236, "uuid": "6c1ea331-e7db-42cf-8677-5e8a8ef9e0a7", "comment": "Malware payload", "value": "97f393f0c464b4ca75e725b1cbb33114c8082be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467236, "uuid": "8b43edd1-8191-4bbe-a2b1-93f29d126616", "comment": "Malware payload", "value": "820eb6b281f71facc3cf199ac06915542b4800290ad25ed60e18a2dec99d3b629a5e88ce416e18bf79f5a4357ba7be6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467236, "uuid": "53e5045c-6e87-4bd1-ac90-9a9392597107", "value": "T1DE5412A8BF230D76DC3827329C0AD7651353AC33C17913EF29F1B1413BBE522656A968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467236, "uuid": "96c6bb91-a45d-4059-af34-c99251339d55", "value": "6144:L3cmCneM7yD3laV/Zh8h03577OJd/p9uPzWP:QmIV7mu/L8iO+PaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467236, "uuid": "76b4d224-33b1-4720-bd35-ed306b11d1d8", "value": 286136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467236, "uuid": "d97e10c0-3251-4633-acd0-c38a13d1feb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467236, "uuid": "d3c3e29f-c8d5-43ab-ae85-32d41e1e4b09", "value": "SecuriteInfo.com.Trojan.Generic.329897.1510.28679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4f1eb7-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493044, "uuid": "288724b5-95c5-4e3f-bb34-b39da3ef81a5", "comment": "Malware payload (RedLineStealer)", "value": "caf67a235aff6164000664cb7e18dd02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493044, "uuid": "497ae392-b108-4b91-a157-f977d629d32f", "comment": "Malware payload (RedLineStealer)", "value": "2589fcd19afe7a4fbeb7dd3ac13881587cb0132f8d780bfebbee3a4467361655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493044, "uuid": "a7e497e8-1033-4c2a-bcfc-b1489f401926", "comment": "Malware payload (RedLineStealer)", "value": "5ba248a905ca037f553fe957a3b3aadcf2b0bc03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493044, "uuid": "9657a18d-58f6-474b-96b0-30294aa698ad", "comment": "Malware payload (RedLineStealer)", "value": "fa6f77b312ea6ed794ed8ff2f6179c0497455f6da3a4f12c719daf92ca74d2cb2b76e152b24c82b47bc774f2e2a1bcd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493044, "uuid": "df0c4a94-45e1-44cc-a698-522e060155b3", "value": "T1E445230267E49472D8BB57B01DF657831B317CA5ACA8439B27956C632DB22C4F93233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493044, "uuid": "82ea62fc-7d94-4702-b577-561c6d4b392e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493044, "uuid": "7ad08e10-2ab9-467a-a68f-e4d40486645c", "value": "24576:5yg9yAiWSXqj1RlEmDPaYOLkZtMhRCto1q9+w5JA9MAu+vu+u07arsKQaULgk6:sgBoqxHO3LhTF1y+V9MAu4k4KQaUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493044, "uuid": "ba53234a-c301-47aa-a39e-c2670c1bb945", "value": 1217024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493044, "uuid": "4598b1cf-1fbd-4a11-ad10-e12e08c8afb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493044, "uuid": "e1b39c9c-c536-4363-a870-16e1aebee235", "value": "caf67a235aff6164000664cb7e18dd02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5f509b-241e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689542358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689542358, "uuid": "acc9a481-d62f-4b29-b97a-4c1fce63e252", "comment": "Malware payload", "value": "7e47e3cf4a3b549238725b755190876e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689542358, "uuid": "aed5734f-fc5b-4e32-8f0f-982cbbdf715e", "comment": "Malware payload", "value": "265560df14513c5fdd9779cf5324c68d3f83e275223dd5d467a4dfbf714a3256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689542358, "uuid": "278b0f5e-bc30-4672-9f6a-a834416ae9e6", "comment": "Malware payload", "value": "0e3f2d4c27c7025d3f7ea14f9fb4c20c273eb477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689542358, "uuid": "f1b71e6b-eb80-445c-bdff-fe3d543628fb", "comment": "Malware payload", "value": "dedd2bb86ab5d4727c69e6dfb550e1e3a8d9059e8e147631812c4c6bea5692d5f9c84b7344f44698dee10c49fef41246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689542358, "uuid": "3a8371bf-2460-4b24-a984-231b78dbb43d", "value": "T11A726C04AFEC825BE2DF0F799C6353500172E6BB6613EB4E4AECE1A81C423445E427B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689542358, "uuid": "b3c0b31f-de10-4972-9869-346a7d0b3fe2", "value": "384:u2CtdIVwgXojQeZndjjIq4hDUdzaTrnmFYH:uz4w3EMRp6UE+FYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689542358, "uuid": "54fd3ba9-dcb6-4ae7-9301-c1de792a8831", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689542358, "uuid": "998a54ca-78c9-44a4-ba91-62ed22bbaa5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689542358, "uuid": "6d3be92b-a0c5-4388-af36-1b8da1e064e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16146cee-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1689493250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493250, "uuid": "ee1f4129-3b05-4633-802a-42f6bb2e66c3", "comment": "Malware payload (Smoke Loader)", "value": "7ff07ccc087a7d29c89cfd7fd5eb9f5d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493250, "uuid": "9d098071-6003-4866-9011-f0baec3a1475", "comment": "Malware payload (Smoke Loader)", "value": "26ee5ecb55714d302e8adcc345fc373abf5eb3189c854922cfca7c3c5c7018fe", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493250, "uuid": "432f39f3-afd6-432e-80dd-24c0a178893e", "comment": "Malware payload (Smoke Loader)", "value": "2150a746f78c9648d61a5e6861817408d80296cb", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493250, "uuid": "ef5b5727-f2e3-4de9-a5bc-e498f89bf404", "comment": "Malware payload (Smoke Loader)", "value": "b5947f50213cbd263d029fcd1bdef98378fea5e3117ef9e87c2ee66725fe49aaf46a2302b1a4a2f35a5c715c59d4f928", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493250, "uuid": "f6bef375-e704-40a8-8c07-8831a1da2bfb", "value": "T19EF3DF1138D1C072D54B86351836DBA4AF2E78229BB8CA8F375C0B7E1FB15D19B7A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493250, "uuid": "e9ea468d-1ada-4476-8cdb-ac367ec34c9b", "value": "40bc36fa70f0816a5b8a662a7b97a051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493250, "uuid": "59b0d271-dca4-4af6-83d2-faae45882ce0", "value": "3072:rri0LnjzU9CSXlwRglQttweek/bOn3fekTBO95wYW:60LnjAxX8WQfY2OvesnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493250, "uuid": "d0bccb4f-3d4f-4d57-ad5f-6d25429ac450", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493250, "uuid": "5ee85d14-ae42-4e33-8103-503695635038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493250, "uuid": "1cc4dd52-61b4-470b-8c12-e0369d03cee9", "value": "7ff07ccc087a7d29c89cfd7fd5eb9f5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65cdcec-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492687, "uuid": "2b655f56-0399-4ac5-855a-db7776d24fa8", "comment": "Malware payload (Amadey)", "value": "861cdcff71d268dee3580d2ce333ac09", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492687, "uuid": "028f7d86-65b9-4238-bff9-b58079ab8712", "comment": "Malware payload (Amadey)", "value": "27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492687, "uuid": "561975f8-5bc5-4267-a46c-94d8c6c7c21c", "comment": "Malware payload (Amadey)", "value": "94be6d1757a7ab5c0d5ebd464cafb71bc1c5d33d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492687, "uuid": "33aa0584-e15d-40a9-bb6c-018b597693e2", "comment": "Malware payload (Amadey)", "value": "080757ad17667e47b21ad051ca7f4770278008be2d0ae5250933c6a13f5d7e8275b93ebd0e18dfac191cc0925a997323", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492687, "uuid": "f7f7ad44-d051-4567-b063-79120483592b", "value": "T17945234BF7E89865DAB06B31D5FA06830F3C3DE295B84A2B27465E5E0523684793073F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492687, "uuid": "417ef717-a695-4870-a7e5-ef8825f30049", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492687, "uuid": "d1b12a47-e855-405e-966f-0d1ceb19c2ef", "value": "24576:ayE5p8ogugja8IT5+YVQ0SVU97kNQ7hDtYT:hwZgja8G5+k79ANQlDtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492687, "uuid": "c9d41630-ac04-4044-8360-653a114c7b44", "value": 1215488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492687, "uuid": "e2e6c9af-b7c7-46f5-a41b-5d9a34019204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492687, "uuid": "14b38eea-aace-4b37-8757-d55e5069fc59", "value": "861cdcff71d268dee3580d2ce333ac09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bde7e8b-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493314, "uuid": "dd08b493-1a47-454c-ac29-6742a4ae71b8", "comment": "Malware payload (RedLineStealer)", "value": "3b15da7da2a9985dfc559678c1c0482b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493314, "uuid": "2010772f-2655-43e2-8a79-b7471dff08f7", "comment": "Malware payload (RedLineStealer)", "value": "283efcd8a6e6bc3c07c2cdffe9f6b06a861cbc169275af6f317398cf0ece5dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493314, "uuid": "fe42c041-bdc2-47b3-acbf-cf8ba1f1b30d", "comment": "Malware payload (RedLineStealer)", "value": "5f3dbfcb44f1a3d380c273bf596a65026858a173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493314, "uuid": "7c35335d-e025-4087-b867-a31bc57d5221", "comment": "Malware payload (RedLineStealer)", "value": "6385eebc635de1ee6f65c7a68a924a8febcdcba47ecafd6b0c55824dd7d96d94605cbd9c95b8221a226a6fb1d4c11379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493314, "uuid": "6056d2a8-fbb7-4ed2-bdaf-20437e7a51e0", "value": "T1F8152306E7D89433D8E727B168F513C71738BCB6AC74C3A62A449A9E4C72094A573B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493314, "uuid": "253239c1-c734-43e6-8d19-a9e9fc46f6bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493314, "uuid": "7a093a06-5bcc-4cfc-be22-db1a3ab95d61", "value": "24576:pyTTX/Q3acTj1bfw3/kl3191yhch7M0I:cTTX/vma3W19Jh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493314, "uuid": "95de2ccc-0207-4cb2-9fd6-96e10a71c3ad", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493314, "uuid": "ad88d6a8-1b35-4b50-8a3b-cff4fde70c1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493314, "uuid": "b739642b-10bb-4c5a-b19a-72df07c5ffbe", "value": "3b15da7da2a9985dfc559678c1c0482b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c18ff24-23a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689490254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490254, "uuid": "84b77a81-0fa6-46b0-8987-73bac56d6c10", "comment": "Malware payload (RedLineStealer)", "value": "913090fe2276ae84a132e19ddbfaf4e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490254, "uuid": "af23e22f-8c7b-475c-b6a9-f5c47b493dc2", "comment": "Malware payload (RedLineStealer)", "value": "2ad9d3c12e825dde8a117abc44607f85155d19ddbd630da6378aa19e67f60175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490254, "uuid": "e4562ac2-f841-42d3-b41c-12ed11b32ffe", "comment": "Malware payload (RedLineStealer)", "value": "48d3551586c66d15b1b7750e313fbfe67934720e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490254, "uuid": "85df1a61-039e-4c3c-8d0b-000f04e76be2", "comment": "Malware payload (RedLineStealer)", "value": "063997eb47aa5bdbbbd4f1e8ce29d673dcda32f2918dc6c401dd0d73cfb57da89579169984aaf91991928a6c7547a4d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490254, "uuid": "a09f431d-a4cc-45d3-81a9-ceb1300a411e", "value": "T1CD1523576AD48032FCF653705CF40BC30B7ABCA048B4972A4795689A1E736D1A672F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490254, "uuid": "188d389b-427a-4835-918e-81cb40cea860", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490254, "uuid": "fb578ca5-1eb8-4cec-9fd8-dafa27d473d2", "value": "24576:oy5DFHE8APRSwmm3Pfxo0dcCzcu/2uUJlK2jFKB/sTrX2hS:vvk83gxo0RzP/RgfTTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689490254, "uuid": "1f195cea-1b74-46ac-bc0a-f9d76808a36a", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689490254, "uuid": "d286d299-e1fd-48c7-b077-398e52d76eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490254, "uuid": "5afcf6b8-fb59-41b5-97a4-a4d331421012", "value": "913090fe2276ae84a132e19ddbfaf4e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef7b8dc-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492084, "uuid": "a0f5d4d3-3432-4190-9c35-58e6af5c1ea7", "comment": "Malware payload (Amadey)", "value": "4bd8d97b6f4e7a1a229776de47b3b1eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492084, "uuid": "7000e5ca-d8db-43e4-b8fc-044d31169d38", "comment": "Malware payload (Amadey)", "value": "2b0c74155065ebee97b8bdef3b76c62a66664b2c27f6becab3483a1eacaee1ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492084, "uuid": "4db35068-2c4f-4a7e-a915-423bf00c20a4", "comment": "Malware payload (Amadey)", "value": "68dacaaa5ee538fc95de7de40908535a6b533710", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492084, "uuid": "ec3004a7-46ba-492d-af32-464325d64e20", "comment": "Malware payload (Amadey)", "value": "6c51de931527e80d1f25abe6828a6b6dc482bd02b71fda4af51f0f8e197828ae2ec92bb74f127673d4cea543ffb71c79", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492084, "uuid": "0ebdb4dd-a57f-4c40-950a-8c432bcf2726", "value": "T186F41216ABD99431CABA67740CFB11831A35FC62AD34C29B6B42B85D5DF36C4A830737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492084, "uuid": "3c89abc2-b04d-47be-a9ef-3f56c994945c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492084, "uuid": "be2f2e8b-bc33-45a6-a716-f2e05b607749", "value": "12288:TMr0y90Ww5uEfZ9cOOq6ra9dtnY7iRnP6XmC+WKg7FAOogjWkRijzl1l:fyyRb36+conPu4Wzt96Gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492084, "uuid": "8cc2fcb6-dae1-4e8a-8e79-0a9fd85a82fb", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492084, "uuid": "4f8dcfb1-aa26-4ebf-8414-7871e98fdb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492084, "uuid": "ca9db596-025e-4627-81f6-dfb01972fc22", "value": "4bd8d97b6f4e7a1a229776de47b3b1eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f3400f-23d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689508870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508870, "uuid": "51fa8584-da04-4b91-9a81-f399ad77ee23", "comment": "Malware payload (RedLineStealer)", "value": "e07c87a1ae322382a2fe0e531f6723a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508870, "uuid": "4c8e48a0-0b87-4509-a1c2-eadd587269d1", "comment": "Malware payload (RedLineStealer)", "value": "2b568c0cf29aad37241a01e5dd8f60343466d6380caff108c4f4efd4949837a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508870, "uuid": "9ade5c01-dba9-44eb-8e1e-7bda7c614799", "comment": "Malware payload (RedLineStealer)", "value": "dc051d40d81f339317faecb4a6766126364a5011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508870, "uuid": "5db4822f-b813-4752-87f9-5e4194d5edf0", "comment": "Malware payload (RedLineStealer)", "value": "4525381e0902aff50567d5f685d4bf7df258cc0bc87ad702b9f77cf4052e6c529c927fa18d5d9d388f73bdc4a0735a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508870, "uuid": "9198bd51-76b5-4902-b520-9ac41faa5386", "value": "T17F04D458364BA97ECA6F483D9C700CD06A7CAC975246A7078D8EF4E83D3A7809F151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508870, "uuid": "c362c60a-b904-40ae-808f-b611d97b0eae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508870, "uuid": "f0aac0d2-4db8-4f6c-9cb6-57e175ecb933", "value": "1536:ciFT95/536sv0W7TOqHfrHx2+prR93466OKixNfSYQftbu/XV0xGy/0GkR88e8hH:cwf3b8+973R3KixNhwa2xGy/f8e8hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689508870, "uuid": "60492ea0-beec-4a81-89ce-e7be2a262bc2", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689508870, "uuid": "d33b086a-b17e-49ec-830e-eba36bf46d4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508870, "uuid": "2968c297-92e2-43d1-8a97-ff7a3a12a4e4", "value": "2b568c0cf29aad37241a01e5dd8f60343466d6380caff108c4f4efd4949837a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d44842f-2407-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689532561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532561, "uuid": "325fd3c2-22c6-423d-9737-3d18e782b2db", "comment": "Malware payload (Mirai)", "value": "1abee889f7ed4219beca1319da29a504", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532561, "uuid": "49948160-0ebb-49e1-98ee-8cd215a663d5", "comment": "Malware payload (Mirai)", "value": "2c2ba81ccf3b8f4a0e5b21a238bf762b4618af48250425dfaaf4a831d338db4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532561, "uuid": "8f7cd35e-c0c0-4c86-bf76-1ff51c13f24d", "comment": "Malware payload (Mirai)", "value": "fb2ac9d95e0ffe05fac6dad675573df24d329726", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532561, "uuid": "7c5b612d-d626-4185-ab9a-e978899ab591", "comment": "Malware payload (Mirai)", "value": "72136678e44d8f88512ec22e2db9b58a4184d66210f9e4841628d25659f7430fe4d68b89ddb2da1179cd45476050b968", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532561, "uuid": "a2e84698-65f7-4c01-be4b-a64155d17891", "value": "T1763339C8ED97D9F8DC5125712027EB328672F13B1019EA8BE7DCAA23BC52B41D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532561, "uuid": "867cac74-4c60-487a-b4d3-fdd0c085f578", "value": "1536:BAmkKnnAvjccy7ZeDm4EJd+67ZkC2BjWxrXdJKQDfM:ORKnAvjcV7ZIEJdxZkC2tirN3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532561, "uuid": "11fe905f-8486-428e-b85f-14a72aa6678a", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532561, "uuid": "4596d1b2-ba88-4cfb-99fb-88ffeb698bc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532561, "uuid": "c303b8c0-3c86-4661-96db-61c85aa881c5", "value": "1abee889f7ed4219beca1319da29a504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5d889e-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492108, "uuid": "5ebbc4f2-abe1-4bd1-b4c1-e5ce9c3b0e79", "comment": "Malware payload (Amadey)", "value": "561f236d360635fdfcc2df9331b86b24", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492108, "uuid": "6da772ad-2a45-44b8-902d-93d0032063da", "comment": "Malware payload (Amadey)", "value": "2c751c7ac1378f80f8d7cfc1904c669b21ee9b73069c6a75c3890e7356ad2861", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492108, "uuid": "abd7fc7c-9bc6-4e02-a512-855853e8b0da", "comment": "Malware payload (Amadey)", "value": "c8e7e8159c5986f848be3c1544821786783e6b3f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492108, "uuid": "fe629d11-61a7-41f5-a338-164dfed115e3", "comment": "Malware payload (Amadey)", "value": "8a700cc8ab0abd169aa38c50d03b11aa84a4876788a1bc7f7ae1a0ae967d8b8c57425b6e2024c49e235e5c9b7690e176", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492108, "uuid": "41d40077-8fe3-443e-91c1-3b786b8ba56a", "value": "T183F41282BBE46432D9FA177054B603930B357DB15839872B7B97B8561CB3A85E93032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492108, "uuid": "bd69fb40-b70f-415c-affc-49d2c5bc3539", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492108, "uuid": "9763d61e-bb22-4c06-a2e0-96e9e0e81519", "value": "12288:rMr0y90d2vtQrKmyskJC0FkUTGjUJlXbO98qJV4oPCL8nMzeP+GH101s+gcW:XyI21QGakI0FfSjUJlLuV4yC9O/V01M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492108, "uuid": "63d4f626-5b14-4e1e-95a0-f287243f2fb2", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492108, "uuid": "d22252c8-e410-411a-8ab2-d5c1a85a6547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492108, "uuid": "e117acda-2932-4465-b662-8636b6e85a40", "value": "561f236d360635fdfcc2df9331b86b24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a818a134-23bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689499938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689499938, "uuid": "bf1c28ff-2062-4a0a-8473-2510003ff071", "comment": "Malware payload (RedLineStealer)", "value": "1be99dc5f6f0d5ff37a493fdb997c3f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689499938, "uuid": "5d3d5244-7b26-4edc-bc03-f7aa878682ac", "comment": "Malware payload (RedLineStealer)", "value": "2c860d3263d6ae7ae0f8fb959b7e40c40dbaa8b430d9fa35d8373f35b8e7ae35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689499938, "uuid": "4734ce3e-136b-4249-b87f-71d62024ec1a", "comment": "Malware payload (RedLineStealer)", "value": "cd76f015082af2970d68bc3499125e54383286f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689499938, "uuid": "323932bc-54f7-4812-9e72-46d89f9c8cb3", "comment": "Malware payload (RedLineStealer)", "value": "13e1c607d9b2756a6a147ecbf8b15d2494128298c781734f26db0fd5946fc638f244296eb35af31433a05977fc7e9da3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689499938, "uuid": "7c320754-d846-401a-a54d-c24b686d7836", "value": "T112752396FBFC80BAEAB007755CF207C31B747D91A80152A67399E8495C73688B5313BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689499938, "uuid": "acd8250a-b5fc-467f-8893-5adc4b25d387", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689499938, "uuid": "f7f969e0-4b4e-4df4-9d74-fcf71cfd826e", "value": "49152:lqDrkz9NHXCjB5I/nL0Cdr482ngFiXdBgKzgJ8:7zHi5knLz482yMdBFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689499938, "uuid": "a800dc09-7f65-487f-ac06-4ec58b780796", "value": 1637888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689499938, "uuid": "56c074aa-fc1a-4481-b26f-dfa3e4c73c81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689499938, "uuid": "67d22dac-a2ee-4836-b3cc-4ac53359a52f", "value": "1be99dc5f6f0d5ff37a493fdb997c3f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec9f8f1-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493050, "uuid": "37fe28d8-6082-480a-bf51-a00d3083668e", "comment": "Malware payload (Amadey)", "value": "e9ae31b0e6366ece99e2bf650c2b9e17", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493050, "uuid": "6205a9df-7366-4abc-ba90-33105b87eaa0", "comment": "Malware payload (Amadey)", "value": "2cd70321a7f4a39e0fa291841d388eb1f565c800d45aea6db90af9081462fd17", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493050, "uuid": "5073b5a4-9553-4e94-8036-f96622c6e1d1", "comment": "Malware payload (Amadey)", "value": "9475564183359552f9c338ccb64ab8da88b114c8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493050, "uuid": "7087ee20-a28a-4358-96f5-96f6ec0bc7e7", "comment": "Malware payload (Amadey)", "value": "ac94fa1918b724e2a1df564abe86312a40555cef4258d6d665b06ddd70d88d49fbb2853d37cd5d15e63e759f627e0871", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493050, "uuid": "fe52bb9d-6a30-4b64-8fc2-db718bee3d52", "value": "T1C2F42343FEE84073DDB557705CF603E30A397CA1982892BB22D29D4F4C726529476BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493050, "uuid": "5836314c-ac8c-4ef1-a74f-f26b49819639", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493050, "uuid": "ef4f05b4-efe2-4162-a825-d71aa2045642", "value": "24576:wy7VW0kU1mFqKvGXxJ4mVvjhsC5Aq/tR:37VW0kUs8j46Vt5Aq/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493050, "uuid": "3ab16993-1e28-4cfb-951a-ecd0f0b72b64", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493050, "uuid": "5f8ba863-75d3-4a59-a542-93b6d97a6de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493050, "uuid": "1b222159-173f-4b0c-9c3b-2e45be921c4b", "value": "e9ae31b0e6366ece99e2bf650c2b9e17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc517f70-2411-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689537016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537016, "uuid": "cd05966e-4950-4448-a210-4d63c6a457c6", "comment": "Malware payload", "value": "1dab2f5cdf7da974f922e9ec2892e6f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537016, "uuid": "1fc7c419-7236-439b-9054-09a46ea158f3", "comment": "Malware payload", "value": "2cfa39c417e648445aeb33c87d3919ee247156ee5970410b3ebc01a658d3a724", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537016, "uuid": "2d5feddc-666c-42ad-ae92-00c38b92f3c8", "comment": "Malware payload", "value": "d391795fdc2ea72b50a6556a05c9a52df2e09096", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537016, "uuid": "a3a0c6db-52f6-4395-9012-e41e70e7f68b", "comment": "Malware payload", "value": "02cc8603c96b64a65d224a8200f5942a4d020ced273d838ad05a52347677f291733374c0e1b0b2a6f5711b3452f6f070", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689537016, "uuid": "c66830be-47db-4996-8120-6c278af5e611", "value": "T1F14339C8E6D7E9F4EC090A313137EF32D6B6E13F252CD993D7986963AD41642D4022AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689537016, "uuid": "0a5842a1-15d4-485b-899e-86616ca1224f", "value": "1536:CVKFOD7prJkaNup1COy7O/HgeGDp8Q8bi7EnhP8xR:XFOXprOfPTy7yHgeGDp8Bb3VQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689537016, "uuid": "7b35be92-a4f0-4ec2-a16a-757d7ae72d20", "value": 58128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689537016, "uuid": "937908f0-8e9a-4598-b10e-d9edbb60d2cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689537016, "uuid": "e3216882-8590-42ac-b137-1366cd6fcd29", "value": "0xh0roxxnavebusyoo.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdeb5b5-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492376, "uuid": "b687f54f-55aa-4d26-9252-a5b92f395a33", "comment": "Malware payload (Amadey)", "value": "4ce629f8747eda6f87736e78bdfa16a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492376, "uuid": "24e27875-80b9-4805-b8f2-fbc01b8264f4", "comment": "Malware payload (Amadey)", "value": "2d0e9487b9ef5db2eb0500ce9a5ed167ceb3c1f271e1a50f7283d3ed521cb67c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492376, "uuid": "86509b69-fdeb-4ee6-a609-99786f22e39c", "comment": "Malware payload (Amadey)", "value": "17184f40285443cc76533b58363b13cd1647ad99", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492376, "uuid": "ca864c97-bbbe-470d-b2b9-fca1e66e6b7e", "comment": "Malware payload (Amadey)", "value": "c269d777d2541bf19d0104e4e31fdb13828bd3dfdde5d70a90d33b231f5c92832d04135948d2f54bb0dec85536232f77", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492376, "uuid": "cab8d192-f8cd-451f-a941-9ead032b045b", "value": "T154F41212B3E98073E9752BB06CF203D70B3A7DE26538836B2A52955E0DA3780E471767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492376, "uuid": "184fb19e-3754-46ea-a775-9cd657508b54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492376, "uuid": "9b6905bc-d09a-4c10-a485-bb61f53e60c8", "value": "12288:cMrGy90KcRXwceOU3O7iGzGz6AOrFilv4k425Uvy2hl+nMLAUwoNTeWsIk:iy9e893OuGzGkrFiGkL5Ur+g1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492376, "uuid": "8dbb6b5c-b024-40a5-8e7c-e1f74e9bec07", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492376, "uuid": "d540d173-6700-44cb-82a7-fd89f252001d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492376, "uuid": "bf014f09-7180-4719-a33a-9ca7e3c55a5b", "value": "4ce629f8747eda6f87736e78bdfa16a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744bad0f-2423-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1689544518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689544518, "uuid": "4b468a7d-0bf5-4da8-94ae-12eb3c487463", "comment": "Malware payload (AveMariaRAT)", "value": "30a95317c407bfac4caab29b0ee996d6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689544518, "uuid": "5a523067-aa7a-400b-9aae-5328597a2a65", "comment": "Malware payload (AveMariaRAT)", "value": "2d2db06bf4f183adf7f1024f85bfd9e20fc6b38b2ec7ddfe889ad37a4b535739", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689544518, "uuid": "9290217b-93a4-4fcd-b4f1-a57db19371bb", "comment": "Malware payload (AveMariaRAT)", "value": "da20a8f78110c35a58a1b360c5e70d8221068587", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689544518, "uuid": "394d8fcf-8879-419e-984a-320620952cf2", "comment": "Malware payload (AveMariaRAT)", "value": "6245dceb6e3d2b2eddbe8d54fa32202b72b594b578a80e389f8ac8945f473649903823af2ab9fcedce4162af232d7125", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689544518, "uuid": "7b442b61-590d-451c-b3f8-3bcbecb89c16", "value": "T19EF4AEAC765076EFC857CD769AA82C74EA1134BB931BC243902315EDAA0DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689544518, "uuid": "efa3cecc-e15b-48f4-8126-3be52eea023e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689544518, "uuid": "31dccb9a-dedc-4012-914a-2be6bed1cd74", "value": "12288:d/zoEPcPYsxoKTpvBlKX02HORiYk+Abx+NAOrRN+3MGWjYrxR7oZl7wjx:5zoszooKTpveXfuRrIx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689544518, "uuid": "9ae52ea3-b53d-4990-8350-49dfd4b23f7c", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689544518, "uuid": "c4ebc917-57e9-485d-900f-ce3f3ee4efb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689544518, "uuid": "bdaec770-2997-470d-a7c0-592ece7fb54e", "value": "30a95317c407bfac4caab29b0ee996d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bbe013-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491777, "uuid": "3a669229-b702-49eb-a612-d085639efcc4", "comment": "Malware payload (RedLineStealer)", "value": "1e4d6f387b6127e8e81f9d87c54ab03d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491777, "uuid": "56ee5fe1-5d79-46be-9def-5fef14bccf87", "comment": "Malware payload (RedLineStealer)", "value": "2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491777, "uuid": "534561bf-dde2-4639-b682-fcb3d870f154", "comment": "Malware payload (RedLineStealer)", "value": "aaece8294c60dcb0dffa5666c5562dfd1c625d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491777, "uuid": "782f5bd9-ed26-492f-a1a1-0acee16bc5ce", "comment": "Malware payload (RedLineStealer)", "value": "93a00f240acc5cd8b5e9e44d45d36c0475a2e0559e98708f6761515f56ae93101410f47f7cb7a5aa8e2a8694c345d103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491777, "uuid": "51783a3d-e145-4126-a00a-9bd279cb06d7", "value": "T142151212BBE84173EDB447B018FB17930A367DA29CB4C32E3A4865260DB22949D7577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491777, "uuid": "aabedd97-9bb9-4559-ada1-7099ff6df6e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491777, "uuid": "fa356433-33d5-4542-b6fe-2d981cc4e3d4", "value": "24576:HychlJu+Eka3nZgkWIRqu1ooxDHWC77/UXuE:SchlJha3KkWgH17xDHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491777, "uuid": "c68a3b49-b707-4502-ad79-dc0744765930", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491777, "uuid": "a7af0b22-0dfc-4c2e-af5c-42af2a10ed21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491777, "uuid": "70afa66e-b4a7-40fe-836e-80d463cb39fe", "value": "1e4d6f387b6127e8e81f9d87c54ab03d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4b3f1b-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493022, "uuid": "938bde82-80b2-4faf-9a1c-462044c370eb", "comment": "Malware payload (Amadey)", "value": "ded856faaaf7204071d357ac2e4bd482", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493022, "uuid": "307f0646-9a50-4486-a9b5-824d744dbfb5", "comment": "Malware payload (Amadey)", "value": "2d6e35a8b02958db64fe8effa9804064bf478e88717fe23dabf9ee300706d032", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493022, "uuid": "b047f0c6-23b8-4893-af47-34ed11164f25", "comment": "Malware payload (Amadey)", "value": "b071d4af706f6a29ca6ab2605a8f12810e007fa7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493022, "uuid": "5e8f4a22-5ef8-44f7-b28f-abec8b692224", "comment": "Malware payload (Amadey)", "value": "3b6841275979a51ca905a40ecef6648e8bfd508bf73d9aee5d714432646277bf6c7ae28cb54a1ea0b2b374532c78c267", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493022, "uuid": "158879cb-d28b-4240-b70e-b4cd299cbf3c", "value": "T109F422A6AEC85837CDB527B01CFE02835A33BDA14D79535B3686590E1C72690F173B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493022, "uuid": "55776076-13ef-448a-a260-c2d601f66a92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493022, "uuid": "8c23d17f-7cb5-450f-816c-8aeb82dd0319", "value": "24576:6yDlHqDvPmZYr6+Udd48cxFVbW2qL0xtc3h716b:BDLuHUdd48QFVrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493022, "uuid": "90e81b32-c746-451c-8c2a-0db724cf7bb0", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493022, "uuid": "9673304a-ad23-4ae6-8073-bb46f8ab0c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493022, "uuid": "454ca592-5ce1-4fd9-84dc-553bc0903788", "value": "ded856faaaf7204071d357ac2e4bd482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77945fc7-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1689493843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493843, "uuid": "10a0751d-b7a1-492f-ac6d-f13b2933c742", "comment": "Malware payload (Fabookie)", "value": "b33cfeeae0e54ce730e12bb76cfa9be1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493843, "uuid": "83d33f60-2ef2-4721-8ca3-53dab35b6125", "comment": "Malware payload (Fabookie)", "value": "2ddc19ae908947ed753b9681fca56b219204174819c5cd9113dc02ccfa79ced6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493843, "uuid": "147d8bf6-9416-469f-89df-342a8fb1f55d", "comment": "Malware payload (Fabookie)", "value": "63a211e372765322687b0485baa81a93d6ac7d9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493843, "uuid": "50d289b6-461c-4818-9fac-5308de98bfcb", "comment": "Malware payload (Fabookie)", "value": "6890ce2ea9efb28d87ed1874f5e4e36559e5c340915007c5e189b2398539c49d9455498e87fd555d34b69c7966093e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493843, "uuid": "a10ffda9-d229-4821-81d0-4a142bc06060", "value": "T1DAD47D51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493843, "uuid": "12b026fa-5e33-453a-a8b8-cff68c46a278", "value": "20a03a21823d3b586003fbd55dedc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493843, "uuid": "804e3fd9-3a58-4304-a06a-aab12f7da4bc", "value": "12288:Tee9CNmn1yjnivHTJBxPTXzGwDJciMuGEPnW:qe9imn1+uJBxPTjGwSiMupnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493843, "uuid": "80791ee5-8871-4341-b1a8-a423590a09f7", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493843, "uuid": "188e4a97-6165-4d3a-978d-8c0567950d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493843, "uuid": "4978c0fc-a7ae-4ab8-ac82-655450b1340b", "value": "b33cfeeae0e54ce730e12bb76cfa9be1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6159ab8c-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492088, "uuid": "2abbfa76-fdc7-4946-aef5-e1472b5288f9", "comment": "Malware payload (RedLineStealer)", "value": "2f8765ddfb5eb9cf565d416a2fef07a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492088, "uuid": "20074ee1-2906-4002-b7e5-7f85b5a25ab4", "comment": "Malware payload (RedLineStealer)", "value": "2e0a9b6a39ce81b93beb155ac3c237f4a6b9248d6b872ed22bfdf8851796b19b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492088, "uuid": "0af137e3-e7c7-4ad4-9204-32ffecd156f1", "comment": "Malware payload (RedLineStealer)", "value": "ceb22309b872f04d9c5df1e6fe3cc35fa616e6cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492088, "uuid": "0d765910-3608-4870-9725-53bbd0c85893", "comment": "Malware payload (RedLineStealer)", "value": "f2b00931eda36c5092b8461b84dbaed814d4a78f7e7dfe0bd3a215c72560257edfed566a9371e032ed40dd82dd9565af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492088, "uuid": "a56f3730-6243-4769-a23f-17be8cb587d7", "value": "T1F945232696E88073E2A507B439FE019306357C91ACB4127B234DAAAE4DB3BD4D935377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492088, "uuid": "bb4971bf-f2d6-4a41-bd49-8c139d68e614", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492088, "uuid": "b11338ff-94dd-45bf-8b2f-c305949b65bf", "value": "24576:Cy4hgIcCM5IddKY63yg7MVZeoCNElcacqdf36HXe:p4hdcidKY63jwSDEa923", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492088, "uuid": "6f138a25-1e83-4915-a8b9-4f1d6d5e2df3", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492088, "uuid": "62198bb9-99e9-4d77-9a9a-336c38c31e77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492088, "uuid": "e0fd6bb5-032b-425f-991b-607e6c2935e9", "value": "2f8765ddfb5eb9cf565d416a2fef07a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14fcadd-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1689493618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493618, "uuid": "b0727077-2b2c-448d-bf5a-6a0113527bba", "comment": "Malware payload (WSHRAT)", "value": "22ef674791168c60e62f62f00be76cbc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493618, "uuid": "c1a317e3-a04d-42e6-9a9f-7be70b8b3503", "comment": "Malware payload (WSHRAT)", "value": "2e0cbf4f1d9cb97c620adc42521a0a10df04103d394f661e6255d3d20ee2715f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493618, "uuid": "f0d33d60-f3dc-404c-9264-240a9bc98d8f", "comment": "Malware payload (WSHRAT)", "value": "edad10bc2c6491883a7a21ca36350e234d1a7f0e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493618, "uuid": "bfbd2610-c894-4862-b733-3f7b04749602", "comment": "Malware payload (WSHRAT)", "value": "417929ba94c68fcbf2f26b8968571daf7e8d1db6bbeb2261e165c7fb86c5def9da2eaf4075419b48e9678796b8c7f76c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493618, "uuid": "be4e6fa7-e711-4276-9a85-a18fec6573be", "value": "T1EEE124117BEC7B2F2D6051F28486A1E00B2B132B2153BB6F96C43A4C4FD867D6EB7065", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493618, "uuid": "5bc4c9cb-96b5-44f7-9d15-27ceb51752b1", "value": "96:3mqLtJxkhmLILevLqyL8g4cLZL7SPLx7LELIL3LWLOVL+++d:3meJtUezR8g4gN7STxXIU7iOh+++d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493618, "uuid": "ca715c4a-67b8-4ad4-be8f-709a0560743d", "value": 6821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493618, "uuid": "aae1a329-9e70-450b-84dd-6bb8c60f2027", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493618, "uuid": "6b61f73e-ce43-4491-a28e-baa56d2ed21c", "value": "Purchase_Order.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f27038-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492388, "uuid": "3e7d1cbc-ff5b-4864-9c92-11393b248d62", "comment": "Malware payload (Amadey)", "value": "47559f25aa9eb3ca031fae1c77475b3e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492388, "uuid": "51955ed0-19a1-49b6-b0d0-66b9b63aa129", "comment": "Malware payload (Amadey)", "value": "3039c202c5304ea9508db4ad5b10a87960b5e2f9557586f0b01d9c6dc9f7d2a1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492388, "uuid": "1451e578-087d-477c-a026-bdd66b57a864", "comment": "Malware payload (Amadey)", "value": "c0c2f4c28007653fa60c21d6e0421561c74f83e5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492388, "uuid": "87812c63-5d96-4871-8d3d-a236dd43137c", "comment": "Malware payload (Amadey)", "value": "95d9227b975df9ed8623b6713e694ddb105165290aa86dd5527583211250ef901dae728a80559ff7af2be7bf88c025fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492388, "uuid": "5e4f28d0-66bc-49c8-bcab-f7feac10362e", "value": "T154F41256E6ED5032D8F82BB41DF603830B36BE516938539F2785999E0DB32C4A93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492388, "uuid": "5313fbf8-c1b0-484e-9236-fd45f5818d77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492388, "uuid": "c5106df3-3d5e-4a74-a846-764c5849679c", "value": "12288:1Mrhy90tu0sBQkfUk6YKODy4BbYJiKeuKk0r0hFdmxSyjs43:UyKzsONl0+JJVJkeFjyj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492388, "uuid": "729fbd5d-49b6-4a14-bd51-f4e1b5cb38bc", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492388, "uuid": "bf7aa7a1-5a85-4458-99f9-3573210fd995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492388, "uuid": "8839b601-3fb1-40f7-8dcf-bf33f23f9bb1", "value": "47559f25aa9eb3ca031fae1c77475b3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18db976e-237b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689472210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472210, "uuid": "96b7e3cd-d969-44e2-975e-7a8c168a2d2d", "comment": "Malware payload (Mirai)", "value": "404e3413f5f6583af1e698ba4aa561fa", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472210, "uuid": "01e89aef-f429-4ca6-8601-09e89e6a406e", "comment": "Malware payload (Mirai)", "value": "30bb020e29493e81c6a5534cf8809919434a8e6dae111cffdf952e94aff62fdd", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472210, "uuid": "f83dced1-4d5f-4cf1-a82a-26b9bead47b9", "comment": "Malware payload (Mirai)", "value": "05f9f5e8df2f4f8e079d627d6890a6ba1fb87121", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472210, "uuid": "2b4e2461-d847-4c08-bb3b-95fe1e322a99", "comment": "Malware payload (Mirai)", "value": "57bb230485297984091b4aaf401e8e80222f15113bdb86edd69464876cf101a092859cc14ea745714793db43ec91ccde", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472210, "uuid": "59147ca0-82a2-4acf-b342-900e0e2dca7b", "value": "T1E1D2D111E5C79BC5E2AA08B31CDE74AA04109B0F3C80B593FAA573374A53F54276DBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472210, "uuid": "86e1849d-46b3-4b32-9f02-8ff65d4d2118", "value": "768:0d78ykw0/RCgm5dY+6GtVbZHFGH1OlhKMT10IUnbcuyD7Uryq0:K7RLHY+5tVbKH16KMB0IUnouy8mq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689472210, "uuid": "5a3e8011-1904-4052-be62-e71041483220", "value": 29624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689472210, "uuid": "be9c7a74-6ae7-4bf9-8566-55ae2fead96e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472210, "uuid": "aadc7e8d-356d-4a0b-92d8-6bbb1a525b4f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a39de32-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492076, "uuid": "86cd51a0-55c2-4731-9b75-fc9e847644fc", "comment": "Malware payload (Amadey)", "value": "44cbb98318d10e181dbecfc6c7930c92", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492076, "uuid": "ec795a61-e9b2-4a08-bc75-73df5bd4bdec", "comment": "Malware payload (Amadey)", "value": "30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492076, "uuid": "ea1db680-8b27-483c-a74f-5658fa821e0b", "comment": "Malware payload (Amadey)", "value": "8b8dbb3697aa7d64447e563c66fa3e7ff4b7984f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492076, "uuid": "dc657d17-857a-477c-8220-bac1f8dd937f", "comment": "Malware payload (Amadey)", "value": "00c2385300b86b6330ab6932e35e00b56a8b5ffbe2a56ca70b1269067a69d51f20581cc5ae642d43880473fe147b9aee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492076, "uuid": "00d34be1-e6d3-405d-8194-2e77d1419902", "value": "T172152256BACC8933E8B51374C8F713D30A397D91AD3A426B938A592F44F71C0A0757AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492076, "uuid": "6ff3dc89-dc8b-4cc5-b030-6ab99751f2b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492076, "uuid": "b9e38f8d-e42e-4fe5-9462-bda9296107ac", "value": "24576:ny81+rfI0+ZZypDGLOnY6n3yUkcm4ifIPIik:yg+rfI3ypD35niUs4PIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492076, "uuid": "5ebd8791-b7ac-4af5-bd89-a8d1ad797fcb", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492076, "uuid": "297e1bff-0317-4634-bdeb-35f9e3d893e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492076, "uuid": "fe7bb736-8824-4caf-9f82-c3420449a139", "value": "44cbb98318d10e181dbecfc6c7930c92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fdb725-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491780, "uuid": "3ea7ebdf-c7ca-44bd-b536-ab7e2578a9a7", "comment": "Malware payload (Amadey)", "value": "2f90b96c118c015c354c52cc75fa37ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491780, "uuid": "973743c8-fa64-4d22-a955-8a751915c2d9", "comment": "Malware payload (Amadey)", "value": "31398c7cc30995515cf06ccc5a6ad83deda035759e36316fab825d18b337537a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491780, "uuid": "ea49bd95-dca4-4bbd-b4e0-a989e2c329bf", "comment": "Malware payload (Amadey)", "value": "7e2aeefbe7ca1d473bba7ac881bedb7789c62532", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491780, "uuid": "8cb2c969-8890-4e37-8174-2b1a45689b21", "comment": "Malware payload (Amadey)", "value": "c31a88096094ba21f0c26c377f38395ca0b2ac2f1128771b6d8b3e653a375b34360602d94a665612231e4436346036ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491780, "uuid": "9f20216f-56b1-4c02-ba78-e5c15314c506", "value": "T196F42313EBE49872DCFA277014FA03930776BC931964935B3ACA9D5A0DB35C09532B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491780, "uuid": "e312a176-ded9-4893-8d90-8dedf4c2398b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491780, "uuid": "b2079aa4-a9b5-4393-91c0-99b5b9467af3", "value": "12288:6Mroy90J/iaaXvU8CQejUIoZXm8EI2ptyx7YYdpm60UR2mcMd:uypaYs8CQ7IoZXJuteFbx0UKMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491780, "uuid": "a278da75-e7b1-404e-ba32-8ff418b2ea52", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491780, "uuid": "4eacc584-e009-44c6-b820-817299100c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491780, "uuid": "c0b0c721-a4f2-416a-ac6c-f1d4963b5bd4", "value": "2f90b96c118c015c354c52cc75fa37ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4668a4-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493318, "uuid": "b518b9cf-2971-471e-accd-73f67ae5d48d", "comment": "Malware payload (Amadey)", "value": "f51bedf3c17ba3dce19b1f6635a1dbbe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493318, "uuid": "22b3dd4d-43d2-4eea-8ecd-d8884d9afed3", "comment": "Malware payload (Amadey)", "value": "315afb5a6ac160237812438ca184e17af395333e66bcd81ca49532853d8a7760", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493318, "uuid": "4909ff1d-807e-4ee2-8824-89efef8591d4", "comment": "Malware payload (Amadey)", "value": "577ea6336ed1f39070e41e4eaf7c0005d0070ba6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493318, "uuid": "a35e1671-62a4-44c5-be5f-0948b1d73484", "comment": "Malware payload (Amadey)", "value": "6b4405dc23cc4d4a7e4163f0e477ad6032ef7eb286470d232619d52a8e95c2e2e2499021862f81144047c2652087eb00", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493318, "uuid": "da32e2f8-a6d4-47cb-a32f-c63a4cd0a563", "value": "T1D9F4120396E98073DDF46BB198F716831E3A7C52AE30839F1685D90E1DF25E8687136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493318, "uuid": "25a0fc71-dc6c-4e87-85f0-fb5ad7bebf03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493318, "uuid": "d123e6f8-d920-41a8-8623-f8b4d98946b9", "value": "12288:nMray90LQi4znzUwEdE51rtG7BPbNx6vAv1PbVGxuQ5zMsdoQQ:9y3zzwwaEU7BevA9xG9lrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493318, "uuid": "bd3b72a6-27e2-4c87-9f8a-214dc585b913", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493318, "uuid": "7438a4a8-322e-4197-91a4-6071eb47f7ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493318, "uuid": "84f200c3-1401-4921-893c-317e864e8d8e", "value": "f51bedf3c17ba3dce19b1f6635a1dbbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1ccddc-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492106, "uuid": "0ee4132e-1e46-455f-940c-ee372e05472e", "comment": "Malware payload (Amadey)", "value": "512090e01cabf25fe4dcf7a8ab7249c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492106, "uuid": "405d18e2-5b46-4380-9ce0-897b4e3330c6", "comment": "Malware payload (Amadey)", "value": "32cc60651dec2800f90bb8b2edcc69b23693b48683cc9c3e4003d8781219c264", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492106, "uuid": "e15d71f8-cefc-4249-9627-b00e38ed7069", "comment": "Malware payload (Amadey)", "value": "3886e9e0fc8f96f73aa45dbd0c3e0aac335da8f2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492106, "uuid": "68162689-3420-42f5-b8fd-134ef17b4fd4", "comment": "Malware payload (Amadey)", "value": "7871e27095b0eca0e46697f2e436ccf887b78a9ee528aa0781b5ee953cd2d0ba975be5f1cf1a9a5598ad9a43636c58f8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492106, "uuid": "e0593843-6f3b-45e6-8853-417a3f7e5f22", "value": "T101452345F1D89062C8723BB02DF601D34B36FCA55AF943BF1B8AAC9A187634075B5B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492106, "uuid": "e01c2c0e-e8dc-42f1-b9d2-78d322f74a60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492106, "uuid": "7609e623-20c7-464d-9546-73622db4431b", "value": "24576:7yp5OwtVU9Uuy+oMbhas+Qtm98IaoXUjPPz8Ce+3azWviFmD:up5RtVU9U/0as+QtjIaowQ6az8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492106, "uuid": "1247a07f-5fb2-4e93-9717-e156bdd14b61", "value": 1214976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492106, "uuid": "582a8300-01f2-4c5e-9253-e9710c0a24dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492106, "uuid": "8b6442d2-284e-4fb6-b0bb-fc037cdee721", "value": "512090e01cabf25fe4dcf7a8ab7249c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a4034f-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493036, "uuid": "16da1c86-fc3f-4241-ab49-6e9651dc3aba", "comment": "Malware payload (RedLineStealer)", "value": "bdaf5dbfbe1078a6701f4d8a6fcab0b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493036, "uuid": "1c878110-a038-4ad6-98e5-d2e402fe1a01", "comment": "Malware payload (RedLineStealer)", "value": "33571012265b47c2a2d1283cf3c6cef0d37ea98940dcc07dd2ae74de215572b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493036, "uuid": "ab57b7e2-253f-473b-b019-1f2fa4058d4a", "comment": "Malware payload (RedLineStealer)", "value": "a3f17760844e75984d762dc5d53fffd72065f573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493036, "uuid": "62411ee5-4c47-4dcd-9588-4840b79c0c3a", "comment": "Malware payload (RedLineStealer)", "value": "1214df48bedbc992f82df8e2e8d09a624e8a4a9ae46afafaaee859290efb10295e6690b02f9271f293b519ee1dc8e11c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493036, "uuid": "bd473ed9-b731-425e-8d05-9cc3201893c9", "value": "T1F24523129BD45132D8BD27746CF703930F7BBD654878E3BB6702654E2CA3AA0A53631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493036, "uuid": "0ef07053-8f19-4a6c-903e-7d5775e58e7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493036, "uuid": "ff8b81fc-7fd6-41a3-8daf-33db7fea1c51", "value": "24576:4yxY8UgJqf+HGwW3RKH6pd8vWPsTWQw78IH9NKa:/xhWf+W3RKa4vWPI68mH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493036, "uuid": "e1d3b509-fd25-43b4-8c78-7737833aba5d", "value": 1215488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493036, "uuid": "2a3246e9-5793-42f3-8950-0c5263398d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493036, "uuid": "1390fa95-9753-4206-b6e3-32ab4b60e8fe", "value": "bdaf5dbfbe1078a6701f4d8a6fcab0b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd38a54b-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492698, "uuid": "736003dc-406a-4adb-8375-502bae5b2ed8", "comment": "Malware payload (Amadey)", "value": "86aceaa45ea934057a0b2fe5b8f4bdb5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492698, "uuid": "f72668c3-670f-41e8-b1dd-6d10a54cceb0", "comment": "Malware payload (Amadey)", "value": "3390756d04e55a56dbec865d08df87d53336034b7152d1b00d7d731fafc752ce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492698, "uuid": "d47603a2-ca18-48bc-8067-6a91580537fb", "comment": "Malware payload (Amadey)", "value": "5a282aa1c85e14161bbf0c45e2ff6235f1a4c9df", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492698, "uuid": "fba808f9-931e-4f69-bf5a-e0d4836c0b3e", "comment": "Malware payload (Amadey)", "value": "305db480378bd0e0402d670e16b2fda97aae92723752682102ee2640a3138edfe62b9e9e853b762d3cdaacbe2ae56509", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492698, "uuid": "8a02ffa0-c01c-40c6-8fa7-74da209d5404", "value": "T14E152323EAE85572CDF63F7428FA06C32B7ABC911D3553A31798A48A1CB31D4543176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492698, "uuid": "a1f68fa6-dd65-41ac-a005-6c8511c19bfe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492698, "uuid": "51010c35-85d2-4641-8efb-4e8a0c9415c5", "value": "24576:SygHl8evYH/ZPq46y04+0nEw3kZsUwGLZ4X5:5uo/ZAUjEw8s7HX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492698, "uuid": "763936f3-3fbd-4043-9096-c491cd14c7ee", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492698, "uuid": "90760cb1-b540-4b80-b821-77cd9732b218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492698, "uuid": "4cfc39cb-d3d8-4dd9-9b2c-0a81a4d8e938", "value": "86aceaa45ea934057a0b2fe5b8f4bdb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5c4530-2411-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689537014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537014, "uuid": "73a230ba-6c34-401d-857b-fac9cdb481f1", "comment": "Malware payload (Mirai)", "value": "269c398aaf3d96f6de48c7a1d479c718", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537014, "uuid": "bc2c05d0-0ecb-4023-88c3-40e7bffbe027", "comment": "Malware payload (Mirai)", "value": "347d5492187a59b49f021b5426eb7590b0ababb04d9917523bda0898854aace2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537014, "uuid": "c377662a-ac7b-40d9-9742-2125709509f6", "comment": "Malware payload (Mirai)", "value": "62bb9a1ef0743b91b8c29a82c138b8d3705af2a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537014, "uuid": "03bb77b0-d580-4918-a82e-d4b7e87368a0", "comment": "Malware payload (Mirai)", "value": "d28cccbc1986b3f0766777ac30cabadac082db0332268f808891b9af1062e125de5fdcc68ba3ac526272884cf24b2afc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689537014, "uuid": "c48bd904-f63e-4dd1-9adf-5e90fdd674e4", "value": "T1E3D35C46EA418E03C4C61775BAAF418D3322A755F3DB73068E186FB43F86B6E4E67106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689537014, "uuid": "2d21a2d3-3ab4-4234-ab05-8da7921bfb26", "value": "3072:7q6kTgG9C2rrF95hGfAF2rcJuIzlDaN3HM/9J6mC:WdgGVrF9ufAF2rcQIhaNXM/9J6mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689537014, "uuid": "baf2e222-9a6f-4b50-98d6-3c7eeece8058", "value": 137680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689537014, "uuid": "86172313-bdd7-43df-95c1-4edf93332a30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689537014, "uuid": "342d22a8-afdb-4b77-b8c7-11a42b38a2a3", "value": "0xh0roxxnavebusyoo.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b8d008-2408-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689532901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532901, "uuid": "0fdeaf06-0763-4b1b-863d-26925d2bf4ca", "comment": "Malware payload (Mirai)", "value": "061225509a9981069951a1a5137c2d68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532901, "uuid": "07b2c8aa-ca5c-4414-9358-4fbf01e6222b", "comment": "Malware payload (Mirai)", "value": "34cbbae3dcf899d3be8903f3583775488f6d8ec3a44748757ac28a3f8375da20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532901, "uuid": "5a202ede-8ac9-43ac-b7b3-922e55f9b486", "comment": "Malware payload (Mirai)", "value": "3eeb9e7e871769466e46edab301f4989465681aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532901, "uuid": "dd466d41-e749-4222-8e1d-0497a0aab427", "comment": "Malware payload (Mirai)", "value": "17c45dbecbd6d87f9bcd1c57c9001247959929897670ec545f506f9e6ed88d5377373ad158dc6ee80c380d654322b766", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532901, "uuid": "1efa0541-cff5-4d36-945e-f4c6d468ba16", "value": "T1A8532C96B8016D3CFC5BE6BE40110A19F931376129B30F2BD6A7FCA36D321A65D1BD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532901, "uuid": "16913496-0cec-492e-ad33-355eb5bc644a", "value": "768:HeBaz0tMQaaZ261DmbgiWJNS5LhZ5GGuKdOmXPLzqovl9uQ8yhh5Cu7VqntyPGy+:HUfi5LhXGGukLXHfvlMQ8yheu5q4PGDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532901, "uuid": "93db07c8-c9ae-45ae-b5fa-8a76af02cda1", "value": 61288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532901, "uuid": "c98263ef-aa77-4b46-86fd-de76e1f60e55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532901, "uuid": "918a58a2-0205-433b-a8b2-84d6f14d42ae", "value": "061225509a9981069951a1a5137c2d68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15239e12-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492390, "uuid": "8a2152b6-6643-4a62-a705-8fe1c6da75dc", "comment": "Malware payload (Amadey)", "value": "645161e16811572b30755a8dd13804d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492390, "uuid": "8c84f87f-73a1-4bb4-bfc5-1adc2742aa3b", "comment": "Malware payload (Amadey)", "value": "35215e89572ecbfaa3a436e333cb1e0f098d17d677bac7e993c09a031326cecd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492390, "uuid": "38fa7b6e-e5c5-458a-8bb3-1813c1d9bdd2", "comment": "Malware payload (Amadey)", "value": "972909ff0fbf6274e8eeeacef8150a03c0bd49c8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492390, "uuid": "c208bbdb-1900-4a66-8c11-b99056eae6f9", "comment": "Malware payload (Amadey)", "value": "c4ebf7570c9bfabdbc95791c325865d160f984644305601b362508b68b50809f05a6cdde54563aa8654dd986d8370e44", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492390, "uuid": "fa9af4ad-b57a-46f0-b6c6-a8006671ef08", "value": "T164152343B3EC4473D8E527705CFB06830B3CBDA35A78976A2746599A4CB32A4A436377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492390, "uuid": "549db7ea-8328-4038-9980-5835056cde38", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492390, "uuid": "336a623a-d1c1-4806-bde1-5f2cad0e86f8", "value": "24576:ByEdMQZ+0922lkeOtO4HajahGiXa6TgVSC:0EdPZvkeOtTa6Xjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492390, "uuid": "7aa10ff6-bdc5-4aec-9ef0-add84358a03f", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492390, "uuid": "2903cd5b-ba18-432b-a8ba-7d1ee80d58a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492390, "uuid": "18087004-6604-4d3b-84f2-2b2350c87689", "value": "645161e16811572b30755a8dd13804d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1942be27-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689493685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493685, "uuid": "ac4e527f-2ae4-48e2-968e-ab418c86a4cb", "comment": "Malware payload", "value": "33d31d0964520dbe0a990d52b638efea", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493685, "uuid": "43f5c752-4575-4ba6-b760-31f10777f700", "comment": "Malware payload", "value": "35f0062df59602561a200293799a9e023b24ee1d1b69eda6ca28b435ddc9d3e6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493685, "uuid": "635bc138-c8ba-46fc-9fff-abc18f8d3482", "comment": "Malware payload", "value": "2204d2c2b0fd0227827e2cde43865b543d221234", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493685, "uuid": "d6683193-188d-4a0b-ba3b-60d2d6a7b5b2", "comment": "Malware payload", "value": "4384c9e01675a0c2246871cab877a19a0c2a8398320bb6f9c52105ae1d99fb48cbd1e111903544a692cdf54cba3dac5a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493685, "uuid": "8a341a67-265a-41b6-80ba-2dea5fcbf8f8", "value": "T1A353D08721729015D1F71E7472AF6029FEB23EB36B2B4BD328D2312B0573795E932209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493685, "uuid": "0659a461-89fc-4778-801a-b71be3ccbee2", "value": "1536:GL49i4o6e8RkTA86bvUH1Ht7Uhrg/q8Hc:i49dowyTUDUHbNq8Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493685, "uuid": "90365d8e-02d8-43fe-99c7-d53ad21562f1", "value": 64872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493685, "uuid": "b779d1ad-567f-4c23-9871-964fb7567edd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493685, "uuid": "3af7b9c9-0c1c-4848-8d33-e539581c61df", "value": "March - PO# 4510225181.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55fd1fd-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491773, "uuid": "6cfc3afe-3aab-4ce2-ba99-692b9b2fcc89", "comment": "Malware payload (RedLineStealer)", "value": "288539f077f97c5c6c6564d4ad3e68ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491773, "uuid": "a4c0edb4-b90a-416e-8ed6-7e901df75325", "comment": "Malware payload (RedLineStealer)", "value": "36c09a39b81f36b530c2ebd20584e5cd1196bfb628aaa3ae14f9fa30ea22b25d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491773, "uuid": "4feb169c-d026-4b65-a3e2-9e1069389b4b", "comment": "Malware payload (RedLineStealer)", "value": "1a82ae2cbd37d7880bf48f3a3148120957270a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491773, "uuid": "c8ca3185-11e4-4643-af2c-82faa670c7bf", "comment": "Malware payload (RedLineStealer)", "value": "8491348a1062dff24ec9fea6695043fce9a6f40cd0edc108877689eda3d2f32c3fe563c7502f416adc8b7734738c9b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491773, "uuid": "3cec3e54-2135-4f8b-abe7-4b4e56447876", "value": "T1D9F41203EAD95572E9B727B159F603D32B327CA19E28532737919DBD0DB2680A035B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491773, "uuid": "f29c4cde-ac03-4071-a93f-d661c5d40001", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491773, "uuid": "cc59aed7-c9be-4a24-82a8-6ceaf1f74288", "value": "12288:bMroy90i77iJrfiqnjLV/eUiHs3iQs/3Mar0z98oc7dX1wMyVMRvn:fyZ74qqn3V2xsAfR698Hd6MyVe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491773, "uuid": "eeab7630-a891-47cf-9685-b5eee7ddad4b", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491773, "uuid": "8fa42e5a-2b31-4194-868c-f2b4cfcdfab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491773, "uuid": "7a0dfedd-e1e3-4bb4-b62d-ec0523127a1e", "value": "288539f077f97c5c6c6564d4ad3e68ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb342cf4-23f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689524048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524048, "uuid": "e51b8c36-3216-4469-b6bf-43a639d43324", "comment": "Malware payload (Mirai)", "value": "5c12c61bc9d9c07245d09272ef07975d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524048, "uuid": "90334f28-6fad-48b6-b5dc-94252972d05e", "comment": "Malware payload (Mirai)", "value": "36d3457c374149f1e2075b4537e3dafb99f1312c970df7e7e94b4176b30f1376", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524048, "uuid": "7ce39224-9222-4635-a0bf-3970788f0b34", "comment": "Malware payload (Mirai)", "value": "8b1176ce2ed80a366eecf8cc0b6c49decd608d61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524048, "uuid": "f3724cba-e8a4-43c7-aad5-a91ea0b98be7", "comment": "Malware payload (Mirai)", "value": "66270c4f596c9694f449d176d5610814378781f75beb9eae0fb33b017c0127fd2d49338666e9b802d54c44686b040869", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524048, "uuid": "9f1cb673-a143-4633-b6e3-41f3cbc62177", "value": "T188336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524048, "uuid": "72bc0b42-b42d-4c1c-b3d3-6ca407094ffd", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689524048, "uuid": "e60b0ec1-8253-4753-8bf4-3a52d3eceab3", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689524048, "uuid": "30693214-e0a7-4888-a684-aab1ab283ebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524048, "uuid": "3f58b829-2828-4e93-971b-3e367f598f78", "value": "5c12c61bc9d9c07245d09272ef07975d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea923e6-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689493694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493694, "uuid": "1038a5be-0b13-4510-8c06-c20fd0a33104", "comment": "Malware payload (AgentTesla)", "value": "97307db80c47ca00a99ffc27e99a41db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493694, "uuid": "e9c5aeec-f22a-482c-b822-5fd43164b8b9", "comment": "Malware payload (AgentTesla)", "value": "371748075203405bdaf48e3e7e0959518694c7fab58c432ab360fddcae784552", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493694, "uuid": "001aa28b-740e-4d4a-b373-e8251b811918", "comment": "Malware payload (AgentTesla)", "value": "d84e94c2457399fad3f913b0b2036bd6c8eeab5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493694, "uuid": "52af6ecf-9942-4607-bee1-dd88ce6b1a59", "comment": "Malware payload (AgentTesla)", "value": "7df459d9f372423ef167dd7a1805c033b787c2f5ae593d455246ff7f45baee2ab9fbd2fc925757fe7567e6aac2e0fcf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493694, "uuid": "9a62fe12-f1cc-4cb2-b191-a49df6ced44b", "value": "T1220512063914492BC2763BF94F2162B437FF5B8B3A16E7CB1E47B49998D6F4A1210B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493694, "uuid": "08c2c39b-1cdc-4810-802d-da1baa52e3cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493694, "uuid": "c437659b-6eed-4a87-a1ba-81c9f6524c23", "value": "24576:+GgG1tCuei+jgqONBRRlBrVi7yxkpaQ8:hgqtCDi+jgT/lziLpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493694, "uuid": "b934cc68-384c-454c-8298-a6085cbf34d1", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493694, "uuid": "616d79cc-f539-43b1-8ca2-954c6caa2d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493694, "uuid": "94fde9e5-4bff-4190-b572-15743ed7abce", "value": "INVOICE NO.28898177WK9w7O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7168067b-23f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689522609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522609, "uuid": "7d88e0f8-5a11-4a99-88e1-7e32061fd840", "comment": "Malware payload (Mirai)", "value": "c4be571fcbfca2ecf3f48d89a5a91f2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522609, "uuid": "9011516f-d4c4-4edd-887c-75b37ab4d7fb", "comment": "Malware payload (Mirai)", "value": "37451a463f9cf8dbcb22655921f67f5fb733987924caa6db1b0f3792db2eb773", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522609, "uuid": "a27abe29-5b41-4d53-bc06-6e65bc8730eb", "comment": "Malware payload (Mirai)", "value": "c8107f90d078a6e9a9adf4f3eed70c474b3037b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522609, "uuid": "18e65a9d-d760-49f0-81f4-581420b5d57f", "comment": "Malware payload (Mirai)", "value": "0de6be211c8cc6c52abf237704597905028c9ae91c7720ca40ba58c92d94163addbf6a0f6f27574bd8a555e558180454", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689522609, "uuid": "9de3026d-f18b-442b-aa02-302558ec5e78", "value": "T140A2E015BF18828FC832693455D9EAD61292FC72F2EDCD592A40C15FB4B33E92474E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689522609, "uuid": "aa1dfca8-9989-403e-9379-af3b773e7312", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKq:M98o08kxofBE+ZkXaqGbp2F2TWul0c5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689522609, "uuid": "db611610-f03d-4dc2-8749-7ab235309e20", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689522609, "uuid": "bd73ee07-9227-4ea8-ae5f-674831704b67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689522609, "uuid": "cec4e50b-72ce-4b6f-be6c-16e986977fb6", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5ed5c8-240e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689535460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689535460, "uuid": "3294074b-01ca-460e-b66f-6d6f620bb002", "comment": "Malware payload (Mirai)", "value": "2c791de552da223406428b319906e6cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689535460, "uuid": "04908251-1357-492f-9a10-01208ed54c56", "comment": "Malware payload (Mirai)", "value": "38baa14aae7716202be6cf82b64372bd79f44e71e13047c7006bfd0239c0f325", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689535460, "uuid": "acd716f1-69ec-4532-a922-1600c8a51de7", "comment": "Malware payload (Mirai)", "value": "5061904048a10abb38e301ef89eb22e3fa81fe27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689535460, "uuid": "b9709d52-496f-476f-afcb-c3457023deb6", "comment": "Malware payload (Mirai)", "value": "d40b542b864fe92fe9403b73cb681170a58ffbf1eb295921dccbe07d6f37244b5522171a9746ad2231b5c5b1765f91d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689535460, "uuid": "15ea06cd-627b-4a82-9fa7-d7117f92a10f", "value": "T1EB534A217A792E17C4E4A07E25B38324B6E5678E32B8C65D7C723F4EFF1066064171B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689535460, "uuid": "14faa7fb-5428-4808-a3b5-d38a1b8ff629", "value": "1536:IDK6bb9lTEFq1X6JySbe5/Tbrv0kC1pdYm+A:mKQ27be5/Tc91N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689535460, "uuid": "4060c807-79d1-4b3a-86c0-0e22292f9115", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689535460, "uuid": "185b80c6-1dc9-4c5c-9b9a-bf5599fabb6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689535460, "uuid": "ab7a33d5-2487-46c1-9a65-e5dca7068e73", "value": "2c791de552da223406428b319906e6cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2b773a-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491759, "uuid": "2d2339fd-cbe6-4e8a-956d-d2f8b5b99f46", "comment": "Malware payload (RedLineStealer)", "value": "173ce39c7f3c5a40e98f2dba7b2bd47e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491759, "uuid": "7651728a-83ac-4229-9256-793094cc2313", "comment": "Malware payload (RedLineStealer)", "value": "3931c3ca01cc35353f3a071c6ef787511253396b8e24e12cdf7dbbe451ac80c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491759, "uuid": "44e8cebf-a5c2-408a-9217-0c2de1d50860", "comment": "Malware payload (RedLineStealer)", "value": "5565bb09baf037dfc79a68eb6a74d05dadbbac92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491759, "uuid": "a23954a7-f83c-4935-8fba-d1a9969e58b4", "comment": "Malware payload (RedLineStealer)", "value": "dc8d09c7a1de5bd96369b46ce4b3dd950a6e899f7f9b17509de9670d0279c89389224986ea7a821f8ff1bfa646617925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491759, "uuid": "9087e953-dd12-4717-8df7-c996f382957c", "value": "T19CF41246FBEC9032DDB1237068FB02C30E397D92197953BB2A429D0A4DB37A4693575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491759, "uuid": "2f4b31af-f837-40c2-81e5-e3b215c8a8cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491759, "uuid": "a5a05f22-590e-454c-bb8c-1156a0a345b9", "value": "12288:XMr8y906F6kccByXDZiyDAHQec61kznMvAb5bWCAS7zYXaOwa:zyRFsDUyDkXIMcB1ASHYXqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491759, "uuid": "aa91e9fb-b1b6-49be-9d7c-a22997bc709b", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491759, "uuid": "f8e52bb8-50d3-442d-8373-672591d4b329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491759, "uuid": "b94e0468-9a93-4f0d-a2c1-2cce2df07d59", "value": "173ce39c7f3c5a40e98f2dba7b2bd47e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9be0569-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492693, "uuid": "d221d305-5977-4c43-9b10-c67e97c73502", "comment": "Malware payload (RedLineStealer)", "value": "89756bbb52a06b8032a49c82533c4aef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492693, "uuid": "de0f2c78-0c4b-4ae6-9bd5-d5ca99607c3b", "comment": "Malware payload (RedLineStealer)", "value": "394686946ffbed77188f8da312be9d36b220bfeb682cd47c269828c3c5467b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492693, "uuid": "6c1b1233-b99c-4e6f-a936-8c610d3b855f", "comment": "Malware payload (RedLineStealer)", "value": "4fae46ee1073f3f9fba4186f1eb5d7aa90390e03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492693, "uuid": "7cd6f0f6-8f09-42b1-9380-d370cb6d9dc9", "comment": "Malware payload (RedLineStealer)", "value": "90638ec913cc477ce9f1fdd1fd0c75cd2ee05dd8e2e0916888c301c6c56ffc6c4542528f9d698cf759a67644a797b1cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492693, "uuid": "d8c30627-15cf-4340-b997-781d2db26bde", "value": "T1C0F412929AE901B6ECA4377044F613C70E3BBDB25DB4867B27965D9A0C33646F03036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492693, "uuid": "e100cbce-cede-4daa-8344-c38d5dee5da8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492693, "uuid": "98ac43a6-9fc0-4278-8ce4-27a88ea96960", "value": "24576:gyxf1pNQ2tAvAY2aPA+11VpLFf2jzgpNvC3w:njpiA74UjeNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492693, "uuid": "c2ea7a24-2c33-4d15-a452-64f3fecbc94a", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492693, "uuid": "c1b9aa09-f206-44ca-bdf3-acd2256f619d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492693, "uuid": "78e9a7f2-f757-48a1-9be5-82fcd38c86af", "value": "89756bbb52a06b8032a49c82533c4aef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a319a6ff-2407-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689532571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532571, "uuid": "80d543b7-ee36-4e97-af52-541e7425327e", "comment": "Malware payload (Mirai)", "value": "f4e33f849f6d730a719d985a2686f110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532571, "uuid": "4d4da1ff-e170-40f1-98b7-583942fb635e", "comment": "Malware payload (Mirai)", "value": "3963cf0574b7628028bd763ed0523028c193838022c5d9b766cfb0073d474d07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532571, "uuid": "4c04178c-7d56-4ed6-9acf-52abcc4dcbdd", "comment": "Malware payload (Mirai)", "value": "59527e2bc591a25aab1d973d4e8cc0ee06cfb5ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532571, "uuid": "ee66f557-a967-4346-ad92-0cd79eb4a5b8", "comment": "Malware payload (Mirai)", "value": "deb667d4ca1d5dfa26f2dd590709765c31fff206fc471c8c559767fded0d40277d4cdd748c46da3ba8e65328bd9ff40b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532571, "uuid": "c025cb8a-334d-4cb0-97cd-944652100005", "value": "T11773980A2E35CF6CFB5D823697B78E21975833D626A1C649D15CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532571, "uuid": "7d2bc5cc-92d6-41e1-906d-a21b4c5d4dc5", "value": "1536:HogWL2T87i8qXc3SEyOlnXLKgLhaV4+6uHO/YQBS/hP9AAmd42+Is:HoB2T2qX49JXLKgLwV4+6B/YQBSJP9/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532571, "uuid": "58e0895d-67cf-4fb0-a5a2-03627d52894e", "value": 80072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532571, "uuid": "aa178a42-3c9d-41b7-8803-5e1b521b1aae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532571, "uuid": "4ecd51d8-268e-489e-9ffb-6fb19805dc83", "value": "f4e33f849f6d730a719d985a2686f110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63c2591-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493922, "uuid": "d4942e11-ba9e-48e1-899b-6f96f7b60014", "comment": "Malware payload (Amadey)", "value": "fa691796528eb4aa0f0cc5c6c1aef978", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493922, "uuid": "696f5b14-77ee-405a-8cc3-1ca2fd35960a", "comment": "Malware payload (Amadey)", "value": "39d37169514c00dee2a146244eff208407d47483a473288abeabc5431f2ecef0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493922, "uuid": "ee0b49ed-5efc-494d-90e5-5bf6d4f5e72c", "comment": "Malware payload (Amadey)", "value": "c3c19c02bdf3a77661eb2d67fd316a364d0e1752", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493922, "uuid": "66a6e683-e6da-4832-8fa7-df0dc93a1ac4", "comment": "Malware payload (Amadey)", "value": "c6e431d649f6f97a941d4929435eb5f489a80530dee2e12d2ba5540402c963bc547ce3d1d902ca235ba671f186de1ccc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493922, "uuid": "e40a45d2-ab23-4656-a9a5-5f60c24c387d", "value": "T1DCF4121367E94433D9712B706AFA03A30B317C766E38931B279A6C6B2C735D0A631767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493922, "uuid": "b187993f-891f-4549-96b3-da475bfa1a42", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493922, "uuid": "dfcdf04e-0c6b-4814-ab6b-0d60293ec674", "value": "12288:ZMrey90iuS5eFyMOAClJfTs7McP5jlF9UF6bSenX4lZ7abJ/bHorrvq29dXMr:XyrxgsMOHApD+UmqXs7abJ/8viUXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493922, "uuid": "5f5a7b61-4709-4fd8-b99c-a044b5cbdc29", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493922, "uuid": "a23879ac-bd61-4b80-a6b3-87f682a7282b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493922, "uuid": "85f3813d-7c4f-4e51-bcdc-59833d825b59", "value": "fa691796528eb4aa0f0cc5c6c1aef978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f567adb1-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493625, "uuid": "7da2d163-c74c-4eca-9a11-80b811079581", "comment": "Malware payload (Amadey)", "value": "9ceb7e981876441b81635ed856e5ac11", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493625, "uuid": "5a435247-b264-408c-869f-4fc7e0e07214", "comment": "Malware payload (Amadey)", "value": "3a0ceb2aa80172e3223e5154bd251fc1909cd353262609fa6bfeeb684d7761f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493625, "uuid": "7ac0881a-9d86-462a-a864-d0b704ff150d", "comment": "Malware payload (Amadey)", "value": "98c6e57fa8988129fbb40b89436f4248bf02c617", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493625, "uuid": "13e88d81-4571-433f-ac0b-0c7c31ee39ee", "comment": "Malware payload (Amadey)", "value": "ce5552b104df2b5fd7df63fd171a7f3413e145034b40bf223897456f522888e4347519b562fc68193df43eba1d6849a0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493625, "uuid": "f0d769d7-11ad-440c-8fe3-4b2fe0989e91", "value": "T196F41252FBE88172D9B5237019F702830F3ABD5229B453AF3281685A0DB3BD5763176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493625, "uuid": "44ac9974-4cb2-464b-8dee-a8e6e83860f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493625, "uuid": "aafe46e7-30b5-4106-9654-736804899152", "value": "12288:bMrWy90ucNTOa/oSXd6k6GMAhDH3RcZcVzhvfr25meC/N7ycpyv1:9yhcN7wSsAh99rvScd/NOc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493625, "uuid": "555ff79b-bf70-44c4-ab81-dd134d0b623f", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493625, "uuid": "32dd24f1-7be8-4556-8984-9740b98f8eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493625, "uuid": "1d3a36fe-1ad8-4bb7-a340-b4bd416eb04e", "value": "3a0ceb2aa80172e3223e5154bd251fc1909cd35326260.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ea01f4-23db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689513406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513406, "uuid": "647bf36a-2f2d-479b-9f18-ea569d08f595", "comment": "Malware payload", "value": "6a8912cb71abbefeff1fee4ee85172ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513406, "uuid": "5d1d00b5-f02a-48a1-9e0f-8b65bb07fbb4", "comment": "Malware payload", "value": "3bb21ea2efd0052322e17baa5bbf07a81a980e3fcd9878356860b9369080f663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513406, "uuid": "8519680e-9d8a-4836-9645-717ed18a6583", "comment": "Malware payload", "value": "8d97c00f6ccf37d945015c1423d0d0601f8ac774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513406, "uuid": "7c00aa3f-a8c0-43b6-a727-dfd21ade651b", "comment": "Malware payload", "value": "0f9067aa84c5aebc03966cd0c0298db20a9ed73e2a7fe7b7c776bef3a7c1ace9c52913913e9bfb3e56c45c1187582306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513406, "uuid": "096ff374-485a-4e49-9876-140aa137d199", "value": "T19C447D2232D4C873D5B321754EF68BB573BAFC208A75864B23D43B0E5E316D25639396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513406, "uuid": "ae90191d-21f7-40e0-a084-b81698bb9c1f", "value": "4dce0ea0c7e6aac5a753db90b7799eda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513406, "uuid": "1b339753-e3e9-4612-8a84-b595730c1310", "value": "3072:lxUm75Fku3eKeJk21ZSJReOqlz+mErj+HyHnNVIPL/+ybbiGF+1u46Q7q303lU8O:fU8DkpP1oJ1qlzUWUNVIT/bbbIW09R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689513406, "uuid": "ba3bba6d-9b3e-4a75-8d2e-b910def42f3f", "value": 275751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689513406, "uuid": "7c32c955-fb43-4874-b5eb-556bd5c2a278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513406, "uuid": "41fbcaf7-5c77-4439-a71d-c17d8f2afe16", "value": "6a8912cb71abbefeff1fee4ee85172ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42fe065-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491771, "uuid": "58dad570-10d7-4a9e-b7f0-297f00125bfe", "comment": "Malware payload (Amadey)", "value": "fee8d5ea9c37a108c5b933a700f05c8e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491771, "uuid": "7e5e9534-a1b9-4f71-a7da-9d8f15015939", "comment": "Malware payload (Amadey)", "value": "3c476aaf906139ed8ed40cc77e9d3d2b4484716cb45333a7e13ca6605f10fc6c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491771, "uuid": "3a0c4756-02a0-439a-b005-8cc8815beb44", "comment": "Malware payload (Amadey)", "value": "b6991349e13ef619786d1a3197d42e6b5265e509", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491771, "uuid": "0bb68efd-5c0a-4bc4-bb26-56aaca9cbd67", "comment": "Malware payload (Amadey)", "value": "fc2976af6eb2afc1ee3a33e4fbd919b4145edd2aec34fe068e79de12c92f0fd25ab1d8f4ea9c8fc80f93bc07cb2a013b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491771, "uuid": "dc6781c3-927a-4f34-8b7d-274fd8012c3c", "value": "T1FBF412429AEC8137ECB41B7168FA0A931B36BDA64C38476B2241685F4D733D0AD7537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491771, "uuid": "6639c7be-a831-4b21-b108-e29da41e7625", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491771, "uuid": "264c8447-345e-44f8-8bd1-dd8fcd9b0ea8", "value": "24576:vysRnp8aItnjmq+kYdQ0KGX4l4ilGiIvr:6sldCjDYdQ0KGogx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491771, "uuid": "08dd818b-b2f9-40c8-af91-61cb17cfd1ee", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491771, "uuid": "663243db-751c-4052-a4ea-ba65396deb03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491771, "uuid": "a0b93e67-0c6f-4824-8784-9e44fa451276", "value": "fee8d5ea9c37a108c5b933a700f05c8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85fbc11-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689491912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491912, "uuid": "9dfd3329-96fb-4920-9a2b-ef5624447a90", "comment": "Malware payload", "value": "d83fc334e23e01453d5278b0d23653d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491912, "uuid": "267f97d1-4958-4dae-8b3a-c7b8e8de3a04", "comment": "Malware payload", "value": "3cef0225174d5402f3cd707ba3fd1c9027c5bb31691f8814a9924923322aac62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491912, "uuid": "475d0d77-dd8c-47be-be85-5208ae23876b", "comment": "Malware payload", "value": "98d888bdcb27f6227ab9cab5bfab99e783022939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491912, "uuid": "1c5e1fd1-0fec-419e-8a93-d1d358b17f2c", "comment": "Malware payload", "value": "d35527aac9c600a22afe7ac02deb985f09168bb577a04cceb75a83ac7b00b6372b255fc02ffcccb403eec2a14e7d48e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491912, "uuid": "4d6fcc83-beef-45fc-a5d3-f37396b9555e", "value": "T144E429F9E85282E5ECB9A0B521FCF723849D5EA09FE119C307C81BF681109C9E9355ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491912, "uuid": "3aef1c0d-34a1-4633-8a8a-be4e37aa4d02", "value": "57423b5afae18340d4d20251213d0ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491912, "uuid": "c4abd5a8-3c8e-488a-9285-83caca82c712", "value": "12288:USiBTTZDpCZ+6VPwEiuHcciBdu9B/uaeWLeZk5fdZV18:RMnEiHpOJh5fd18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491912, "uuid": "d33344fe-7ad2-49d7-a78e-f1ba7f85f033", "value": 707659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491912, "uuid": "46e8befb-dbb7-4b72-a920-96b2b6d9572e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491912, "uuid": "466d47b5-3fa8-4a87-8a0c-dc901eb0a2df", "value": "d83fc334e23e01453d5278b0d23653d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0026a9-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492399, "uuid": "daf9bab7-b977-4142-b2f4-c1db9e4f6a69", "comment": "Malware payload (Amadey)", "value": "781470eefd07f8990d4b5711631ac4d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492399, "uuid": "7cf3113b-1569-425d-81c5-d7fc4bb10432", "comment": "Malware payload (Amadey)", "value": "3d96b466db0e6251bd8f1b7d49172995010d720c0a5da0aa8eac6e9d7d6dc4f1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492399, "uuid": "e9c004f7-68b6-412a-8826-27f426f9405e", "comment": "Malware payload (Amadey)", "value": "07f12751038ad991b533ec63be881718ba132181", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492399, "uuid": "7f455451-de54-4e11-87ad-0682d1598fd3", "comment": "Malware payload (Amadey)", "value": "aaf13a0a4b88461ce07926f006e6c007366b530cd766948371bcd7d0a63589791b7fccfedd0c69261f08503f95f88350", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492399, "uuid": "96855c04-ca32-47bc-9e9c-d44f0dbbede8", "value": "T1F4F41202E7E49423D9F22BB058F703931A36BC611C75E75B3BCBA85A19B25C4917633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492399, "uuid": "7d955d7f-cf76-4649-b216-0f93e803c76f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492399, "uuid": "0c85f302-178a-48bd-a1cd-b7c26fbad58f", "value": "12288:VMrSy90S9Ye140EsjEpxvAtWkaxKUB6gztwpUky2tyVM0u/rQCD45T5I:fyn9YraEppxQUB6ZpUk0yX/r6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492399, "uuid": "3007be05-dada-44e6-9552-097ef7e29781", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492399, "uuid": "91a33b00-968c-481a-921f-53f0a010e75d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492399, "uuid": "e8ca4f6d-c9ba-4b2a-94d0-c4d230c18607", "value": "781470eefd07f8990d4b5711631ac4d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50cc785-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493920, "uuid": "efafb017-0564-4176-8809-ed0cd173118b", "comment": "Malware payload (RedLineStealer)", "value": "74d452cfeace60ce408eca1c90419f21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493920, "uuid": "bacd7ab6-7988-4043-aec8-915fbf01a68f", "comment": "Malware payload (RedLineStealer)", "value": "3f65b5245c66a092fe034a8e3295388954757ff2f8e87142896e45a429afe04a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493920, "uuid": "dc16156b-60ea-4327-a650-eccfbce58ffa", "comment": "Malware payload (RedLineStealer)", "value": "e1f156f296aadb9881f0685d0e7700c57c1e3dc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493920, "uuid": "e922630b-b3bc-4243-b355-5bc6e14f27ae", "comment": "Malware payload (RedLineStealer)", "value": "dc2cd0ebe508ddd429ec25f2e7bec92d66d51aa4e6963e9b08def822cf1948224dc1be5b63e7a9f1b500ba49f8ea37ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493920, "uuid": "d6b77432-bb0c-4fb6-a2f6-9ad03bd06b84", "value": "T15EF41263ABD94172EDF2277444F613D30A36BC918E3D93AB2356AD9D08B3544C6B072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493920, "uuid": "cd146c40-f154-477b-9596-ee1afbed99be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493920, "uuid": "1396397f-ed2d-4507-a464-0535591750d2", "value": "24576:WyQvAk/G3uV+s7ApqQVfM6T9pCaqNhUlo0ugrZ:lQvjea8qw1T9wzhUlJugr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493920, "uuid": "e663f175-bb4b-4d95-b6a7-d46e6aa41e2e", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493920, "uuid": "03ffcc98-f247-4630-b1b5-963dd3492439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493920, "uuid": "4605f0b6-2e2f-40ff-8713-8850358a5a00", "value": "3f65b5245c66a092fe034a8e3295388954757ff2f8e87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990838c9-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493040, "uuid": "c6763f6c-3d57-4e5f-b242-e08b3528fce9", "comment": "Malware payload (RedLineStealer)", "value": "e5560a3ee4cb822f13202a6665f57fbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493040, "uuid": "796ea62a-6249-41b2-99c2-9b3fe60b22f7", "comment": "Malware payload (RedLineStealer)", "value": "411cacf02cb265fe7cef59c0cf4dc97798a89ef5da2de26b3681cea1e59cee6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493040, "uuid": "af555da8-a2e2-4bd1-9df9-65aef92c36c1", "comment": "Malware payload (RedLineStealer)", "value": "db3b42336deb9a53c0f7e69f49d329e1b31444c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493040, "uuid": "3da1e333-d34a-4662-a38c-af0a52cf24ad", "comment": "Malware payload (RedLineStealer)", "value": "bc863a80d6d97617fa5567aa791b85cc264a0a50ab7b78e84acbc8cf05b98781fb1f4de9e6839e9426e28ba5ca93c59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493040, "uuid": "6effdad0-6c9d-42a1-bbf5-b65a0c4f5515", "value": "T1D6452396EAE08423EEB527756DF603830B397CB04CB5872B2BD50C5A4C72545B936B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493040, "uuid": "2882d5fd-867d-45c4-a77b-66c9880f779a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493040, "uuid": "8b438f1b-3519-4acd-a515-ae29a8e138e9", "value": "24576:3yC85mABqaObJq64kxPpkgf4qAVMQzJuavbKtt6mnOAalN6qE:CCaKqhkxmqAVMCzKttnOjN6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493040, "uuid": "bd249f3e-80f1-4293-b9e1-f3339b725ac8", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493040, "uuid": "5281ce58-19ee-4bd1-a3e1-4542f03bc555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493040, "uuid": "dd5d5a9c-6f2d-40b2-b207-c9bb6693ae3d", "value": "e5560a3ee4cb822f13202a6665f57fbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cf438f-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493330, "uuid": "3f14377d-5fc0-42dd-868a-858f16c5a0f5", "comment": "Malware payload (Amadey)", "value": "f150e785645f3c563cfd65cbe1546eec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493330, "uuid": "6cd97c7a-3078-4f50-b921-c64399194bec", "comment": "Malware payload (Amadey)", "value": "414a76ec595769d527571be13b3ca5268c3a2d6e9b7405d796d85644f706f42f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493330, "uuid": "1c01e87c-fdc8-43a5-939a-1258e91e1e01", "comment": "Malware payload (Amadey)", "value": "0e1099edffd4cca82200a939d46727336df7fe73", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493330, "uuid": "268873ae-2ce2-4243-bb34-84bdde0025f9", "comment": "Malware payload (Amadey)", "value": "191fb21eb6d42fd85e2dae30951b8ae1dd82fe8c39f60b115cf04a36acff7bef6988c0c8b0ccf877329350c1a49a54e4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493330, "uuid": "04503cb9-62e9-4154-9141-da21298f2b07", "value": "T168F41243EBD940B2E9B12BB118FA43C706357DA69879C61E3786B80A2D332D8D575733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493330, "uuid": "834a8155-0228-4b95-9c16-6d95fab27e7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493330, "uuid": "bff25c20-97f8-4ffb-aefe-b080e0498da7", "value": "24576:syRDvigTXi3WbNzXwkCvIcRVuZsvFpapmJj:bRE3mNJeGsyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493330, "uuid": "d182045c-0949-49ee-87b0-76b5631df2aa", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493330, "uuid": "55607f91-3da4-4c77-9d8c-69966c9ff5ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493330, "uuid": "1fc7051e-7dd8-4830-9448-43b4155b523c", "value": "f150e785645f3c563cfd65cbe1546eec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e0a96a-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491767, "uuid": "18156ddf-5c60-41fd-8e45-fa4b8ebe779d", "comment": "Malware payload (Amadey)", "value": "1beb0795600816557ce325b1c1b59324", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491767, "uuid": "92c110d7-eb9b-4cf7-91b8-caf761a290a5", "comment": "Malware payload (Amadey)", "value": "41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491767, "uuid": "2aa324a2-736f-46dc-8823-6950664f8cc7", "comment": "Malware payload (Amadey)", "value": "acd5093044581410d96d772542ffdc6894a135d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491767, "uuid": "98deaee1-b1b9-4480-9f5d-439653f5ebda", "comment": "Malware payload (Amadey)", "value": "5f571d6418dd53359d3a116fce25cd87f8806c2936286142c7631cdf62be7d3a15ce845ea1411d544f52245829ce0e0c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491767, "uuid": "50690a87-7917-434d-9713-514aa03212c9", "value": "T190152246E7DD04B2E8F277B028B903870A353C916E35834F7781AE1D2C61AA1A57777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491767, "uuid": "ad8d8a8f-769c-4b0b-b230-fae91854cf17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491767, "uuid": "694f8814-3206-4226-87da-91ac06866c5f", "value": "24576:Jyp6CnbbnjhaWAaqWc5YbDUAmuHVunxx:8P8faql54Dl3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491767, "uuid": "85b8cd18-1606-429a-8676-7f03366b1c45", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491767, "uuid": "1fc7f3f0-1b64-4b12-a802-ec44add366f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491767, "uuid": "11b6d11b-966c-4875-bef5-c339f8eb9433", "value": "1beb0795600816557ce325b1c1b59324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb0a889-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491790, "uuid": "8aa9cd49-71f0-47f0-b094-643e127a769c", "comment": "Malware payload (Amadey)", "value": "33c68fe88987df4b38ef5827c403ab87", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491790, "uuid": "2beeb43f-ce04-4e37-b40d-6569b0864a06", "comment": "Malware payload (Amadey)", "value": "4370ba25ffcabe0dc05e0c95cb4ff6ac37aec045b2f045a69df202361163ff7e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491790, "uuid": "e865c1b0-c70e-49af-9125-7c26ab41165c", "comment": "Malware payload (Amadey)", "value": "a40d4c7117bf88527d395b98ea5abd6468d9459b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491790, "uuid": "9b47fd59-3984-45cb-959a-d3b8d61eced5", "comment": "Malware payload (Amadey)", "value": "2a367ff896a40a2faa1beffe9a6e9246f76b199982a65d77637210ddf977aa7ec02264f31784c3b9f81031358472ee7a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491790, "uuid": "fbd124d8-3ed0-47a8-995e-1c77b4272753", "value": "T19EF42207E7E08037E9B1577148FB03870A367C716D34A3AE678B688A5CB219CA57532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491790, "uuid": "75b4317f-ab6b-43ce-a7e7-c205d3046dff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491790, "uuid": "81d4c3ed-7d17-4968-8f3d-ff58a4d581a3", "value": "12288:FMrty90KJZzDOnlVYJ4Bcs6LtEpiclqB67GLqp7ko2tyVMZmardH+F98X:wyL/wrYJ4l62tqB6/p7kmyAL8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491790, "uuid": "1045ffff-56fd-4fa4-aaa8-f8bb7a934658", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491790, "uuid": "ec74efa6-1296-4b0a-b406-3092b2bb74f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491790, "uuid": "790eeb0e-36f5-4521-8d26-feb6c990f049", "value": "33c68fe88987df4b38ef5827c403ab87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf397a7a-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689493131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493131, "uuid": "5c36dea2-05ff-4b07-b47f-0b0740505ca6", "comment": "Malware payload (SnakeKeylogger)", "value": "ad145e2d73475a2bad864b5baefae1d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493131, "uuid": "690d4f5b-55ef-4d13-a751-fd9f879eb580", "comment": "Malware payload (SnakeKeylogger)", "value": "43bf507d699974ff75c793b89087ca9276a16de2599c74e74d4d9028df6e1ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493131, "uuid": "261d75a5-8015-4c79-9e7e-26b0fa28bbd7", "comment": "Malware payload (SnakeKeylogger)", "value": "67b2db6378cb9f2ea70c38bb85f3a7c38648f3cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493131, "uuid": "83bb8ab5-fb9a-4743-804a-aeb4304ebf05", "comment": "Malware payload (SnakeKeylogger)", "value": "ab3f5434f09278b93d1c11b8fc6c34954fc61d45c941708a6db354a635ad7eb8a63d328216ca19753ac1b00aa9f21b23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493131, "uuid": "f1cb3d54-8065-4630-83af-fd71313418d2", "value": "T1ACF4016D33E7110FCE5EBFBD1C890AB9C5F9A9153902D2879EC7384E9C28E4586407A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493131, "uuid": "907f4c12-11c9-47be-ba01-1185a50afdbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493131, "uuid": "a77e6003-bb72-4a00-ab29-1b3ee3a001d0", "value": "12288:Od6L7PVnlf8imbhaDnLMzIL2q+RTdOL8pCTMzet+9XOsqfmJbPsVFqyTkPgAlg:z+OyqGUL8QR0NxJzslTyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493131, "uuid": "f1c5bb3e-d282-42a3-a93f-45ff31d3668c", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493131, "uuid": "673fc74f-2fb9-4940-a672-4565082fd8c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493131, "uuid": "584a1dd5-8986-4283-89c8-8ccc90e7e39f", "value": "ad145e2d73475a2bad864b5baefae1d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37280f05-2383-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689475696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475696, "uuid": "1fea89c4-444d-44e5-85c7-95a86e90a89a", "comment": "Malware payload (Mirai)", "value": "9af78ddfa2d02f28dfd22627c04dfff9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475696, "uuid": "074eaec1-0f1b-424e-82b3-f084ed9daecf", "comment": "Malware payload (Mirai)", "value": "446b8e67fe71cddb7dae38ee57db64853271e8c327ac70fbe8d8e856a599e88c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475696, "uuid": "1eb80ea6-a80a-44b5-b2c6-83e9e0596fa5", "comment": "Malware payload (Mirai)", "value": "cabc0f424235116bbd1876caded861208c52bf11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475696, "uuid": "1a3a8f2b-d73d-4ba5-a9df-6f1c94c4a7b9", "comment": "Malware payload (Mirai)", "value": "cb29b6d49b64e0974f4d8c048ab0527402acaeba2085d305f71e0354bc004a1ed8c7ea223fdc757ccee1aed4460aaf3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475696, "uuid": "a0ef8723-bd90-4bd6-bbd5-fd563743ea04", "value": "T1E6634AD3F809DFB6F809D73B449305067230A3A54A821B77B353206BDD762A92977F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475696, "uuid": "08063455-73e8-41c3-ab6d-3d9edbeccd7a", "value": "1536:C7pDCdtR2nOXop+DV8yQBXZZX56ymwj+GcRcNGYKo8yzo7zBL:CMdtRX4p+DgBXT5T7L4YKo8yzovN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689475696, "uuid": "96cc8af0-b0fd-400f-92a9-98360287b7e2", "value": 72568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689475696, "uuid": "91b762dd-af3c-4f70-b76c-95a994dfc233", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475696, "uuid": "4c2f977e-aceb-4089-97e5-7ded54f9eeba", "value": "9af78ddfa2d02f28dfd22627c04dfff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10700294-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492382, "uuid": "dfb73dc3-60ef-4928-a4e9-7bca7ee8ca6a", "comment": "Malware payload (RedLineStealer)", "value": "6bac020c02bb282d0dd71e61e2f5a9e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492382, "uuid": "49aa01e8-1704-4d1e-ac51-8a36952dabc6", "comment": "Malware payload (RedLineStealer)", "value": "447636417566f3a95ff9482bb8181b9380e74255b333d90bb5e50affb62be603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492382, "uuid": "2b596488-954b-4938-94c4-d47057003893", "comment": "Malware payload (RedLineStealer)", "value": "e92539d287c269d37e3e97dc2acdc984d32d9944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492382, "uuid": "aa4880ff-a5bd-41b0-a211-cc89b8b70ea1", "comment": "Malware payload (RedLineStealer)", "value": "80702dde4321bb998e4ec6ed68d5677b0bc94704589b7cb05419da8bcfe984cf7a59982ff7e2c2f40920e094296ae055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492382, "uuid": "2b2e60a3-87a6-450f-b568-46d77ec6fc9c", "value": "T13915231297D844B3C0B7577058F707C32A367C749DB8C22A3796666D1CB22D1A9BA337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492382, "uuid": "39084e6a-3960-4b0d-82ef-28e07190e631", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492382, "uuid": "3b76c1b1-40b3-4f00-8f5c-861d6ec2628b", "value": "24576:4ySVfdHONar2/4GUIU6KIA8Ql/6uWaBC1:/SfdufAGUIMZBl/6Ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492382, "uuid": "a6513c29-d025-41b3-929d-d228d15180e1", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492382, "uuid": "ea6ba974-a370-4aa4-8660-e467c1080ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492382, "uuid": "bb98e2c2-3cb0-457b-be46-16da5157d4a4", "value": "6bac020c02bb282d0dd71e61e2f5a9e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e521b0cc-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689491880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491880, "uuid": "97c6d47e-fe4f-4d73-a4c2-cab0533bd209", "comment": "Malware payload", "value": "8fd2f01fbba3af5737bd926ab04f54b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491880, "uuid": "4ecbe1c8-f366-4ca2-8222-22c122cdd87b", "comment": "Malware payload", "value": "460b0e5269977119b3033950ccb7a13f5c206922575e42dae12410bc1e72db2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491880, "uuid": "e8e153dc-605b-4b88-a5aa-86368867bde6", "comment": "Malware payload", "value": "c1b0a53ab74bd885bb3237d0a2db22b60c76568f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491880, "uuid": "b92886bb-d07c-4913-9964-a71bf775ff00", "comment": "Malware payload", "value": "5dfe69badc1da2e319d967b75df1970151757b990647b96fae01f13f836e4d90c207a91c04f31d5c4eb59a8470b03357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491880, "uuid": "bb892fdf-90dd-4c7c-8e9f-64e638de0369", "value": "T197C4D63368A541E1DBF990BD8BFCE433375C94E217B24FC7068A16F992282D16E3658D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491880, "uuid": "1e414f96-2820-4cf2-ac64-a0f00cec5c4e", "value": "57423b5afae18340d4d20251213d0ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491880, "uuid": "fccd7691-ecd7-4c0e-b46d-f4e7d800cb05", "value": "12288:USiBTTZDpCZ+6VPwEiuHcciBdu9B/uaeWLeZk5+:RMnEiHpOJh5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491880, "uuid": "edb44daa-8a27-4dbf-9186-e3f25433d799", "value": 575891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491880, "uuid": "de5ab150-642d-4bfb-8dad-8304b1b358d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491880, "uuid": "9b487e31-9d55-4abe-b1b3-97cd1fe8c6b8", "value": "8fd2f01fbba3af5737bd926ab04f54b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc72b63-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529849, "uuid": "139e1d5d-fbc2-4e86-a6e8-954ff297b5c7", "comment": "Malware payload (Mirai)", "value": "be1c9b6ef2a85566f42f4e71bbad94a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529849, "uuid": "3b604c3d-e4b3-47e3-beb0-12c807c9bedc", "comment": "Malware payload (Mirai)", "value": "4705c7d4b26f11c690b461caadedd9cecbda009f3e93eed7f82aa44f3b30c237", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529849, "uuid": "e6148611-02d8-42db-bdd0-3508a8b11927", "comment": "Malware payload (Mirai)", "value": "aef6fb389e25481bccfe2753d5a7348724e44a5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529849, "uuid": "dbf95f55-1700-4099-9b77-29ae0e898fc7", "comment": "Malware payload (Mirai)", "value": "41c4cf1dc9e0503a2777b1258f7cab55c554eda15f97089ace64bff285cdfc2484aae9e767fea500ec12d2cd50b031f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529849, "uuid": "2960554b-199b-4579-a423-d3cd543cdf42", "value": "T100E31946F8819B11D5C112BAFE0E128E37131B7CE2DE72129D246F647B8A9BF0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529849, "uuid": "4f3415a2-109f-49ca-815b-f169150a0e22", "value": "3072:7uXltEHQC13P/XSqzDB9aqt92irNDzCCicUoL0F7:7uXltKtdXSqzDDa+jpCC2oL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529849, "uuid": "7df840a7-b6df-4d8a-bf30-104d493118d3", "value": 155164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529849, "uuid": "448b0bdb-020b-43b5-87a8-97456bf628e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529849, "uuid": "0654efe4-792a-408e-8a69-10ef691b16d5", "value": "be1c9b6ef2a85566f42f4e71bbad94a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ebbb4d-23be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1689501147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501147, "uuid": "7d0d6b4d-3b62-4ca8-bd3d-8ca0e1c68872", "comment": "Malware payload (Smoke Loader)", "value": "edc5c89d57bb84111b66780dc7d7fc27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501147, "uuid": "232eb567-a8a8-479f-b468-7a4af34ce7db", "comment": "Malware payload (Smoke Loader)", "value": "470e93134b2e4d19076792887f553f79cd8b1b54fe0b4b0bc03878df47e2440c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501147, "uuid": "f5f2bfb4-992f-49ef-870a-743278c300ce", "comment": "Malware payload (Smoke Loader)", "value": "741b6f31a1f2a699751fd4df2205b1c09683608d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501147, "uuid": "8bf5a532-3b66-4f2b-a2b3-3d3fc52a2faf", "comment": "Malware payload (Smoke Loader)", "value": "d50f1ab90970246a91a982b10bed6fb8772b67141a2aa503a42472589ad364b66c600227013f360b7e9a933e9895f3c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501147, "uuid": "faa9058f-6e2a-4c10-9ba8-f6c88473ed4a", "value": "T15544F84392E1FD57E9298B729E2FC2E8760DF6508F497BB52158EE2F14B3072C263614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501147, "uuid": "54c1d3b8-3e75-4219-86ed-a38d8998b2ac", "value": "0af0ab32fec6d387d477684bace95bf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501147, "uuid": "90b67017-50bb-4da7-82f6-92c7f0b01e45", "value": "3072:l4RL2zddEsXIlIMEnXL/CYHMLfaxkLQLl0YTU54uoaTS:ORL2hKi77KYsLfgqk0Yh9aT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689501147, "uuid": "8d9c7772-84a3-4dec-b144-2ec4449fc08a", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689501147, "uuid": "fc221dfe-a91f-42db-92d0-e9b386e2aa57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501147, "uuid": "0ee1496b-0a78-43f6-aaae-af28ef107796", "value": "edc5c89d57bb84111b66780dc7d7fc27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164e3b69-23d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1689509142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509142, "uuid": "4c97ca7a-0ea2-47aa-817a-f5a5c2a1f65f", "comment": "Malware payload (CoinMiner)", "value": "9911b684246fccb29c889ed68dcdac20", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509142, "uuid": "269bede9-a915-42da-8517-0a7ebf0b2594", "comment": "Malware payload (CoinMiner)", "value": "4750dfff318bcf5ba7bf432cc40a868140a07b6f3d1a8114bdd625a762799703", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509142, "uuid": "c2e7aa3b-5c0f-408f-b2c3-5e9efc5863bf", "comment": "Malware payload (CoinMiner)", "value": "999608569c2b55812a6f459f41bcbf586b6e7de3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509142, "uuid": "9d02cf59-dafe-4da0-ab5d-05ba02c342bd", "comment": "Malware payload (CoinMiner)", "value": "4893c6ceb72f9bb937d956bf0ea1fd9e6295efd658f2a868325fc85b2461061eeb312371bac574a4d0291ead19118dc7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689509142, "uuid": "f063e26d-4671-467e-8040-708505b5f30f", "value": "T191E4331621A77D4DECBC5E7E7697981B2526AE7B92C0B3C2C0E289011FD9BFC60251DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689509142, "uuid": "91067baf-9e0e-4c3a-a1d7-32c516e4a5fd", "value": "12288:UEcus5b+kocdm3aYpPTQgdBpmHF+DxyWPoSFfGiqpT0byy16opTL3tsLRsJKV:PXsF+kVdY7L4Afv+lZmD6QtsLCJKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689509142, "uuid": "fff433c7-442c-4dea-8de4-434a67c5353d", "value": 693016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689509142, "uuid": "ae0ef1ff-119e-4089-8008-add83ef83588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689509142, "uuid": "070ce925-0f4f-4606-abea-4717db673091", "value": "4750dfff318bcf5ba7bf432cc40a868140a07b6f3d1a8114bdd625a762799703.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e96aafd-2388-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1689477803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689477803, "uuid": "93b2d9ae-5f8b-4f40-951e-ea8ec681f083", "comment": "Malware payload (CoinMiner)", "value": "ff806c88d1afc7ecc5b8ea62f5e77d0c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689477803, "uuid": "78216e53-29f7-4b1d-94cd-5b25051e34fa", "comment": "Malware payload (CoinMiner)", "value": "476d24bc7fef70c639a7fc7469adc0c45b1dd52f3c8907bf06d6c878f2a61fdf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689477803, "uuid": "75284f2d-df3f-4ddd-b49c-8faff4b5d103", "comment": "Malware payload (CoinMiner)", "value": "030248b1c51d566becda13282f633cee5721cb20", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689477803, "uuid": "4cb34688-bbe9-4a7c-bc43-f13eaaf42c0d", "comment": "Malware payload (CoinMiner)", "value": "4cc760040f507d47ec12f21d5b26ff17ef15c2e4251d6730028e33ba1c6bb26e045bf9ccf1a1f2a4532a24e24a34048c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689477803, "uuid": "272d2f80-a0e8-44e5-b3e6-d26c113bc878", "value": "T1C4A5338D2AE420FAF47297744BF241A65A72BCE5563517EF22A0807C1F23B90D532F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689477803, "uuid": "9d2d0947-b84a-4801-b756-59e5843a4ae6", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689477803, "uuid": "7ef2d80d-4b9a-4c4e-a9d8-5291157ee6ca", "value": "49152:pXf3/5wcxAIyFmijexdr0iW213Iw0b+RMgDOmRMi8:tfRwc3rHW2L0bCDOWMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689477803, "uuid": "7502ea4a-4481-4419-a6df-7b849c52a5ab", "value": 2238976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689477803, "uuid": "14216b49-7b13-4747-9eee-4947ce44adcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689477803, "uuid": "38ca0e89-1909-418f-aef3-8dcb0a22fb8f", "value": "setup.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb572ae-239c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689486604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486604, "uuid": "212a2120-c271-432b-8065-97261459ceb3", "comment": "Malware payload (Mirai)", "value": "79987d75fbe1697550104111de3f7f4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486604, "uuid": "ca9c699c-31bf-4239-b5d0-2d772662206d", "comment": "Malware payload (Mirai)", "value": "4927a92a399bf95b0009937760fbf34b7da64bb18055d45d8372d35690f6eafa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486604, "uuid": "bddd89f6-8e71-4d30-b92e-bbe13ae75b99", "comment": "Malware payload (Mirai)", "value": "b8ba8845bd3c8ebc85b825a87ffaaf34f517a632", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486604, "uuid": "25534ca9-0f2c-4dfc-8d50-e419af6f85d4", "comment": "Malware payload (Mirai)", "value": "c32d31a9e4051e1c460ebaa260e9962758484875340074c0037f8490d131c6081e3931bed47f4b3bd53841c94e09fd01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689486604, "uuid": "9be3f83e-2efd-43c6-b994-ca7d0395201f", "value": "T1DB3302A257AD29E152B09377BC33AC56629C17F99D5730DA2CF0AB1577C08024EF2786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689486604, "uuid": "fea4a5f1-6ca2-4562-bc82-8339907d4750", "value": "1536:d9O/ZMAXIxNUk06uLcPqF1aBexo4opKZbi:d9O/ZNKyxLGqFUFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689486604, "uuid": "736df6e7-5b21-4ace-ae0a-760db2cb28db", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689486604, "uuid": "095d387d-3874-4fc8-9398-13bec8be67a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689486604, "uuid": "18171cad-0024-4877-9c83-f03468800c36", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93107d89-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493030, "uuid": "f666717c-9b3e-415b-a3de-cdda9bb2d9e7", "comment": "Malware payload (Amadey)", "value": "d976a8f57aa35a2bcf103cc9aa8b879d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493030, "uuid": "a0686d05-eae7-4505-9e05-dd0fd27c5603", "comment": "Malware payload (Amadey)", "value": "4a3dd3191ec150a56e0b222adec9224329cf17d37a6047ab79c079e79a6abb7f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493030, "uuid": "c65e6b97-abb0-475d-b110-1a14ff2c3751", "comment": "Malware payload (Amadey)", "value": "bbb2ec929dbb8199b2f6937220cc14b89fb16c3b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493030, "uuid": "d64e1b24-3804-4d0b-911e-c93cef29533e", "comment": "Malware payload (Amadey)", "value": "a3b09740e000fb85be7dbd3b8104955de9a10995342d366501583a6466c7c44c87054c9ba3f6fb3acc17fac38685b241", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493030, "uuid": "bc850f00-6fe8-4a5f-ac33-0e0ccfdf433e", "value": "T1CF152303DFE84573D8B81B315DF603C70F367D528DA8421B6A96DCA74833A5468B2B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493030, "uuid": "611f304c-c154-4c83-82c8-022c3bd7fcd4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493030, "uuid": "35b0d9a8-87dc-40b9-883f-6be34f111267", "value": "24576:5ycQMxYQSypnxj6UUgkKbRuUtNBGvLLBLc0:sYxlSCjRUO1NBGvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493030, "uuid": "e91c0b76-e7e9-4d9c-83b2-4d8f0718c434", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493030, "uuid": "bd11c79d-09be-443a-9cbc-711902b248bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493030, "uuid": "e3b8e99f-58d4-471f-9a09-223ca02c4b05", "value": "d976a8f57aa35a2bcf103cc9aa8b879d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4758b21-241d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689542022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689542022, "uuid": "33340f33-0704-4f18-b292-ec22dd7d2ad9", "comment": "Malware payload (RedLineStealer)", "value": "9830adb8f1e433cd9e882a0a95f8fd32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689542022, "uuid": "e87d6dca-233e-4be5-b327-5097b8fbd19b", "comment": "Malware payload (RedLineStealer)", "value": "4af55a79245502d5996bc221af187ae7d92d8ce9ae4f0474bc955ab19429b608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689542022, "uuid": "087fe17d-c6de-4b7e-b35a-9e79f8a66eeb", "comment": "Malware payload (RedLineStealer)", "value": "a18e4578a7769ba48d634b03451d821e3deaedf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689542022, "uuid": "3d8caa30-7061-4d55-b521-19892912a57e", "comment": "Malware payload (RedLineStealer)", "value": "e1d12baad784203bee94b10f6459d38bae92a8222ea0596f7098d8012a4aad0cf0b8ac76fa24556da2547f5c58935ae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689542022, "uuid": "0f4100ac-a474-4548-bb22-a951aef736b6", "value": "T140D46CE1F8E04162EDE2E0BA32ECB52C015DA4F0C7255AC756C8CFFAD6603D16B3655A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689542022, "uuid": "eba0d389-26ee-4a78-8a22-08d1f815c955", "value": "366b889fbf8b867e33436fbbbc4d0c58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689542022, "uuid": "f85b3039-4cd5-4ef1-9a66-1a04bb00519c", "value": "12288:F30e+2Z//7yKB9UyTLrY1X6ql6Au2qwLF1UxdxiRGKPU72A3CZ:F42Z/JrYr6yLF6xdxiRGKPUSA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689542022, "uuid": "78e1906a-c305-4dff-97b9-c3fccf0b5fdf", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689542022, "uuid": "0646b270-421d-4bf1-a14f-c7e7d10ea80e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689542022, "uuid": "7e9bbead-137e-4069-adac-e4e26179e01c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b6c409-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492120, "uuid": "4c5d1b9c-b023-4062-b6fc-859bbf5a62af", "comment": "Malware payload (RedLineStealer)", "value": "71be01bb024a89a23ca18aa6a77d160b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492120, "uuid": "33428c68-7158-47b9-8950-8df1e53692dd", "comment": "Malware payload (RedLineStealer)", "value": "4b8eb941853bd390287dbcbe8dae61e1b226baa6661172eff6766605a0047ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492120, "uuid": "a6b0a357-9fd5-4641-b920-621945491ebd", "comment": "Malware payload (RedLineStealer)", "value": "4d11090dcfa1809209f5ead33ff2359628985a5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492120, "uuid": "4f2fa0ad-111b-45e5-a349-7775d44ba74b", "comment": "Malware payload (RedLineStealer)", "value": "59014795a3f2ba2a3e603d1383f6e41392cd8dba48220b5492fedf19b55ccba512aa6e7580d82b4c9ad7b3286250f98c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492120, "uuid": "fc612f35-b111-47d5-88a0-e341bc0c98a6", "value": "T131452351AEE46063CDB67B3018F217D30E7ABD901CB9860F234A585F1D73AA5D4B872B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492120, "uuid": "5dbc83cb-874d-4bff-9c48-0c3c99d2d412", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492120, "uuid": "d017f0b1-8b7a-4325-8ad1-b9cf871d19ce", "value": "24576:9yzGzXUUN6D6ScsWIPYUSsXqzlIQBo+/RpyPQqhNFGIO/:YQXUUN6D6CwvsXsWKoIRsxhNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492120, "uuid": "87e93699-c1e4-4c3a-a88e-5cb65e2cc397", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492120, "uuid": "e8dcdd5e-1feb-47e0-a3a1-11c18ff7e1f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492120, "uuid": "69b81ab4-f633-4328-aef5-95747888b1d8", "value": "71be01bb024a89a23ca18aa6a77d160b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8739c832-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493011, "uuid": "f9ac072a-dc5d-4c76-a23f-adb4126950f7", "comment": "Malware payload (RedLineStealer)", "value": "d39dcf62ac8d380a1c819828c2df9863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493011, "uuid": "ddbf9dce-6f09-4098-a8de-a85736ea1018", "comment": "Malware payload (RedLineStealer)", "value": "4ba6cb4492178ca2ab5729d4990d7abf5d07686f7a8b8a027bacc9104714f151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493011, "uuid": "0d1a6338-12d1-49e9-9945-4101fa4d1cdc", "comment": "Malware payload (RedLineStealer)", "value": "e66c0aa9aaade69d42409a1768d49bce300cce09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493011, "uuid": "54770abf-543c-4f53-9a3a-de7094409196", "comment": "Malware payload (RedLineStealer)", "value": "39975e417952eeaa92624464b460bde289b1ab5d3f3962b570740efdb4f7163bbcce4ee49ce83b2ad2ec553a9c4f1446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493011, "uuid": "d5ec9b31-d4a0-46f0-8540-04d464672654", "value": "T144F4120197DD8832D9F527705CF60393157ABDA259A8C3671B96A80F4CB3AD0E93633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493011, "uuid": "27b8bc68-2b6e-4930-ba4e-b9564e35d959", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493011, "uuid": "46f2dc89-e366-4fcb-86ef-81f4a19a92f8", "value": "24576:DyYjJwU3/H99vy+cyB5XCCtEBdesavnWTQjxP:WYlwk/H9h/BEBgsaxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493011, "uuid": "15c23359-e375-4e11-b3dc-0de557915020", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493011, "uuid": "55f4e5e8-ecb4-491a-bd0d-ee598efe0921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493011, "uuid": "e9491f15-5cce-43d6-ba64-fd7734e6bea6", "value": "d39dcf62ac8d380a1c819828c2df9863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7dca56-23f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689525609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525609, "uuid": "ce086f26-f0c4-4adf-8d58-67fa0aef0054", "comment": "Malware payload (RedLineStealer)", "value": "aa8faf889d1d6868c5a0123ab5a0f5e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525609, "uuid": "9ae41449-361e-40f5-937e-77faedc83216", "comment": "Malware payload (RedLineStealer)", "value": "4c4cb7ae3946aa2cd0040b76b458599e948e43bdb508ecb69882191f07d44232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525609, "uuid": "327ef61c-2683-4207-bdf6-1e9f64b53dde", "comment": "Malware payload (RedLineStealer)", "value": "c654934d97fb3af927ad678d510e66072cf5a1de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525609, "uuid": "c5c8fb0b-5d52-4581-816a-8f7108dd7e99", "comment": "Malware payload (RedLineStealer)", "value": "47e8838a99bbc1157ff6d00f1cb07e093fda45254fa20db634f10523cd988ef2bd301420de97afae246cd696d0589abf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525609, "uuid": "101b2d46-a6bf-4099-a978-cbfb36eb3d7b", "value": "T1E9A4184393A17D48EA258B769F1FC2E8B70DF6D0CE4D7B693219EE1B04B1076D263A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525609, "uuid": "edf49107-be0e-4fd3-81a4-015a9e681614", "value": "326441378ca815656cabd6c06990bf3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525609, "uuid": "ec4e1855-7a62-484b-9162-eeaab41bb97f", "value": "6144:NLPg3akV0pDWxAF6oeXN8ttUQCKRACdO/7cB2zeg700oMqlYToZQUFG7:NDg3S6ocN93KRACGWL0R8uUF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689525609, "uuid": "b4b34d45-fc19-4292-bdb1-aafbee1e8347", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689525609, "uuid": "a673bb63-75af-4afe-adb3-23648541ffa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525609, "uuid": "a2b134d5-6cfe-4a1f-ab85-1d232dea690f", "value": "aa8faf889d1d6868c5a0123ab5a0f5e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c602ecc-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495891, "uuid": "ce735002-0a06-4ac7-9323-e432060cba7c", "comment": "Malware payload (Mirai)", "value": "edeade3a30b764c91078d796eae7404b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495891, "uuid": "5016ca62-ab66-44f4-ab92-165e1809345e", "comment": "Malware payload (Mirai)", "value": "4c6b4ed687f22e6e7bc6b1c89a7196a3f2d2d16a0ddc78d2f4b61bed52356753", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495891, "uuid": "a8d7fb4a-5863-491e-883c-a9a546d6383c", "comment": "Malware payload (Mirai)", "value": "efe7be11e25af259e77e9030dda866e7c1951d7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495891, "uuid": "148b34e6-212c-4498-8e25-c3792389fbfd", "comment": "Malware payload (Mirai)", "value": "05d0809e6a42eb5a535a690d9cd247374d970b8007160bc67d8faed9269b998d584d2a71d6477578ff418af7d40822ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495891, "uuid": "763a5c62-23ed-47b0-a24d-17d8d9eefa83", "value": "T1E4A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495891, "uuid": "b50c5402-68df-4c8f-ab4f-f8ea54a43a13", "value": "3072:VK1z13U6HzHoXRtmTUhQogLEmmFVcqq0GnDZT:VK7DDeKlogLEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495891, "uuid": "9d3a0329-4a08-42b8-9b81-cd858f748d1d", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495891, "uuid": "af4367d5-106f-45c6-9b84-35b363169062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495891, "uuid": "399c1bdf-985f-4c55-8fbf-a6566bc8d6b4", "value": "edeade3a30b764c91078d796eae7404b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568468ea-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492070, "uuid": "a82b629f-94dd-48b2-b212-ed08683d2482", "comment": "Malware payload (Amadey)", "value": "2ff65e9ca8a0b92b2f9ead3ba8dd7ed2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492070, "uuid": "43d8473b-71ff-44f7-b095-9068bfd547b4", "comment": "Malware payload (Amadey)", "value": "4d09936a4a5e882005320c53757dc18469109b9f86d4b6003bb674e1658b0dbf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492070, "uuid": "53ce2db3-ef14-4b39-b4d0-d61000404e55", "comment": "Malware payload (Amadey)", "value": "bc118c8a4ba9391e5bc4315eef3d0dd83afaebfd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492070, "uuid": "4212a323-6f72-4ef6-ba06-b28e3a61ab8e", "comment": "Malware payload (Amadey)", "value": "5e7a5a5385ed1c1b05687d06143668dc2d13e2f4d54b4d4cf54778978e4fee2b723f9625b3a5fd530e85ca0b27fba13d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492070, "uuid": "78a4db85-3cb3-40ff-8231-50631344d1c6", "value": "T105452307BBF89436E9B55FB01CF626830A75FD751EB4832F2309A80A5C726146835B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492070, "uuid": "1b19f06d-0fd7-4349-9b1a-8cfde01905f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492070, "uuid": "4a60ff6c-88b6-443f-8c23-510a82cc16f4", "value": "24576:YyZkbJInDZr4+HhuBykcdH3B3laSprA5MBkWUhLfYTemxmdza8xPjo:fZkbSDZTHc9cdH3aSBA5I4FduaPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492070, "uuid": "ad3461f3-d7cd-43fa-a5c2-720bf4018bae", "value": 1218048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492070, "uuid": "1bae04a1-056d-412b-a278-fc224f0c32e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492070, "uuid": "9a1ed06f-99e4-4752-8faf-745cee005463", "value": "2ff65e9ca8a0b92b2f9ead3ba8dd7ed2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83badbef-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467235, "uuid": "12b49b28-2f56-449c-abb4-1310b403f106", "comment": "Malware payload", "value": "7f48a4e1f91a07900772319e4ea4b757", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467235, "uuid": "69b29297-cf00-49fd-b7bc-49fe320009b9", "comment": "Malware payload", "value": "4dafc346e4253bd1235cb11a6f09779dd6ba528dd5cc999980b95dd5755ba77a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467235, "uuid": "4b99f06c-22a1-44b2-924f-ea0b1dbc931d", "comment": "Malware payload", "value": "2b6a20168d3c2785d190f7721ebac726c73df799", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467235, "uuid": "a2b35d65-9ee9-4f8e-afd7-6d9f5003d44f", "comment": "Malware payload", "value": "a347982c4a65e34f50b2eb07bb288eeb563d67b4066945af6828fef89b10604a5bc49ab890fc26573ff51aa404fdc1d7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467235, "uuid": "d0945730-6cc5-4a12-96de-cd055b02b9dd", "value": "T173159D41FBC3A58FEE5D853C88273AA44BA0FE49BE3A52F27E9172DF5931F901505608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467235, "uuid": "2cb56ed7-b4c3-4c5b-8061-fdc33aaad591", "value": "12288:EqRe69Ayq/4aPisKA/pl2HM+yUN8IU03ynJNCBa7li+lirUN0wn9a:L4OAyCPL2HM+yU8TnJMBaZx2Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467235, "uuid": "678c6348-7cb1-419d-8243-749d3cc74e9b", "value": 915383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467235, "uuid": "c0a106c5-802f-4b1a-baef-886723a50823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467235, "uuid": "c4f105f1-ad23-46e3-8859-8eef6ddb679d", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.527.29268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a9df63-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1689493062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493062, "uuid": "15cad9e4-121c-4643-acd7-b99f1e7a38d6", "comment": "Malware payload (RemcosRAT)", "value": "c73e3ca4520ec7f2e2e435ce0033ee35", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493062, "uuid": "042b2fba-ba15-4349-8940-0d37511a022c", "comment": "Malware payload (RemcosRAT)", "value": "4eaf10beee3ffe3dff4d6bd78c7a8f04c7a1b067c1f7cb6d414a53d56b1dee8e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493062, "uuid": "94608a1f-8851-48b2-a54a-cab031076f8c", "comment": "Malware payload (RemcosRAT)", "value": "8780a255751a1e8e6d19e828c041cd34a7496b75", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493062, "uuid": "382251fa-d3b5-4b83-ac76-a8b19d2cdcd5", "comment": "Malware payload (RemcosRAT)", "value": "7fc9e65c4e8cb43ba5baf751090be0bdedcd7ff0057d7b48bc835064ecac8d7f1c0836113c872b5269a0ee354edab47c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493062, "uuid": "9ba588f0-92db-43f7-9d08-04ac98654a92", "value": "T19A05E02CAC2AD760E76B01B630D3C50CC52FDC1DD9937D88E9C93F99A5F0A4529E0A9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493062, "uuid": "5559524e-9f0a-4b9d-8146-8a7642766846", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493062, "uuid": "3d574cf3-c251-4548-b926-0a7c44fe7156", "value": "12288:UWbhMZJT8mJj7SnoArI5UkrdDCQcagKN0lfCtys3l1lOoXeanfL4PMUA5:9Lmblph7cau4bHcanfL4JA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493062, "uuid": "e53a9ee2-92e5-4dad-bc2c-47e5fedc7fec", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493062, "uuid": "8e6ee952-82ac-4afc-94dc-f646485b44d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493062, "uuid": "1bc6d89a-7627-4b50-88ca-690f264c9e27", "value": "Copia de Pago_ Banco Santander_Pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5520b451-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492067, "uuid": "2b8ee47e-7e15-4b17-a019-e7e41988e993", "comment": "Malware payload (Amadey)", "value": "324cb7ed10920e1912c6c390c5179a1d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492067, "uuid": "4ce2739e-d97f-4fdd-b22c-64f0eaacf39e", "comment": "Malware payload (Amadey)", "value": "4efca8805f96c16e636fc6f51197b43215b96da00409608d7658fea7ee155ea2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492067, "uuid": "451c6791-4a7b-45d0-a012-c86e01654d30", "comment": "Malware payload (Amadey)", "value": "2cb736bf107171b3047cb7b0ae7085a09704e68f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492067, "uuid": "aa23cb95-d97f-4309-8351-1faee2c61c2a", "comment": "Malware payload (Amadey)", "value": "db3971e3909d7a8253fd400f10cdf427adfcb0d3cdd2f34e69c502ef72754d9270b076205822940a477bb53b80f29f73", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492067, "uuid": "157904b8-aea9-42c1-a568-2e86a6ff0225", "value": "T19A152217B6E88036D6B5173458F612830B39BC82ACB4A37B3B86594D0CB2BD2D875777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492067, "uuid": "2f3e3d3e-e65c-4396-b8d1-d395b5df528e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492067, "uuid": "b9b2e86b-e06a-4cb2-9f20-bb0df772a2db", "value": "12288:8Mr5y90BC08ZhZRpWsDWMuTYKrTDcVl4JRh/+pnKuLp611/cNOaK+oyrfYGzfD+Q:lyTn/qMnHAhWpKuLM7B+VrfvpaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492067, "uuid": "d0808867-f4e1-40cc-b1ce-7de6cee20390", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492067, "uuid": "339f1e0d-cf40-4cff-b413-50cdc6b32c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492067, "uuid": "b0d458a2-8703-487a-a2a4-518903426523", "value": "324cb7ed10920e1912c6c390c5179a1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d3d093-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492386, "uuid": "af744215-f92f-46e8-8b90-8b9f82b20410", "comment": "Malware payload (RedLineStealer)", "value": "806e422c72778033c5ab84a122ee219d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492386, "uuid": "a5ca9d93-cc6e-4274-8aa9-7695f52f7026", "comment": "Malware payload (RedLineStealer)", "value": "4f6b8faa6814b26627c6c8eac0bc9c5237229efaec31a93ac5634db12970f986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492386, "uuid": "a7af67ee-3d18-4a3c-a0fc-6a6287124673", "comment": "Malware payload (RedLineStealer)", "value": "2a82b3feba5337f550d857fdd39290c1edbeaaff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492386, "uuid": "08cd3061-537b-47a5-84ee-fe26050a9a03", "comment": "Malware payload (RedLineStealer)", "value": "c27fa02ddb5d5f6f2889fd1706d07cd3d408b49bd8a8f69fa8045e10beb92866332f5d6b9cb2ec8204667e8f70be9c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492386, "uuid": "c77f17bf-2080-4b71-bfcd-f10574ab57fc", "value": "T1C7152311A2F50163D9B027B4A8F707C317757D718E38837B3796985A1CB2AD4A473B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492386, "uuid": "e3396e3e-0e83-47cc-8206-1cbfcb8db599", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492386, "uuid": "8b790ac5-b756-4f7f-a26e-709685d78e76", "value": "24576:lyxIBM9mCnbl4MASk1HCUvk9gY6gmZw76pr:AxASDx7HzHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492386, "uuid": "1757a0a8-4bc3-458d-920c-85f7c6d31c2a", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492386, "uuid": "9cbc7be6-ec99-48d1-b77e-ddc7cdc005c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492386, "uuid": "03385f1d-23ec-41c3-ae6d-dc5c486ab23b", "value": "806e422c72778033c5ab84a122ee219d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd176c2-2407-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689532565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532565, "uuid": "f3017fb2-10f2-45af-8fbf-7082a2bd3dbb", "comment": "Malware payload (Mirai)", "value": "a8c798f4d6ca70748e00e21dabe6e5f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532565, "uuid": "577d2625-0c1e-4003-80f2-245983afdc08", "comment": "Malware payload (Mirai)", "value": "5011be5266b9a32dcf799a7bb826c63a5528d47a8bda5aaa8cf9ae08c280a003", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532565, "uuid": "01d8ece0-89b5-40f9-9ded-11e6b7462f57", "comment": "Malware payload (Mirai)", "value": "3a5a2e71e32430eee13e1f5097fc704ef135f48b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532565, "uuid": "c3e53e34-71e5-46b3-9a4b-bb583b83624a", "comment": "Malware payload (Mirai)", "value": "fc6e490270366dbafe2c2a2339db24c3a16c57913bbed944d680ab19c812b45dd7e0a54f0372c6294fe7285c1422b86e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532565, "uuid": "065416f3-133c-41c8-b75b-908950176ac5", "value": "T1D253E59178819A17C5E422BBF96E018D373563F8D1DB3206CD226F6477CA82F0DA7792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532565, "uuid": "5da2fc51-c1c0-483c-ab50-933b89905dfc", "value": "1536:OPcVNq5WxJ+HhMv1dVAUJkulG9WXiY1dBQd42+:OPCt9pk6G9Ai4dBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532565, "uuid": "fbdf6c35-ecde-48a9-b0d5-c72cd85dd9dd", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532565, "uuid": "2f6f848b-926a-4c12-aada-a38012e51e25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532565, "uuid": "be5c51b4-033d-43a0-97b1-08ed24cb674f", "value": "a8c798f4d6ca70748e00e21dabe6e5f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7de0ae-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689493232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493232, "uuid": "32f0879d-dc8d-4b10-8ab4-db7c13928f63", "comment": "Malware payload", "value": "ba2fb04b9e8ac0e81231a2d86e1c36aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493232, "uuid": "59b8e932-6076-4690-9fb9-7d1f2e1d9407", "comment": "Malware payload", "value": "50351fe11facec63a8283f10957945df394e577ce124e38b79cade3b71bbc0e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493232, "uuid": "d730bdfd-351a-4b22-aed7-72ff90dc5568", "comment": "Malware payload", "value": "24c2ef36a8bd1d14e75f6973c3625509506ca022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493232, "uuid": "71f60afd-096a-4e4d-b7a7-e14a1266e96e", "comment": "Malware payload", "value": "8db83cbc3168cb547a2c6fee25069bfa8a57770221bb8ad1f0d5d45d8b466d284f9a9e70af27a83a462f12eedc723c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493232, "uuid": "aee50d8a-13fd-4b62-9574-26773ed5131e", "value": "T1CD32E8FF7B4D1D62D6B804F552C33E404B68D456965AF33F6CDC09B84A213DBA60268B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493232, "uuid": "8c975f55-a693-4c13-b58c-3fc75340c2fa", "value": "192:xwpmAPQ9SxMEM2IH/rOq48i9+HlIUj3ZC7JsFBMs5J219ZMandH28wC:xwwAPQ9SxnaRvj36KMs5FadH28p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493232, "uuid": "441ec0d7-3885-4ea2-b9cb-1db7403bd53a", "value": 11876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493232, "uuid": "9d65b1c8-6066-4ae0-942b-262046a4e19f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493232, "uuid": "e797badb-f24b-40ac-be25-bb6a286d484f", "value": "ba2fb04b9e8ac0e81231a2d86e1c36aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b730986-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467248, "uuid": "8c5a76fe-7822-43be-8696-0ed97f1f1b94", "comment": "Malware payload", "value": "baa404f7605a32101a9e0373d58f04b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467248, "uuid": "86250fdf-1975-4b80-9339-aa2ee5d740d4", "comment": "Malware payload", "value": "544267d05148721be7bfa339fe612c31bc459b8ebaa4ff9ac5667ecd6f4f23b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467248, "uuid": "92046047-f610-4b73-a639-41fe820036e8", "comment": "Malware payload", "value": "41e3e26e4a0ae649a9007a97185c0c63569d0d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467248, "uuid": "9f34d0ef-6d4b-4df5-914f-baaddac9e28b", "comment": "Malware payload", "value": "acd1286940ee992f9118617bb355d3a5c02b0fe58c26d34ae6680072080b17c0906ac72602ea5c8c1f83830fc4aa0f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467248, "uuid": "711afa1e-de7c-4275-b446-f31139bef3bd", "value": "T1CCC59345EB9780F9EC9755B18057F37FA930A68684B09D61FBC4AF41FBB2D22760B204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467248, "uuid": "fe6ca0a8-de68-436d-b22d-bca23bd036c6", "value": "24576:XQ6aZOaP+wNosR/GiZF6wakeNVp5Z/fTmT+tJlevZZsOUR+QbgzfuJPn5J35V9IH:LaZOaPekettVpx0AYQwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467248, "uuid": "58983423-39b5-42ff-8509-bd5402ab057d", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467248, "uuid": "042f4d54-a451-42cf-9aa4-6a4f0814d897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467248, "uuid": "8723404e-5489-4795-a427-95df66b6facd", "value": "SecuriteInfo.com.W32.Kazy.CA.gen.Eldorado.29955.24476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05590fb-23f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526204, "uuid": "a288fab1-6a84-4601-9869-a77348083dc6", "comment": "Malware payload (Mirai)", "value": "99e8bf71af92aede29b0197cc31377f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526204, "uuid": "8d122f48-4a45-49d9-a86f-4d6ee4f925a3", "comment": "Malware payload (Mirai)", "value": "545d656bc451fc73d1de1449030cbe06a18a6c970e240aa043d786f587f3677e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526204, "uuid": "14e3e20e-b197-4c1f-af58-a2dcd3fd2d45", "comment": "Malware payload (Mirai)", "value": "2e8d809c4b1e7e4ccb4f75a84985ea00dcbbf7b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526204, "uuid": "bcda0f2e-79b4-47ba-9354-3adfbd785d6a", "comment": "Malware payload (Mirai)", "value": "130ecd72ffd4e25688f6a876ed5969f09a5b32f4a6af5e9e9a9318f80bdf862234de36ae2b8143cbba431aca3fc0db01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526204, "uuid": "ba944610-f7b0-42ff-bc57-4faeb745e734", "value": "T12AC2E1BF7AA56A67FA5C273DE435811B03D4F02C57AD2B5763400432E94E81D7532CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526204, "uuid": "8fa522c9-3a79-4d1e-8559-26394cddb788", "value": "384:M21DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZH0F4tmr:vMwxdyoEUnDz+Y8tqHWXmU80NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526204, "uuid": "08772268-d59d-4e95-a234-034c50315cba", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526204, "uuid": "2e79f039-e2ab-4798-9417-ecc023bcd19f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526204, "uuid": "4016956d-a62d-4882-8a2f-d2e4325426bc", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0b8f55-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493337, "uuid": "f2342071-0163-4f36-867e-4b4860472db6", "comment": "Malware payload (RedLineStealer)", "value": "fb6b0ea88f94428d752543367f70b1fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493337, "uuid": "2d330de9-191a-4d60-ad30-1b7339f28da0", "comment": "Malware payload (RedLineStealer)", "value": "547e1a93a2de0cbf03bba505c7a2739bf5f94aceccc7ffeb473ac63291e78895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493337, "uuid": "3368844b-e7e2-49ca-8fe8-9b394989778a", "comment": "Malware payload (RedLineStealer)", "value": "0300828bb50fe468374fccf22b9fb1b9f81d6212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493337, "uuid": "2fe322d6-f844-48c7-aaa8-e54752eaaab5", "comment": "Malware payload (RedLineStealer)", "value": "022ff998db51f7c1d5fd885bee4a85ddedeb655e9d0001880cd00d6f213f7ae112c963c43b16c76ea06d470cd0ba76f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493337, "uuid": "c4216f2c-e8c4-4e04-ad3d-301f01892573", "value": "T1EF4523A3B7E98122DAB1773029F51347093ABCC76C745B6B6B11A85A0CB3B90653137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493337, "uuid": "52da5dc1-e36f-442a-acfd-2086e510dc5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493337, "uuid": "cb3c6e45-9893-44ca-8675-6c5c7424c928", "value": "24576:3ymRaQWydVQi/iYm9xnO4ae6BR55SmNjHw5Rgc+EfRPyVXJ:C7RYVXiYmXn4BTDy5uJEfR6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493337, "uuid": "a85860d0-041b-498b-bbbe-b742fb9f950e", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493337, "uuid": "d9d566b1-bb1e-4454-b0c1-6a3522ced0c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493337, "uuid": "7668a45c-f509-444f-8043-a68f64f99d55", "value": "fb6b0ea88f94428d752543367f70b1fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efa3331-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689492003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492003, "uuid": "0565b6bf-633b-4d1e-9a6f-e2401ee8d005", "comment": "Malware payload", "value": "10cb542b7c7987ad1abcdb8a253b4316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492003, "uuid": "1d2a02f8-8363-41c1-b7ef-d1da395282a6", "comment": "Malware payload", "value": "55189aa69195daa095b0ec054297d54a51dd19c42a3f004d36386c7b1f3de4cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492003, "uuid": "ba8cf28a-be4a-43c5-b620-910a0cc6a45d", "comment": "Malware payload", "value": "45fc917d4dd50817e854aebcaefeb9d68c697635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492003, "uuid": "b364d76c-20fb-4e18-827f-cdb256c9a78d", "comment": "Malware payload", "value": "8c9ad069d4f81bf9fcc2beda8cdcd157832d76d1013e019a2b7dd3602a2cbdd5e1e7cc150b8039a8e0a3f4e8501e984e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492003, "uuid": "30f1a023-529a-4446-828f-bc553cf6fef5", "value": "T13F056D36B89183E6FCB2A0BA65FCF523445C6FB017E11AC347C41AFAC5509C16636ADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492003, "uuid": "1d52ce9d-3b07-4b9a-8dec-c4e7a66f70a6", "value": "57423b5afae18340d4d20251213d0ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492003, "uuid": "25bb1906-9240-4d94-9a9a-ba1f029eca03", "value": "12288:USiBTTZDpCZ+6VPwEiuHcciBdu9B/uaeWLeZk5fdZV1:RMnEiHpOJh5fd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492003, "uuid": "63f522fb-f363-4da0-a70f-3e9284bdcdd7", "value": 816259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492003, "uuid": "34e3ddf3-df14-479c-afaa-92229c660089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492003, "uuid": "b65317f5-78e2-4d5e-8591-00a059f76706", "value": "10cb542b7c7987ad1abcdb8a253b4316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e446d38-2389-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689478393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689478393, "uuid": "aa2a3298-3202-4407-bb8b-36a6fa26a271", "comment": "Malware payload", "value": "aae219d4e703051d60351f73ca288d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lechuk", "colour": "#FABD4B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "visual basic", "colour": "#9CF9BD", "exportable": true, "hide_tag": false }, { "name": "VisualBasic", "colour": "#6C7366", "exportable": true, "hide_tag": false }, { "name": "win32.lechuk", "colour": "#131BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689478393, "uuid": "72f1a475-3f69-4af0-bf00-29cc84447a1f", "comment": "Malware payload", "value": "56947c93fb17d3339ff2a778556f4a4f95516fb5112db61ae0804ecdcf4d1307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lechuk", "colour": "#FABD4B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "visual basic", "colour": "#9CF9BD", "exportable": true, "hide_tag": false }, { "name": "VisualBasic", "colour": "#6C7366", "exportable": true, "hide_tag": false }, { "name": "win32.lechuk", "colour": "#131BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689478393, "uuid": "5e698280-70ea-4534-a4f0-d96f560b45c5", "comment": "Malware payload", "value": "1b28cbc3d27a92281ebf4754c27b9ac4a3a8c214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lechuk", "colour": "#FABD4B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "visual basic", "colour": "#9CF9BD", "exportable": true, "hide_tag": false }, { "name": "VisualBasic", "colour": "#6C7366", "exportable": true, "hide_tag": false }, { "name": "win32.lechuk", "colour": "#131BE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689478393, "uuid": "6e1427ce-84ba-4c6f-800e-30893ab2c9ff", "comment": "Malware payload", "value": "9025a94e8d9ef9271737afeb443fd3fe78252c952453a8e4ba322f2f26e52086d6d6d04d7615c56e9bb54c8058841448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lechuk", "colour": "#FABD4B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "visual basic", "colour": "#9CF9BD", "exportable": true, "hide_tag": false }, { "name": "VisualBasic", "colour": "#6C7366", "exportable": true, "hide_tag": false }, { "name": "win32.lechuk", "colour": "#131BE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689478393, "uuid": "ce7f58c7-40cd-4a50-991d-91e3a5407c17", "value": "T18CA312B4A7B4193EE27753720ABB126BF13DBC704A37879828D0766DAD37DD8B005588", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689478393, "uuid": "0535c8fa-77b2-4663-93f0-5b2f6e5b5d88", "value": "dbca8e987daf46dedd8c159f5f5a8e01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689478393, "uuid": "80d9c973-cd91-46fe-94a6-6c5b6f83d85b", "value": "3072:J2MWsQvnyo/CtkgEcnz7fsmqLGnQ7eMDLyPexpZ:J2jsgpYtEcnzwlLFeMD2Pex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689478393, "uuid": "3bca6ea4-c64b-4030-989e-87a99c1cfcc2", "value": 102840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689478393, "uuid": "3d5eac8c-8ba2-4816-9f81-e85e26cc98e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689478393, "uuid": "f9febd46-57b9-4eb2-b29c-74c0fbe31d53", "value": "autoruni.pee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11985ec4-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492384, "uuid": "ed4c2732-fb72-4bf8-8847-8111d90fd480", "comment": "Malware payload (Amadey)", "value": "6e845e4a02f79675ec279266d244eb4d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492384, "uuid": "b3ab2409-b835-4a27-87f4-9a57e36b11dc", "comment": "Malware payload (Amadey)", "value": "575a1bc3db5400ccaa9ab071bc9517395bd2efc1280e59a0fc0bd6b3c3421dd1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492384, "uuid": "86294634-c76a-4dd6-a418-1f3d38c4fabd", "comment": "Malware payload (Amadey)", "value": "7800b09237f24951dd19affd77c06020f21b79c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492384, "uuid": "5299feaf-1d1a-4171-9715-6cd34b25e644", "comment": "Malware payload (Amadey)", "value": "4872682f878fbac42b42963f426233bd866688fa1dec8801c16ae0b33363d9c6786bb27b4ebe8a700b779afce13b03e3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492384, "uuid": "b7800f0d-f70f-400d-8401-27718a33d5b9", "value": "T1E3152245ABC48472DAF1177854F606830E327CA2DA75870F37E6986E1CB31D8A4B637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492384, "uuid": "f1e09a76-9876-4ffb-83fe-d1f57a5409c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492384, "uuid": "69e0891e-0cbe-4808-aabd-774228ff75b3", "value": "24576:Byivr4K/jvR77i/4m/hEjxt7IXU+wE9HG9:0q3vNHIiVCbVHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492384, "uuid": "5b8a75fb-c9fe-4ead-8692-6dae62cd69d9", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492384, "uuid": "e7538d1d-519c-4313-8911-a8386293af86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492384, "uuid": "54cf6e85-735f-463b-becc-77d36d9700cb", "value": "6e845e4a02f79675ec279266d244eb4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a078e4-2383-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689475850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475850, "uuid": "fefce8c9-4a9a-4544-b4e9-94b46f710eb0", "comment": "Malware payload (RedLineStealer)", "value": "fde4ec171a6e988c9640d8f8dcf35aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475850, "uuid": "d8f3fa3b-e0d0-4c89-8275-a0e2718fe2de", "comment": "Malware payload (RedLineStealer)", "value": "57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475850, "uuid": "fda5dc29-081d-496b-b949-eb8ede77138b", "comment": "Malware payload (RedLineStealer)", "value": "47d357a4e617b46e47ddc8aa9869f33a3c9fffb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475850, "uuid": "4631489a-e90a-40e8-82e9-4a423b1bdab7", "comment": "Malware payload (RedLineStealer)", "value": "4eef0a33baa1b105aa151d4714e2562ff079207d63b12cc901179183b6ca37d5f991562dc88303db74e7dc1f4f5f1f2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475850, "uuid": "09e97f80-4a31-498e-b7a5-9affd68d786b", "value": "T1508612AF614433ADC01BC87C5433FC8AB1B15E1FE6E9859AB5DBB7803BFA0509586B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475850, "uuid": "65e3294a-ae29-4ecf-8334-4b4489948ea4", "value": "846876fcfaab8d0675698c01a809ad4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475850, "uuid": "1a506861-0ddf-49d0-b47f-d0189997721a", "value": "98304:9bRwXuv0bjY0mqBvzKczYA3IycQ6XpyWzI/vjhugtsoQYWb7lFGo:MeMVvaAPHzhug4pU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689475850, "uuid": "f6e6897c-9063-4efd-ad98-c0913eebd553", "value": 7864260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689475850, "uuid": "ce2f5b06-cbb9-4142-9758-df6fe42d8c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475850, "uuid": "4f5bf72f-4f83-4cdd-b816-c72578664270", "value": "57962D6E4DEA092778CA4B98D68EE62D11A8CFA88FD7F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662146c0-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492096, "uuid": "d0093e97-6815-4845-a969-bf6aa3f95e93", "comment": "Malware payload (RedLineStealer)", "value": "355a3e838e20ebfddb67e880ffd84eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492096, "uuid": "15c2a884-22db-4e0b-8b2e-3c77ada2db79", "comment": "Malware payload (RedLineStealer)", "value": "57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492096, "uuid": "6bdcb7e9-6eb1-46a7-89be-178ce71b444d", "comment": "Malware payload (RedLineStealer)", "value": "ec544c366ec75c9072f5aaba66e80d04b59f70e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492096, "uuid": "7c67333f-14f9-4153-af89-9527a88f1407", "comment": "Malware payload (RedLineStealer)", "value": "2a3544c3c455856c8ebe3c7bd2c52d6c61fc2fb58125b51e075506bc189687a1ef7c87505f5edfdc71c36b87f4129d20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492096, "uuid": "6a162850-0043-4628-907a-eb89aba41e55", "value": "T185152312EBDE4272ECB017B099F707530530BC659AA4462767A16C4A4CB3BE4F172BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492096, "uuid": "81019420-e484-430f-8950-b44bc8a92a1e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492096, "uuid": "1496079f-2813-46a6-a1aa-92d9fa3322cc", "value": "24576:wy1vtFUxX9ePZlAVZDRr/jXZOnQ0/RlSUP:31vtajegVzLkQSlSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492096, "uuid": "40cb527f-45e3-4acb-8000-9976365a5d64", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492096, "uuid": "27f1c41e-4810-481f-8d21-36a68d58da8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492096, "uuid": "70e6f659-6a67-47f8-854a-c209803de6e6", "value": "355a3e838e20ebfddb67e880ffd84eb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea0e8cc-23f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689525611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525611, "uuid": "faf9cc27-048a-4cf7-88eb-34ec8920c693", "comment": "Malware payload (RedLineStealer)", "value": "ca447c7b62918f87379f262f129364ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525611, "uuid": "25b65ccd-8f08-4d38-b75e-47c58f9d8306", "comment": "Malware payload (RedLineStealer)", "value": "57e5f2e3cd535f4e186d355e24db8fbb2d5e905f275fee9822db8140fe79a59f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525611, "uuid": "f8123512-699d-442e-8a04-acbef09f393a", "comment": "Malware payload (RedLineStealer)", "value": "aca8f12813ad69790596686ca0ceb479127c437a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525611, "uuid": "343edd24-6ac1-48e0-9b78-a646bcaee505", "comment": "Malware payload (RedLineStealer)", "value": "e824c64b2d62f6ec48c34167a02c308c0c12e948259cc5b3fb2ae6db6c803c612510bad7ce970ab997899dbbdfe4462c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525611, "uuid": "85ebed17-e7d6-4e07-b687-5bc7163d4e62", "value": "T121A42A4382A17D48EA358F769F1FC6F8B70EF6518E4D7BA53218EE1B00B1076D963A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525611, "uuid": "2d1ad47c-fdd7-4643-b16a-7dde39795c60", "value": "f3a1a6c560f808b7f46a078e7eba3d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525611, "uuid": "b5009cf9-e258-477c-912e-e4cc55243896", "value": "6144:DLw8yvzVzBV3IQFkDXOotj+eIBJtSPDZXvrVqIkQOnovSwFGtT:DU8yJ3IWoO+j+7iZ/JVkpnPwFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689525611, "uuid": "1b372a78-4b2c-423f-bd91-44c7ac531021", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689525611, "uuid": "1ab56df4-54b3-44d8-aab2-98469f7a64a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525611, "uuid": "23ad0e80-76e6-4bb0-9bf1-8d5ad5d07d81", "value": "ca447c7b62918f87379f262f129364ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d97e4c4-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492994, "uuid": "d3d51d5f-7859-4b3d-947e-8d79687ab167", "comment": "Malware payload (Amadey)", "value": "b3dfb7ca1683786c4adf4f860666c913", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492994, "uuid": "00f34164-bc53-4e42-b6eb-0a9d384584c8", "comment": "Malware payload (Amadey)", "value": "588f0d0655ede669b683b138ca3446389a8b2433a9b13676a32dcc726becd5ae", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492994, "uuid": "b5789101-804e-4d3b-8e46-4427d8abe794", "comment": "Malware payload (Amadey)", "value": "1d953e48b892bc33c27e25952d864bd0e91fff61", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492994, "uuid": "5460006b-f596-4370-9b8e-06bf97ae58dc", "comment": "Malware payload (Amadey)", "value": "2ec351dbfbda475f13843214d75c79682ef4145c86d854ea382351781cc1be8bc40c586cc2a9ad924643f5813995e0c2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492994, "uuid": "07e5ca32-11ed-4f59-b68a-67cde03b0ff3", "value": "T1C1152387EBD9E172D9745B301CFA27930E35FC656C2C436B2356A80A5CB20A1A4B537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492994, "uuid": "c5979677-707b-46f9-b5b7-3c9739378c1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492994, "uuid": "c7ce1246-cbe1-4103-9fe4-a093ab3f8580", "value": "24576:Uy7H1HbgaLUJSB3pr5/CZELJITxUybbASWw:j79bgawJMr5/CZELmTxUsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492994, "uuid": "138c9e4a-b0c4-4dac-b3bc-7e48ecffa25c", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492994, "uuid": "62c9f5b2-5a6c-49a9-bb8f-1ccd99d4b0bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492994, "uuid": "bab0cac8-bfbe-428e-8cc1-3f940b52a98f", "value": "b3dfb7ca1683786c4adf4f860666c913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd17a588-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492725, "uuid": "52ff3666-df69-41ca-8de1-ef2a1e0dd7f6", "comment": "Malware payload (Amadey)", "value": "51760248cfc85e82a5bf1869160c25cf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492725, "uuid": "6ad042fe-2524-4b86-bff6-48e890ef5d17", "comment": "Malware payload (Amadey)", "value": "589187184a0e13abd76b31d408d304b061d44a69d3b05923350a4c7e1f7fbf0f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492725, "uuid": "e55458e1-78c4-4c40-afd0-314715813a8b", "comment": "Malware payload (Amadey)", "value": "7562f5a17e10c15cefa47b01f3eff48c67a8fc78", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492725, "uuid": "e8398e64-e554-4670-b97e-8e62a1e0a116", "comment": "Malware payload (Amadey)", "value": "5dc869ebb0a045348fe4637394fd507d58540610420b77aca6ad249dd9ee40ab3f3fbdfb80b17451147477fa6623c4ea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492725, "uuid": "4048aed5-0960-4052-986c-1dc192a47868", "value": "T1D2F42353B6E4C422DCF51B7158FA038307367CA58EB8077A7B5499A31CB3589A4B237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492725, "uuid": "7b313fea-f91e-4519-86ae-b259b2d210c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492725, "uuid": "ca6975e0-4e3b-457e-8701-07da42472c1f", "value": "24576:xy0TiTPDg5JkkDSs94p2sTlyt4IaHBlKQ:k0TOrg5JhDSsyLTlykh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492725, "uuid": "98dd96ee-9058-431b-a823-614fb7930ff4", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492725, "uuid": "df74db07-2ae7-461f-916a-8721e0225747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492725, "uuid": "b4252cb7-2a4b-4f55-935c-ed2d2e7006ce", "value": "51760248cfc85e82a5bf1869160c25cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e0f3c7-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493028, "uuid": "1520686c-cf46-406b-bf0b-4ed1f9ffb384", "comment": "Malware payload (Amadey)", "value": "e2cfb414b78cd412329335d65b436b53", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493028, "uuid": "e67ac492-ccdf-40df-bfc2-4839f1a1ca7e", "comment": "Malware payload (Amadey)", "value": "58ac243b45ef87d1d89e4d35343f83b686883c7f9efb2e8b6507bb858ac4c668", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493028, "uuid": "dc4163b2-496b-4acd-9867-94f9163e2d2f", "comment": "Malware payload (Amadey)", "value": "e96187bcfce679223cc73d503ead5e26fb91e0aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493028, "uuid": "0d8aa30d-550d-4ebb-bff4-5206e4f8660d", "comment": "Malware payload (Amadey)", "value": "c8f089bcdf5b77e841c2790df0136d12802694fb1e955ac3d18206d316371693fcf464e9fc282ca868579e8e28b01f2c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493028, "uuid": "49677bf9-8a81-4941-9d7c-867026d1477f", "value": "T1D04523825AD88563D9F82F301AF626F30D343E917A3943236697D86E0D72AD85772337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493028, "uuid": "7ecfc7d9-bf0c-4012-b5b1-188f5326b84f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493028, "uuid": "13ee6bf3-9125-469a-9813-cfe6b3f9c7c0", "value": "24576:GyH57Px8ZDlrus033aK7SLEp/EVBzb6QGA7z9qxR4m9Bh65/E4ybos:VZ7PUw3KK7SLPzfGyJqsYBthb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493028, "uuid": "39962b58-fd1b-4cea-a8f5-ae70d3c051e4", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493028, "uuid": "fbb9b1a8-d55e-466f-ac12-8dd90e3ba92f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493028, "uuid": "0863ad33-f572-410e-9a68-cdc7b139826c", "value": "e2cfb414b78cd412329335d65b436b53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab21db26-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491782, "uuid": "ffdb5dea-2fd4-49f1-975c-2c70d24e38e1", "comment": "Malware payload (RedLineStealer)", "value": "31949d27882d35e52730f6dc140ba2ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491782, "uuid": "3d9b617f-0b29-471b-bd0d-88b755da69e1", "comment": "Malware payload (RedLineStealer)", "value": "58b2cc703aaee9fcaa836ccf4ea5dc3de2ca86b3f2f28d1d38d087ed3ec25895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491782, "uuid": "731427dc-2288-4668-8f06-cbcfb019e392", "comment": "Malware payload (RedLineStealer)", "value": "ec519b2019c5df9de898c8772446dab0bc3b0bfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491782, "uuid": "624fa9f3-da6f-42f4-9cec-bdf5e7bb43bb", "comment": "Malware payload (RedLineStealer)", "value": "ad6995727254b58640389adfc489342c9720eb2442c58b602d11d6da21e1b86c63555da35dd39ce07d55e25b018fcc8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491782, "uuid": "38569065-6256-4f63-a5c7-ba6749d00249", "value": "T12FF41247B6E840B2CDB627706CFB06930F36BC9559B8831B254AA84B4CB35E5763137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491782, "uuid": "f7d5fb4d-c12e-49ce-b0d6-aa6bfb805aa7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491782, "uuid": "95cb1bcf-0563-4d9a-87de-e2c61de29630", "value": "12288:JMriy908wFVF/TBdAGEw+G83ID/dbjhZt+StfdP6YHnhxeFvUle9DU0UIY:HygPAfGddPhJvPpxIvUkA0UIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491782, "uuid": "c260475a-dfbc-487e-b68b-ba776626b803", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491782, "uuid": "97b6710f-6847-41bd-b463-35bb8e709c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491782, "uuid": "de496c92-47cb-4b13-aea2-4b6bad2e9346", "value": "31949d27882d35e52730f6dc140ba2ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2485854-23f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526208, "uuid": "6c74abe2-63a8-4436-b512-746c5da9562e", "comment": "Malware payload (Mirai)", "value": "beebc0253b908f3d986f155b76789c2e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526208, "uuid": "09ba6887-ef94-44b8-b050-63cd0a641db6", "comment": "Malware payload (Mirai)", "value": "5954cde9589a9d9bb55ad94985d42770d22bc583aa0ab964a9568b941916a20c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526208, "uuid": "ab30bdcd-fe6f-4ce3-ae2f-ccba05cbb8e5", "comment": "Malware payload (Mirai)", "value": "f4994d70a303c16199b82c39df32e3a6a52cc2a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526208, "uuid": "6d1aae56-e275-4404-97d7-ce991ed1353c", "comment": "Malware payload (Mirai)", "value": "dd9d91036885d5f74ccd2765fd7f11ac64dda6099cb5dae33d31095a2d0be2c670a19c13d3265582e3ce0e2272d9824e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526208, "uuid": "8e9743c4-56d3-4ec8-b49a-49a6a68895fe", "value": "T1DCC2D07093EE2CB5C6500571E7F866C5BA434F7DFAFE389011404BAB3941D4629DA9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526208, "uuid": "27192ad5-3cfd-4012-a155-2709aeecfc2d", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEGP3khymdGUop5h5:AWsoTAZ3alkXLvFh8nNEGPUs3UozP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526208, "uuid": "0cd674e2-d18c-45fb-beec-b448da463581", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526208, "uuid": "b2d36dba-94ba-478c-9843-b086f630538d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526208, "uuid": "b28f66c6-4cd7-419d-9d87-3cbf438cfd63", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229fdfec-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492412, "uuid": "c6e97f7e-2586-4b27-9686-7d6dc4083306", "comment": "Malware payload (RedLineStealer)", "value": "7744901dc80e2afe3afa4c7b5c399d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492412, "uuid": "12260f9c-e0ea-4002-9958-b002a85aad95", "comment": "Malware payload (RedLineStealer)", "value": "59a57474ebe62f572bb724c334e3f51070b9605bdb8a26ca62aa328af1683a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492412, "uuid": "8b8d61b0-f79e-4dc7-a333-e2d1af72da3c", "comment": "Malware payload (RedLineStealer)", "value": "78f4dbbd8afb9973e7927e8d11602eda9f1d7cd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492412, "uuid": "b00cf772-3b57-4f55-ac07-ad86b2d21a12", "comment": "Malware payload (RedLineStealer)", "value": "e43b7c0c8dec902593c5cd50b151b53b80c6e801e67892949fe85c4f4166e95903226a0b7f35a341fd72e727e99dea40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492412, "uuid": "50600aa8-4ee8-4392-be8f-1a49f0b55b41", "value": "T19D15224AF6E46063E8E50B3019F713D70E383DA25DB8461B37D5692D0CB3AD4A87276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492412, "uuid": "50c26eff-ac5a-4601-852d-178f0d4d7b93", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492412, "uuid": "90cd683c-3451-446a-a839-ef23374e04a6", "value": "24576:OyIUn4LTjk0iz8Bw5jfsEyAHVTUk19I/faYKbrVa5Y:dIHbPE84fxy6HIFKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492412, "uuid": "b22e9baf-3f3d-469b-b03d-b4ebd1b03de4", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492412, "uuid": "27e575c0-d0ca-4f0a-8498-4ddda5e6501d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492412, "uuid": "acc484a3-d35a-4100-8505-7a3ddf6818f7", "value": "7744901dc80e2afe3afa4c7b5c399d3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8639bdc1-2433-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689551420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689551420, "uuid": "d9d46497-e65d-46f2-a6a2-79b6734362cb", "comment": "Malware payload (Mirai)", "value": "4c45d4567ee651ec1fd7c2d7db0697ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689551420, "uuid": "64045bc7-5339-4d3c-9e94-1728d53f0f35", "comment": "Malware payload (Mirai)", "value": "5a32459a1092c900cabd914775cf0daa7ea0919cb9121a2857c5bbaa962f288d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689551420, "uuid": "88dff53f-7af7-4a0e-af88-5dd737c4453d", "comment": "Malware payload (Mirai)", "value": "a1d9184172bf60e8f1b9d134ff129f36e21eb658", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689551420, "uuid": "d8fd1871-f5dd-4a9f-8014-1c6dffe6c2ea", "comment": "Malware payload (Mirai)", "value": "d09bdf94a0c5a4c88ac95fe26592351cd9b428292e33d8b6f2996ebfa509135863534f5a674c52085aa7559166eaa9f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689551420, "uuid": "7f6e13ce-1e50-4c4d-96ab-51852507fa81", "value": "T18DF2F13352612CA3C0B2063EC77A86C365763B69555E333FA964028CFFC946E32B2709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689551420, "uuid": "3bbab56e-b9d6-413c-9d04-5c2a85403404", "value": "768:QgNZmyBgKP94wQCmlo/xnAiUgBvHXtkbs3Uoz+:QgNZZOKP9P2K9pBvH7z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689551420, "uuid": "7d3f0d08-c37f-4164-9364-403a10a71e99", "value": 34748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689551420, "uuid": "65a3c273-d2d6-485e-86e2-1484e82bb4b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689551420, "uuid": "e6dfae27-b46a-4ce8-94f0-e50a58a3e0c7", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc0da38-23fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526948, "uuid": "0c302368-fa7d-4ea7-b5a7-62777caf29af", "comment": "Malware payload (Mirai)", "value": "6ab4791e78f8d90d2978a69b0a90ddfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526948, "uuid": "822e62ae-d36b-4e7d-a040-2a52f5efbff9", "comment": "Malware payload (Mirai)", "value": "5b2596b94f8475582ace1fcc719f15ab68428a4687e442e65885089f7c24d5d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526948, "uuid": "edaf240c-9930-4e2a-8524-cc0e598152a4", "comment": "Malware payload (Mirai)", "value": "d2edf51b60d6ff0b708943bddaecafadcbebdc79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526948, "uuid": "084581fc-3cd8-4c6f-b5d5-e7ec3a9b5385", "comment": "Malware payload (Mirai)", "value": "919b674a3e0e5adc4ea17aa983a79da0e398203c35b644c98d0a5b35df6ed4b90aef53c691fe001a13b8f246c693df7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526948, "uuid": "b6483c29-503b-40a2-94d3-565dd9678593", "value": "T138D2D01CE1643D4ACB6D3C3452CD06B5AD9AB182731E9F4BA37720C1B67A987F84D0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526948, "uuid": "d620b116-27f8-49c2-8542-601a1cf1793a", "value": "768:D1uUtLrVDsAp6tLDgJAZ8G1x23fvydzS6W6j/dYb1AECJbKWUD:DbDs06tPg5G1K6dzSTA/0AEC+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526948, "uuid": "77a07878-b24e-42a9-a2be-daf45ce38510", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526948, "uuid": "f7113e85-228b-4148-951b-ff6a8a6ab3df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526948, "uuid": "90076a2d-40a2-4200-a8d0-167505f0ff9a", "value": "6ab4791e78f8d90d2978a69b0a90ddfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb63f970-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491461, "uuid": "3d0c56b6-386e-46ab-a26d-c0ab66f8cad7", "comment": "Malware payload (RedLineStealer)", "value": "0f9ad58e78b90812b3028a87b6d0f884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491461, "uuid": "69fc2898-aa17-40ff-9c34-1d69a3c4ca9c", "comment": "Malware payload (RedLineStealer)", "value": "5b57b7361c9d785c0273941211ae1aeb32ba7b771989ef9fc54e28707d9c73d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491461, "uuid": "ee7b27a9-f6e4-43b0-a905-a88bce3535bf", "comment": "Malware payload (RedLineStealer)", "value": "fadac61b54947f98c0af5fbaaf19374bc9f14a89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491461, "uuid": "391ea333-a2bb-4926-948f-5bb9d1ee8d86", "comment": "Malware payload (RedLineStealer)", "value": "b5735bc8d29b7c430fb3844d8462c180e05e40f3a5c8be2d735f5746365bfe2d43a435b852b0ac29f448ef0ab49f1944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491461, "uuid": "c7cba232-1b7f-44c7-a87c-d3818f6b2555", "value": "T111F41246EBE90472ED752B325CF602930B39BCD11DB4836B7389A84A1C73A94B53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491461, "uuid": "6c0dcd09-8caf-4bcd-a8b9-4e4256134656", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491461, "uuid": "56454d27-71d0-42d9-9316-ca0fec94fd4a", "value": "12288:AMrwy90gn1aiPVss886HgG4Fmc3uSTmg6JaRRbehcd0gkT+gu2hmTGFvrok+mJF:gyTU4f41SuSTmpQucd0gSoTG9hF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491461, "uuid": "079f280a-4450-4a5b-aff0-0837b8332b7a", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491461, "uuid": "577a5104-2084-4188-97ca-e88e11087e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491461, "uuid": "4fdba1d7-1ba6-4562-a741-2e803366724d", "value": "0f9ad58e78b90812b3028a87b6d0f884.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af85d8c2-240f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1689536028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689536028, "uuid": "199404a7-c084-445b-b36e-1bc4ad80a3ac", "comment": "Malware payload (LummaStealer)", "value": "b0517305850d5be8e02a648bb90a3c6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689536028, "uuid": "dbae3c79-b313-4b9c-a232-136b75a08289", "comment": "Malware payload (LummaStealer)", "value": "5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689536028, "uuid": "eed4f227-b0cb-4299-ad50-e922dd51b82e", "comment": "Malware payload (LummaStealer)", "value": "24e75c0ea6b07fd3c4e03c6661ed911632f3e784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689536028, "uuid": "c5e7b298-3de8-4e43-a413-76124b0f93ec", "comment": "Malware payload (LummaStealer)", "value": "2e2629eea1c103ae6176f9bd426bbc0cb5228e4c10e03cfbae987f716c2995f9862c01430bf9c1c6c9b4185b68ae0f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689536028, "uuid": "ffb2c92e-cfe3-43f1-99e5-ae174062b658", "value": "T15FF49C1975C1CA71C6461832C4D7D6390BF6B762A733CB8AFF57059B0E133A1AA4A3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689536028, "uuid": "de6e19c5-b9a4-42d7-838e-3e8a1599f24a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689536028, "uuid": "0c6c8458-8466-4a90-b8f6-95aff58a3f64", "value": "12288:IsjWYqfNTYmessZerchdW7lRA3aDloJZsjudEDT26qh+kB:IsjWYGYnZQchI83mlamGv6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689536028, "uuid": "fb8030ab-8e26-497b-a6d3-14843a16f101", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689536028, "uuid": "044a82f3-f8a6-4ea9-bb86-f63039d4865f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689536028, "uuid": "da55bcab-1fb0-4453-b70b-1863f533a02e", "value": "C4A17DBA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6665dc97-23d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689508847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508847, "uuid": "69e261e8-addf-4098-9c77-be79b193fcb8", "comment": "Malware payload (RedLineStealer)", "value": "1ceda07c0fe11c0fe4d81463b4283f7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508847, "uuid": "dd4f1f6c-63ad-456b-8397-cb4fe3bd1c86", "comment": "Malware payload (RedLineStealer)", "value": "5ce5071790c2e83ffc59fc291021f55f1e200bfd63033f17ed80320940f9b1a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508847, "uuid": "93583ca5-1fb2-4cc5-b4aa-09d14814bac0", "comment": "Malware payload (RedLineStealer)", "value": "066a9fdcca558eb7d6eada1cab0c674a71e7a57a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508847, "uuid": "c3120745-5526-403b-a1cd-1ceb33841372", "comment": "Malware payload (RedLineStealer)", "value": "a088fd84319d15b665e9d60e969cd97d30b385730e07fd6d75fb0a75fd7da40611455e17d3f94cc8f5eb34dcd03ae4fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508847, "uuid": "0442b755-5581-41eb-80a3-3b9b6ef7150f", "value": "T15F94F84383A17D88EB258B769F1FC6F8B71DF6508E4D7B663218EE1B04B1076D263A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508847, "uuid": "3aec0ab2-9520-4a9d-9743-695b2db4a8bd", "value": "f3a1a6c560f808b7f46a078e7eba3d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508847, "uuid": "8b00a042-f245-42d2-9d42-860e3169349e", "value": "6144:FLInPc0EragRHNOfNUNAizlQXRX3MpERFGtT:FknUfrHtOfNU1KX1Mp2FO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689508847, "uuid": "ffc482b6-2724-4e43-846b-915c4fd6296a", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689508847, "uuid": "37c7d0e8-7afd-45cb-978e-4958d4891013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508847, "uuid": "e67eaca1-5a26-4570-8ec8-7db2482b4c1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7681b3-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529899, "uuid": "e6a93619-7a24-4dfa-92d2-66f6888ac76d", "comment": "Malware payload (Mirai)", "value": "763d409c9799b99718c96bd861ca2743", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529899, "uuid": "e9c3fd9f-d970-41e6-a928-7a1ef2d2ad76", "comment": "Malware payload (Mirai)", "value": "5d8a3fc81277790c8ab9690fd9367692fc252104ba6afb13d47d871e2e472e2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529899, "uuid": "1f9a4040-115d-4727-8131-1146feb0127e", "comment": "Malware payload (Mirai)", "value": "ad21dfef071ed443351ba7e88cc8a7113c147742", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529899, "uuid": "19a6c172-1045-4b33-ac38-04b3f33fcd08", "comment": "Malware payload (Mirai)", "value": "7747dba67a75d3ddda1bd3bd788cf16e80009c5e655a965435e9b0ae90679362ecda11518cb9e09480db9bcc9ea79b26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529899, "uuid": "9fa7ba10-9f6f-4cec-bc89-6550d03fb73e", "value": "T185F2C481B8929967C1D853B7AB5F468D336237ECC2CF7723C9284B2226D991E4D63F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529899, "uuid": "95c60f2e-9901-4a96-a764-3d2799c38b4c", "value": "768:X1RBO+MgIm9diRA/gUP2skG5wdTov71v8juWvH6NWcq:FILK+A/xP2zG5wykyxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529899, "uuid": "f3027951-cc8f-44af-899e-5c5345fefd6c", "value": 36096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529899, "uuid": "6d09de36-68a9-45e0-a2b0-ae044ed7dd9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529899, "uuid": "b094470b-6d64-4f35-b3e8-9a79a83445ec", "value": "763d409c9799b99718c96bd861ca2743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cb23aa-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492092, "uuid": "f5cd5f9e-d47c-433f-b1e9-5e7a669c6ece", "comment": "Malware payload (Amadey)", "value": "4b5ac01b9c3209fb0bcddbad0986bb4a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492092, "uuid": "3e8c9fd8-fd23-43ad-90ab-df9209798e59", "comment": "Malware payload (Amadey)", "value": "5de64d5ab56bad52329947e26f8110fed2348f921e93665a3999fc44153d6ef8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492092, "uuid": "f6bcfd70-eeb3-4bfd-9c24-bc2844341921", "comment": "Malware payload (Amadey)", "value": "65f2ae841ced39a952231d5c948a03656722e518", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492092, "uuid": "6ed7db1a-899d-43b9-afda-ef24e0a2984e", "comment": "Malware payload (Amadey)", "value": "fd03624ac84fc2b0a9f70bd28bb8d24c42559607119792a712db89070a4c637550d52610f6fe5d2da0edc9946a5d5252", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492092, "uuid": "e91a564f-cabb-4571-aabc-e24b38dc75ad", "value": "T1E2452356F7EC94B3CCB51B30D8F547934A32BDB26E78C2AA57485E1E0CA13482935B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492092, "uuid": "b344287b-da0f-476f-bdd3-12878c601d09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492092, "uuid": "dc391bd1-0fc6-4a93-9ef1-fc7954c5645b", "value": "24576:kyYAb9wJ23e65odkfOhx+JdiKF6aLxOvTv/K1xBha1/jSZ6ZLBv:zX9wZMrlam7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492092, "uuid": "45be6893-8665-405e-a0ca-e775bb302a9c", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492092, "uuid": "757a4753-4baa-436e-a2f2-da767cdc9a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492092, "uuid": "51fc294c-d3e9-42f7-b7fa-096b1ca3eeef", "value": "4b5ac01b9c3209fb0bcddbad0986bb4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961fef1b-2406-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689532120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532120, "uuid": "e8042949-ea5f-4111-a3cf-9d53c3be6863", "comment": "Malware payload", "value": "8e0c45dde34b22df6e4055a31f06788d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532120, "uuid": "2b3e57a3-b545-4725-89c4-ffe9580b7a6d", "comment": "Malware payload", "value": "5e84524b05e2456c28a3530cb8e0d7f2b811a2d7074acbbac6950bfff97f8a13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532120, "uuid": "02b20267-a9be-49bf-b978-76e6bfbe2969", "comment": "Malware payload", "value": "02291e6dfb01f6a542c56026a9b50ff44a2dce48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532120, "uuid": "d4878e04-c86b-4009-ae79-f30fbb3543c5", "comment": "Malware payload", "value": "9d69d7a2ffec4bd43f4604be9db1a093dc394b983060368a00bf3f60015911ced93be388f0b9bad0eb5649ec7c978269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532120, "uuid": "033780b6-b08a-48e4-8289-4506fcb4c357", "value": "T12FE533E972D00C1EC85EEB72099C858D166742067D42CA750EA87DB44DD37EBB29ECE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532120, "uuid": "39d64d51-5e24-4e83-9f9a-7908bd7bbabe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532120, "uuid": "c1177f4c-04d5-4553-86c9-ca0b9cbe91de", "value": "98304:4vJ8ad0y5vx+q5O7gowuF+TCpZEeg1GbWumM:zKH5vx+qGPcCpZEXSWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532120, "uuid": "fa62a18f-445e-4c48-afec-7ff02d43fcd9", "value": 3210752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532120, "uuid": "4725c5f3-00c0-4cdb-8b0a-921c26061c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532120, "uuid": "de990af5-0307-4911-ac23-919125754ea5", "value": "SecuriteInfo.com.Trojan.GenericKD.67807853.17613.10369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6759aa6b-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492098, "uuid": "a444c75b-ec64-41f9-8d26-ac3bbb932b4d", "comment": "Malware payload (RedLineStealer)", "value": "3798d7397297e366a26153993de02af0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492098, "uuid": "001e4c87-aada-4675-9577-6dc213bf85a3", "comment": "Malware payload (RedLineStealer)", "value": "5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492098, "uuid": "0c2db015-4577-40dc-a924-318a1466b917", "comment": "Malware payload (RedLineStealer)", "value": "ddedf24c83ae1c4a0e7baf2cdfe59463a10b56da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492098, "uuid": "8a4f3794-af78-4854-b7aa-14be72eec00a", "comment": "Malware payload (RedLineStealer)", "value": "6eb5ba9abf8c750c99ed10673f48ef4133f64ff1d455089ef8043e8d78303913830bf03f753df0ff428bc3f91ea6070b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492098, "uuid": "05c422a7-235e-442e-88f8-da524f1f548f", "value": "T131152303B7C84132EEF527740CF323932A357E169C34829B26A29D994DF3650A5767BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492098, "uuid": "fa1d4cad-818b-47ef-8cc0-f05a818dca34", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492098, "uuid": "9712fae3-8d1e-4469-b624-a6605bb7d132", "value": "24576:Jy8rhw3n0b6BVnDlL2dEl/W0gJUku6tREpqM:886kb6HD12dEFWtJUb6tREpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492098, "uuid": "0d7cbf63-f383-47c6-8f56-9c50e4158758", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492098, "uuid": "8f72df4b-3788-42f0-b3f8-384eb8b8212e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492098, "uuid": "10f74744-2c99-4be5-a900-78f116e0f949", "value": "3798d7397297e366a26153993de02af0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6406cd-23cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689508538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508538, "uuid": "3deb913e-08d6-474c-a5e8-b6674716ecfb", "comment": "Malware payload (RedLineStealer)", "value": "5d0d4b05c7a5eb4af371a9ef9bb01033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508538, "uuid": "ff7f8e14-16b3-466c-ae12-326d219f5242", "comment": "Malware payload (RedLineStealer)", "value": "5f058f99fd09462d646ed044f726c18799839e617bd61ab1dc107e2e5b74bf3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508538, "uuid": "4ea2f529-897d-4a64-b83f-30a56c9ccf26", "comment": "Malware payload (RedLineStealer)", "value": "4aab4c6d50f57027348087bf6b23b5e26c0d5a45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689508538, "uuid": "136a7e31-2b3e-4471-8482-00859a0e406e", "comment": "Malware payload (RedLineStealer)", "value": "314407b30bcbd97945c9a111c6504ab50326d964b1142f8858f6da05bcafce6619594ef71be558473c0f40d28a157285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508538, "uuid": "301ac7a7-361f-4afa-8ec2-d3aa1e800a03", "value": "T1C5B40203BBE88476E9B52B7059FA02D30B75BDA24978835B2355D84E0C73BC4A93573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508538, "uuid": "5a90fb5b-10b5-4a82-8c39-5a0d15a937e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508538, "uuid": "e45f2e9a-2bc8-41c6-ab92-df108d6d0792", "value": "12288:fMrHy90weiJZMBMHrR4PEZqjso3xc+42ZDrhbb2Sd:UypeiZF/qjsyxcV2hrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689508538, "uuid": "4c9b3e08-210d-46b1-897c-8fd435fcad0a", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689508538, "uuid": "c49ef756-4b33-4419-9309-e6b3f3d9937e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689508538, "uuid": "61ccb747-1094-4280-a79f-f3caaa46b103", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e87d404-239c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689486607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486607, "uuid": "7a6fadd8-f772-467a-a14d-cbeeb054c9a5", "comment": "Malware payload (Mirai)", "value": "0bdaac520dc9896138ddd4fdc2438e18", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486607, "uuid": "9e996d00-ad0e-4040-b12d-3a0cfa9c0311", "comment": "Malware payload (Mirai)", "value": "5f2da4c4bf6597adfcaa1278b5b2ea008fab5a10c56f8ce4a056c200b04d4c51", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486607, "uuid": "ac1e7621-e41f-4714-a226-68f2dd030497", "comment": "Malware payload (Mirai)", "value": "e1a1bc68bf841fe53a769a66109220f92b770bcc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486607, "uuid": "221b2c01-9aef-41d6-9c1a-0b884c281950", "comment": "Malware payload (Mirai)", "value": "c8a1f7b2905e04d8334d30e47955331f29d5939b0984c513791cca22a04c14569e6210f95627834cd40b290d743c1f87", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689486607, "uuid": "240b04c9-81c5-4fef-ab42-93aa3c98d0b7", "value": "T1B4C2D03056AE1CB1C6600632F7B866C9BE530F7DFAEE3890114156FB3A419052EFA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689486607, "uuid": "5d29f16e-55d1-48f8-9bc3-2edf9007a553", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEl8ljhymdGUop5hN:ERsoTAZ3alkXLvFh8nNE+ljs3Uozj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689486607, "uuid": "142a9fd3-2d8c-4500-b03f-20749ff2efcc", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689486607, "uuid": "065cdebc-d6cd-4fc5-855e-b7eaf870331c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689486607, "uuid": "da91a2e7-7b28-43d3-92b7-3f19aed4a435", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31a8c00-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491796, "uuid": "d4ab5430-5ce1-408f-9f8a-cf75db7498e8", "comment": "Malware payload (RedLineStealer)", "value": "35d65edcad0eb94203a77b37f369a214", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491796, "uuid": "b44f39d6-33d5-44cb-a102-3641697707ae", "comment": "Malware payload (RedLineStealer)", "value": "604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491796, "uuid": "fd9edbe1-0345-4be8-89c2-756c242ea019", "comment": "Malware payload (RedLineStealer)", "value": "a9a64846ed8c44b0969da1b8c912181b971c9cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491796, "uuid": "bb2bc4ff-ec89-4020-b1c7-1a7d5fade88b", "comment": "Malware payload (RedLineStealer)", "value": "1cf2b76725519db6b83e7972e95a11c48b582fa6809f12a58f2a77595cde976b6487c74e747e1f9b134c0e9a737e8f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491796, "uuid": "aa8d1be2-30f5-4459-8729-d1c0127389a7", "value": "T1A3152303EBE48132E9660B7099F653930B35BCB19E7C136B6758B99E1DB35D09C30729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491796, "uuid": "f9e085e9-a940-4812-b367-7ac6c83c1980", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491796, "uuid": "6cce6355-ef56-4640-a8fa-3aa73d516b33", "value": "24576:iy3YGYGYjHIA33LkLpteVbKpX4SVkrh3:J3dYGYrI7p+G5Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491796, "uuid": "a94e682a-d36e-4a5c-a75e-c7a7b1f21b49", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491796, "uuid": "1bdc9521-6ea1-44a5-a69b-d7bef331c988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491796, "uuid": "308ae38c-707e-4b07-a379-19ec51e456c9", "value": "35d65edcad0eb94203a77b37f369a214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d707fab-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529877, "uuid": "ef7a3fa9-efcf-4e76-bf4d-91af5de351c1", "comment": "Malware payload (Mirai)", "value": "ff581c5d5193f4ca73e9e212c26d6d76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529877, "uuid": "0008f4fb-3d0f-49c2-b7d1-9952f0863b67", "comment": "Malware payload (Mirai)", "value": "607c484991c182f3fe3f943258f313d0f7f5755d66b1e4521f49029dee2caf9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529877, "uuid": "23ed6cf9-53c9-41a2-a525-bc026a1e1070", "comment": "Malware payload (Mirai)", "value": "0f652a5cc355dc2da4e19902ca6dc55c792407e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529877, "uuid": "1a643404-865e-4f4c-9bd6-a2458fc8c677", "comment": "Malware payload (Mirai)", "value": "a3105605ae39fc9f9182a20a37a4861d6eb58eebe0f5564c5103c5198e4d71d5329180517f12f22af24dd17d3928c1c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529877, "uuid": "4ec5d9e0-c766-4f8e-ba2e-9275ab01077d", "value": "T174B2D1A4D7916706C2B0B435937CCF926B3B15A4D6F238271B1092ECD6914A733EC9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529877, "uuid": "b7df6fc5-be37-4de8-9613-893b93435813", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+B2zqhymdGUop5hu71:4GHKQFH0rs3zWoDDRsjt7LB9U+B2ms3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529877, "uuid": "bd050853-a6df-4116-975b-da661dbacfa0", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529877, "uuid": "71d4c85b-3407-47a6-b4d1-8661ca21eaa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529877, "uuid": "0e9d0ce5-ff8c-417f-b7e4-7c29dd1288a9", "value": "ff581c5d5193f4ca73e9e212c26d6d76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c276111c-23b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689497834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689497834, "uuid": "ed87d21a-f0b5-4983-813b-cd50d82bdd53", "comment": "Malware payload (Amadey)", "value": "63a231c4bcfc21dd28e9460a7f92f1f8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689497834, "uuid": "61faa45d-23d9-4b2b-be75-e102b1d22b67", "comment": "Malware payload (Amadey)", "value": "609e28d10b5e58955748e02bf022f5bd21ee8872bc9cd197d25624c55c4ecbc4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689497834, "uuid": "5c2bce2e-fcb9-4aad-8934-91890ef6c132", "comment": "Malware payload (Amadey)", "value": "e1d795b79b89676a88fb2eff49ac7f6493fe5559", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689497834, "uuid": "b7c750ef-afd0-471f-8615-45b064a4abeb", "comment": "Malware payload (Amadey)", "value": "2bf6c4add198ab68cb813a4a3648d812bc3c2e5e37efe5073978b60e69bf5d013a53fac571ed840b97dfb1cb544023f4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689497834, "uuid": "1b828aca-7777-469f-8497-197e513a8247", "value": "T1F4152316EBEE1473E879137428F616A70E7A7CA09D3853535B14289A0C73BC4A47673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689497834, "uuid": "e6f55ab1-84db-4093-aeb3-fe4f3d801b00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689497834, "uuid": "ff93c719-40c8-4b4f-b8c6-e41357351072", "value": "24576:tyTEgi/RF7/mbsGg3JSViipQr3lGhtRDujxGs:IT0rSuJaixr1G0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689497834, "uuid": "8e9c5d2c-72ef-489a-ad97-c90996929d31", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689497834, "uuid": "b537137c-a1ab-43b9-9075-a8a8579f9c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689497834, "uuid": "9ed2423e-5404-40f2-a91b-0edd079a2f8d", "value": "609e28d10b5e58955748e02bf022f5bd21ee8872bc9cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d5bbf1-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491792, "uuid": "05c65fe8-f39b-4844-a411-a89ea48003c3", "comment": "Malware payload (Amadey)", "value": "4266390a3e460f4dbe90ce7d9d091d2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491792, "uuid": "b6f4e998-18ac-42d2-9e2f-616b3ebcad58", "comment": "Malware payload (Amadey)", "value": "627c0990f7c6fa8cc9a276966f3e2b428f8323bdd73c68bdf8034799f948f0d9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491792, "uuid": "438d7763-23f1-4334-8dbb-0bc396fe6e99", "comment": "Malware payload (Amadey)", "value": "16bf185400157eaae1561b62196add6bca53b84a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491792, "uuid": "9cf6ff9e-9655-4622-85a7-a36813eff50e", "comment": "Malware payload (Amadey)", "value": "6fbbd2d651933715f0b2f39b1be3dee3959dbfcece7b7bbd621abc5516d51ab8aa8fec71e88d45d4f1571b375d5a3a24", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491792, "uuid": "00db4f90-0123-48ee-9886-6116b20e79fb", "value": "T1C3152213E7E848B3E4B517B054FE02930B397C925A74876B3785AA270CB3A84953177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491792, "uuid": "d1fd79e0-4fa8-466e-98e3-6ca1c236f632", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491792, "uuid": "1f803205-b632-489e-9068-78c745675e85", "value": "12288:EMrBy90qgmVH2qW5mA+49iYIvuPRQ3ijJbcrmVVhlheKO83eRs850M2ztvv:ty7gmx2qW5mSVPRQAJlzD/GIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491792, "uuid": "660034a2-88e2-4a1d-9a71-063213e8ead1", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491792, "uuid": "1d65f1a4-c8d9-4e42-a96a-2904a04a4220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491792, "uuid": "9cea7772-03f9-4b62-8787-ca9b32a9d241", "value": "4266390a3e460f4dbe90ce7d9d091d2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1182b758-23db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689513429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513429, "uuid": "580746b0-08a0-46e5-978f-1a8094e84e47", "comment": "Malware payload (RedLineStealer)", "value": "7b8e77e38f77f32d58afc9de7c9b7f24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513429, "uuid": "baa334fe-11d2-47f7-ae81-2ca9dd5fc5da", "comment": "Malware payload (RedLineStealer)", "value": "62cad440b4a8907459d7068bb1479ae7d5a969fc6c6ed206bf7dfcf4fb796764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513429, "uuid": "de8357ae-566e-4626-a149-5f0585b58b90", "comment": "Malware payload (RedLineStealer)", "value": "32cf78465842b1e7f80bb1275e0e7f1eda25756f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513429, "uuid": "9e2dda1d-e8b1-438f-8506-4e7b93f1076d", "comment": "Malware payload (RedLineStealer)", "value": "042933e6b433eeb52f1b657e9371ba3f3cd9ec4038da697e7bbadaf5528fb2c93364bc0cd98c1f1d8083f874e51dd9b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513429, "uuid": "184d76b5-6e3c-4465-9152-f1863702b7a0", "value": "T139B4AFC5B6E214C9C093A93B3B7FD421D17BB62ABF0D7073E059032936287946A3579B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513429, "uuid": "2e7dff71-b901-453c-8e0a-b6ed4e6fc83d", "value": "5826e2bea2981d413e896f41d08c994e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513429, "uuid": "4285a12c-f8f2-42c6-b9d0-2a25ce9faf95", "value": "12288:EmlLFjTX9wGT6r0K4MfwGxfDutgrq8YM+oh:E6jz9wWDK4MYKrlf+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689513429, "uuid": "71b411a1-2541-4ad6-bba1-ab8756e79486", "value": 505345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689513429, "uuid": "7d76010b-1ce3-4bab-97d9-e5e5844bde24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513429, "uuid": "c30bb430-9641-4f57-bafc-10d76d8a2800", "value": "7b8e77e38f77f32d58afc9de7c9b7f24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e86b0a-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529812, "uuid": "561d351d-e248-474b-8bce-6159a940cf3e", "comment": "Malware payload (Mirai)", "value": "075e515e34f0ba79c48625fc2cc433b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529812, "uuid": "34a6bae7-567f-40a5-8dd3-8996ef6d0bae", "comment": "Malware payload (Mirai)", "value": "632aa516839c1385518d21465bbf9dd009f44b9d223e2497050947beb2e34ee1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529812, "uuid": "acdb7b65-b859-4488-bb58-59d1d4b026c3", "comment": "Malware payload (Mirai)", "value": "950abbcc8130b8d20080da65c6cb3b38a8d49baa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529812, "uuid": "495eaad4-710e-453e-9851-fe61095c9cbe", "comment": "Malware payload (Mirai)", "value": "eb3236ff6cbdaf8fdd2a25250ed5ca09992796760016f05408c9231d8b3d78fdfbebca3fac53a277a48cb162925d145e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529812, "uuid": "201caa11-c204-4419-b934-f8d78dedead7", "value": "T1B8141946AA408B13C0D62BB9FA9F425533239B64D7E773059928BFB43F8679E4F23501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529812, "uuid": "54e65aa0-3350-4bc2-92e7-5634ba7bc6f0", "value": "6144:TJUxOaz1d3qGnAvaGNWK6jP50qipfoAnWZXM/RWwesmP2bDoZ:TJtaj6GnAvaWWK6jP5ZIgVZc/4HsmPgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529812, "uuid": "5582ab70-36a4-406a-8943-eb9a6c9dd65e", "value": 207311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529812, "uuid": "2650dcb0-e736-4313-bcc7-afc5d837683c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529812, "uuid": "a1690206-e228-45f6-8e05-65aefc42a4bf", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b15d31-237b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689472211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472211, "uuid": "60432245-0228-49ef-b0dd-6402e20d6893", "comment": "Malware payload", "value": "045df35c0cc6f49db0c6f77cd7d3096e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472211, "uuid": "520926b2-7f27-4cae-b4d6-38dc9ea864cc", "comment": "Malware payload", "value": "6331e1c5393ef11ff4e056edd90f98417a1f169d3b7f2efa9e1f27e2acbe17fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472211, "uuid": "a7f34ac7-ae38-4762-bd26-3abbfcbd9a18", "comment": "Malware payload", "value": "77d688f6430eb0e4fcc0b526519e0e42e85ce34e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472211, "uuid": "64ad132c-8d72-4c66-a4c8-ef31a1e5a092", "comment": "Malware payload", "value": "4e840c3d98a815b4457490a255e2c1a28be2a131ba0317971d1a59830c594e263a7a6e7e8db4ed7a50c4590b630eea86", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472211, "uuid": "0b30ebbc-a5d6-4bfe-b84f-008251b13f71", "value": "T17443F111D70A7FA6FB7BA075B4364492336E0BD5F2AF63C0D73E0B3255D840B21AA592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472211, "uuid": "c44c7fa5-44b7-463e-883f-89e62a101b86", "value": "1536:Bin4/vjvlGhKHhbLf1WN8WyI459vZErRJVg:m4zloKBeNyI4jvy9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689472211, "uuid": "9a4f0789-e041-4e3d-b3ef-ace98c139443", "value": 58712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689472211, "uuid": "cb677406-37a3-4fcd-9b85-941faaa3978c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472211, "uuid": "3d09ab5a-6f17-45be-9f2a-66931c529610", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30172aa-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491769, "uuid": "7977a07c-f7d8-45a7-838d-27935cde280c", "comment": "Malware payload (RedLineStealer)", "value": "23035d801b41b05a6f6df0913478eb81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491769, "uuid": "5182bfd3-6412-4734-a639-093f70fa673b", "comment": "Malware payload (RedLineStealer)", "value": "6407653fb96eb144397cd5292be81f74ffb0eb8949a8d73e1a21ee3c9e85f97c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491769, "uuid": "bd061780-ff6a-4644-94b9-c08c45e63537", "comment": "Malware payload (RedLineStealer)", "value": "c00c74a50b7d973b64d70b10c8793dc0989d8f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491769, "uuid": "ca8f6890-d0fe-4fc5-a9fd-a6c8ebadc2a1", "comment": "Malware payload (RedLineStealer)", "value": "6a100782bfb51d957b52f8f515264d3bf892f46fdc950baf683119a34ee5c5baa37594eff3fcf798cde8b5357687741b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491769, "uuid": "9f226f94-041e-4107-ba30-65671334619b", "value": "T17E15225667E8D033EAB61BB029F906D303767992897A8BA603D4A90E4C737C0F474777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491769, "uuid": "f70aff6f-d205-47cc-9457-b038437f169c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491769, "uuid": "90f63d18-644c-44f2-b940-07e2247aeff6", "value": "24576:Byve36Qov9lp/uRuA+QUdJFGmdbXVaI8Ui:0veKQU9DujUvFNbFNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491769, "uuid": "dca9d56d-f3a0-4da6-9583-befdcddba694", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491769, "uuid": "c76f866f-6828-49d0-9fb9-8f2b6d8cdc76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491769, "uuid": "320e4a07-fa44-4ccb-8efb-1be87f00d0a1", "value": "23035d801b41b05a6f6df0913478eb81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195a5a4a-23db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1689513442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513442, "uuid": "00d6c191-9c7f-49d0-aa86-85d534e9b0c4", "comment": "Malware payload (Stop)", "value": "73e23e1245f37f034a981ed1903950ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513442, "uuid": "3794e8ff-209c-453b-ae41-136860dbbbb5", "comment": "Malware payload (Stop)", "value": "648273738adb42d071ddd5f1d4ca2cd81edb1e4f1f79edbf1a60e35cd7be3806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513442, "uuid": "a4c09b17-b852-4af1-ba0b-3922074e91a8", "comment": "Malware payload (Stop)", "value": "800c9c4ececbb2724a5e09a74d5be4baab12eabc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513442, "uuid": "a5c04716-51be-411b-a804-09972c3a3f5f", "comment": "Malware payload (Stop)", "value": "08b7fb2e3778191030a24b5e16c0a4f2c985a2eba1cd4f955962da1147296c8fea90d5af8971a5dd64cdad7957f8c992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513442, "uuid": "9234a897-ef2b-4f6e-a9ff-704dedbfcf0a", "value": "T1FE059E43C3A17D48EA268B779F1FC6F8770DF6518E4A7B653218DA2B00B1076D2A3B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513442, "uuid": "7c7c7e4c-9373-451f-b5ec-b089405aba8d", "value": "326441378ca815656cabd6c06990bf3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513442, "uuid": "2e44bb90-b8ba-4711-af05-6d9df1a91100", "value": "12288:FE44xAnltpojlu6YnlBHcLGCr+obLQv7jxGDbjHyruN/hv49zGXc53d8F:y6tSjhYnrsQ7jxGDyr2dct8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689513442, "uuid": "0b269660-aa79-4dd5-b7f4-24af24c7552f", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689513442, "uuid": "3cb9cb53-b7a2-4fab-8b6e-e9d0098ae296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513442, "uuid": "5f02a9d2-4019-4bbf-bedd-59a3d8f379bc", "value": "73e23e1245f37f034a981ed1903950ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8519c6-238f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689481151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689481151, "uuid": "91fd0f96-344d-4989-9521-dac2887fcf46", "comment": "Malware payload (RedLineStealer)", "value": "2efde5643e7e01def0c2c0e409dfaa84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689481151, "uuid": "a3ee02b3-40da-484e-bf5d-3d138d35b2b5", "comment": "Malware payload (RedLineStealer)", "value": "657d471a64624cd0e7e6d91374d75212b100bda987ac4425d3552224e2d2a33e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689481151, "uuid": "0ac3ab45-1b84-49e5-92ce-9fd841579fb0", "comment": "Malware payload (RedLineStealer)", "value": "1234251a8b2c49ab465c3c40b462a33e768e7b79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689481151, "uuid": "43069928-b1ef-46ed-83ba-6affa22d0477", "comment": "Malware payload (RedLineStealer)", "value": "17e1820c29b9df4a352c51f9475c9ab0455a9f096953a970849643ccf2435bdb8001e81cab58d3dd920b7daae061df8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689481151, "uuid": "4c67e3a5-8a50-464f-b4fb-f4b83f64390e", "value": "T178947D4392927C59EA254B369E2FC2F8774EF350CE4ABB663218AE1F14F1172D163B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689481151, "uuid": "28e37a4b-9702-4dfa-8004-b4e36db97197", "value": "171ca87c7d79f90a7375ae3063387bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689481151, "uuid": "1ba3b6fb-aaa5-4e8d-824e-cf599c3a9ff6", "value": "6144:RLgCTEz0lWb4j0yDVwXjwER7PzyCNJXBWXBMVDxySxf6y:RMCYzAj0eUt2IXBuyVDxySZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689481151, "uuid": "c4377060-e29d-4ed9-9952-3e861c633aec", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689481151, "uuid": "253cc592-1e50-40e0-857d-ece00ab2b31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689481151, "uuid": "6224b930-d192-4992-874e-020b78a043e6", "value": "2efde5643e7e01def0c2c0e409dfaa84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1839f0ca-23b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689495401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495401, "uuid": "82bcb345-f8b7-480d-9028-a37fbd3c54a4", "comment": "Malware payload", "value": "34e7f7701f39c1a7ae6e86f7c0ae2082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495401, "uuid": "32a48279-3127-468b-bc69-f077965c38b4", "comment": "Malware payload", "value": "667520ff4f0ed9ea39e00203d9da4ae4ad0ac66713e0f3f69d69854f90734b7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495401, "uuid": "b9045403-b55e-418a-a137-8c112139e99b", "comment": "Malware payload", "value": "99065e52adb958f757188631502b1ab2bf543ac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495401, "uuid": "ddf3d112-49c6-4183-a6df-ffadff11bc88", "comment": "Malware payload", "value": "60c2de70c7dee3faa455008dfc8d8989ed250f89efe95145e69eac160d429a1e9eb2d038c856bfb6b3a3bc3b9245e658", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495401, "uuid": "b81042de-5866-44b3-ac43-b2160eadfe4d", "value": "T107E5AF26BB9480E5D1978236C519864BE6F2F8060B3197CF11A44BDF1F732E68E79363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495401, "uuid": "24f9c1e7-650f-48cd-8da3-7ce68b27ab24", "value": "789387070702b493624ef46c83577753", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495401, "uuid": "6d636c92-72b4-43ae-acb8-7c610c1907a1", "value": "49152:VpEAKAbxG148vSK9nNC89sBMxDunU8hqxUq8BFAJeMnmKRo:VlbS48WKxq08BFGeORo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495401, "uuid": "61536da4-0cda-44cb-9bd6-3924efa71123", "value": 3043328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495401, "uuid": "8dbb3a6c-e5a4-4461-831f-9cab51379af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495401, "uuid": "10f8eae6-1268-442b-ba58-5aaf52b4d51f", "value": "667520ff4f0ed9ea39e00203d9da4ae4ad0ac66713e0f3f69d69854f90734b7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189e1fc1-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492395, "uuid": "8e0fafad-e10d-4aa3-a2aa-fd9b93a76a62", "comment": "Malware payload (Amadey)", "value": "718bac591f791ea6db4365045388ab78", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492395, "uuid": "9237dd4b-7578-460e-adab-f4cae4399930", "comment": "Malware payload (Amadey)", "value": "667d9b13df640ef07136fa705bf630cb528838ad28367bc6bfed2b5ebba20377", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492395, "uuid": "53c39eea-3fea-410b-8a22-4414d1e1665a", "comment": "Malware payload (Amadey)", "value": "df1cd0b6c565376b4f3ac032080f4cc26d5abd17", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492395, "uuid": "9cee5c76-0e5e-4295-875a-cb47e4fad409", "comment": "Malware payload (Amadey)", "value": "b2668143098d0727eb7d3fd4e2a747014388bc2e45df40bd27fcb962ea1bc08b4d94682a9e5b096056bece7a36a10b4f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492395, "uuid": "c45d63a9-6776-4bfe-87cc-fc556a0e80eb", "value": "T148F42216E2DC41A3DAF5377158FB06630B3BBD71292987677356192E4CB2AC1923232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492395, "uuid": "9f56e745-cb89-4734-965f-1e3e8490e353", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492395, "uuid": "0e95996b-1f9c-4ee2-8a74-23b4d2abb913", "value": "12288:nMrGy90AVLIz9iIoZEC4k+9u85pnuX473ZUqyMUHjfkRm5RKQiw:xyZyaZEPu+3RWkRm5RKQiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492395, "uuid": "1a014eb6-6471-4578-8e10-8f16bc62c795", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492395, "uuid": "bdfd4118-a2f8-4a9e-bca5-df1e548be5fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492395, "uuid": "911c732f-acb9-451d-8e34-b885c12b4895", "value": "718bac591f791ea6db4365045388ab78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf9daa5-23f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689524053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524053, "uuid": "798988db-62c4-44f5-a308-433e46916be5", "comment": "Malware payload (Mirai)", "value": "005b065daa037fa0e903ddc4637e69c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524053, "uuid": "95230ac0-df1a-4e0e-aed9-0613891a8d0d", "comment": "Malware payload (Mirai)", "value": "67805cd71d1733da91efec64ab0fb471406a6eb79c51675dbd9ec35ffb6eb4ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524053, "uuid": "1b7c279a-9d22-4ac4-9bb4-ddb6b52d80a9", "comment": "Malware payload (Mirai)", "value": "dbd355e2061cf697850c505f9d87276597b8339c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524053, "uuid": "e8150a28-3dda-49bf-8080-7f293103321c", "comment": "Malware payload (Mirai)", "value": "623903fee3c2c41d15a53820e09979a9fd5ca7a81010214804e83ddcfbe5180ec73a0a493f583d8bb4523c5a5f596ecf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524053, "uuid": "81fa9a77-a8a3-4cc1-a971-85c408a18586", "value": "T1FCA2D028E345AEF4DFEF9D9093C2D2C276E543C7278AC4E240EEAF016506046B789C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524053, "uuid": "0ec7ba69-67f7-4924-84bc-54a29d8d4059", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5TSM4uVcqgw05VxJ/:mRxsSVsMD6xiJJE5zRWNhJ4uVcqgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689524053, "uuid": "4e197652-b9ef-433e-8bfa-8bc31ca4f2c6", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689524053, "uuid": "e69a71e9-1c12-4a17-9de0-a07e1f7ae75a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524053, "uuid": "4c20de19-21f7-423d-bfde-e1a7c690790a", "value": "005b065daa037fa0e903ddc4637e69c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fefdacc-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529881, "uuid": "4dc61ec0-0ec1-4e07-9d36-cb3c7ccb51e7", "comment": "Malware payload (Mirai)", "value": "46c4cf50f91e3b0d69d6f9d3b098a8a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529881, "uuid": "18563a58-e76c-4317-a2da-561cd38196df", "comment": "Malware payload (Mirai)", "value": "69264b92ad1762321afc467bd3e95d401d6d1ad2dd2807766df2e5f26c004b34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529881, "uuid": "1eabc484-f291-4011-9874-4d0932cdd4b1", "comment": "Malware payload (Mirai)", "value": "1fcaa8737a9d9a333de684ce8c952c5d943c2ba2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529881, "uuid": "eea059e1-6bf5-4a90-9c25-5db9f4dde4de", "comment": "Malware payload (Mirai)", "value": "0c33e47cbaa36ae19ac97f30b8cc5d3083df7f125d0ae0e716ee6187ebc1b6f2acca3e9d212923745a8b177ab594d036", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529881, "uuid": "e17f42ae-0d1c-4888-b361-4d8db3822e10", "value": "T10FC2D054F045DE41EFFB29F03E50DAEABB902F1EA6628E8126A053C26F5D2634305DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529881, "uuid": "561d1a0a-fef1-4f05-a313-2a9545bd1be0", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7PgDRi4uVcqgw093:tam+AnKehPRa9aj4u+qgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529881, "uuid": "e787613d-0672-40e7-b988-bf63d54f7505", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529881, "uuid": "149d7f3f-72ff-4473-b4f0-a4f994c7f79f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529881, "uuid": "bb844ec7-bc78-4cdd-9a1c-b84d42dff52a", "value": "46c4cf50f91e3b0d69d6f9d3b098a8a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cb9757-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492397, "uuid": "8edccc5e-4872-469a-a01a-8a8dbdd8eda9", "comment": "Malware payload (RedLineStealer)", "value": "7bb28ec37429513395c63aa6a6fa4f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492397, "uuid": "37a9252f-e021-45ad-886e-e1b6fc8acc92", "comment": "Malware payload (RedLineStealer)", "value": "6a91bb3c7806220775aec95f2be55efdebbe55505eeb465cf1ee4dade43b1fde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492397, "uuid": "74b3b7cb-82bc-4af5-8a93-378fb5d4024f", "comment": "Malware payload (RedLineStealer)", "value": "5365c4ebd053da50049fc18c6dda74d844c0a60c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492397, "uuid": "c8947814-960c-4341-ae8b-416af677d134", "comment": "Malware payload (RedLineStealer)", "value": "6dfb7d29403b68aed59f2b27eac4e6d3a6ec6e05fcfc2047c9989c346049e2b032c8656fde8cff84e99794acb75342c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492397, "uuid": "23299bfa-1914-4daa-bc06-ed7ae6ee8b75", "value": "T150151216EED84423E8B99BB01CFB07570777BC629E78162A275DDD4A0DB3980A07136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492397, "uuid": "0369f391-d67e-48a7-8df0-a597823c7a33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492397, "uuid": "6ce4b8ef-078f-4334-b0e3-b8cff7fd23c8", "value": "12288:UMrjy90zGi0sERT0TqTiqOk4mGpykp5HOSrI8buidzVgtgHlspfZ1R3tIH5J:fyCCGSieGptpxLU8qid+0afZ3+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492397, "uuid": "5711d3ce-a1d1-466c-9e32-8aa16620f518", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492397, "uuid": "878741da-878d-486a-9b06-22369e3b2442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492397, "uuid": "9e1ccaa1-c3d9-4e24-8a1b-5ba46fd62f74", "value": "7bb28ec37429513395c63aa6a6fa4f0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301ac831-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495871, "uuid": "f8d692d6-f6d5-451a-a242-b32262650937", "comment": "Malware payload (Mirai)", "value": "5a90aa35afd615302cf44d2cbd0af77f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495871, "uuid": "fcd0c10d-c607-47ac-a5a5-a20b15426ddd", "comment": "Malware payload (Mirai)", "value": "6ad3ebd22fab278cd7c33006740c8bcdae23a56a244b9739d13f3fd152bfb07c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495871, "uuid": "0827eef0-5c29-4fb9-a814-0d512721136b", "comment": "Malware payload (Mirai)", "value": "acfeabe03d81e1e53cc1f9efd2ea4c3966f81461", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495871, "uuid": "89e578ae-a058-459e-9ec2-1c3e938a037f", "comment": "Malware payload (Mirai)", "value": "87bf8f755963ce78cd35e70cac77f58d4fbda99543968d339391fa27cf4025371ec673c95df8b53cbf3f6ac52d63b0ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495871, "uuid": "d9ee63f5-f641-4892-bf1e-1762f5dd6221", "value": "T18DE3A53E7E11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495871, "uuid": "7046f871-e88c-4577-bc53-a69792224f33", "value": "3072:JW6dm9tS1aRGQdK76t/zCSI5mrThPaLEnvPrNb:c6IG+LCzmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495871, "uuid": "7304a2fa-9afe-4a4e-ba1b-0c526923ac09", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495871, "uuid": "c4f3e0ec-17a6-4473-8133-138029e6f58c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495871, "uuid": "885cafef-6436-4eda-8019-d95e0db9a491", "value": "5a90aa35afd615302cf44d2cbd0af77f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcccec6-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493340, "uuid": "6931850b-6a04-4cb1-a6a3-4daff04a5598", "comment": "Malware payload (RedLineStealer)", "value": "5f4255eee316c3012ae5fb29e0ee40ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493340, "uuid": "0ef6387d-b024-4686-850e-b03ff4247e6c", "comment": "Malware payload (RedLineStealer)", "value": "6ad7c6843d6d51443c94603e7c8f37e33a59d2cd7043235712cbf88918ae2f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493340, "uuid": "75cca955-34f8-437f-a2ba-8d1acd8a0f50", "comment": "Malware payload (RedLineStealer)", "value": "1af3713753b03b0e4c2d369de88af44701e172c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493340, "uuid": "c4590f9e-05d8-4e4a-b00e-5e1dc348cbfb", "comment": "Malware payload (RedLineStealer)", "value": "6d2a2813626c27d2b322b2c3b28bda370bbd023f58ca626121a8f752e2facd457deb2fb3fd93346a50f6eef8c7db4bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493340, "uuid": "bac66a0b-7f33-48f0-8321-e365a962a903", "value": "T1E1F42247A7E994B6D9B02B301CF307931A36BCA95D70C75B6755E84E1873A80E93133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493340, "uuid": "6f1346fe-5a64-4230-845f-62e43cfb3724", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493340, "uuid": "b15d0282-cd6c-47cb-af4e-b9d5cd6c8e59", "value": "12288:JMroy90qOFD7SJlMa0zXkq38ke2HIMSMaFDCDka80/xMqNHGJWyd06rwh5xc75fB:pyHWomvbc/Mqa80JMqNmJWOiO5bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493340, "uuid": "6c90a60d-7421-4bfc-8c5e-8f82c6651187", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493340, "uuid": "95858a26-8f9d-496a-aec2-9b9cbd5772f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493340, "uuid": "ef2802ae-5c48-4055-aa8b-3cb8804ad5e5", "value": "6ad7c6843d6d51443c94603e7c8f37e33a59d2cd70432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44328ca0-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493328, "uuid": "e826ae5c-a85d-43bc-b9d8-05a02cff886f", "comment": "Malware payload (RedLineStealer)", "value": "f2a435288af42881303cdb4793ee7400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493328, "uuid": "79833e2d-c5e0-4a01-9fca-a14c7e611920", "comment": "Malware payload (RedLineStealer)", "value": "6ade7d6ec7a6381185b43d64ae2429ee9c4ee1ccf584c5bfe5887d96d03e3680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493328, "uuid": "70cd35c0-22f8-4ece-b530-2bd39d953614", "comment": "Malware payload (RedLineStealer)", "value": "9f5bd3e4f31299347372107b08b89938437393df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493328, "uuid": "c0031884-54b1-43fc-8a62-836c94cf2703", "comment": "Malware payload (RedLineStealer)", "value": "c480e6a278fc754b66bba974bf7a6b85f48daf6d625d4af4da6a588dcd21695e8bb166071c714862724e3ca30c6b1ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493328, "uuid": "d0c3a914-9298-428c-9182-08e36f6f4a41", "value": "T152152311ABD55232DDF5237018F703831E3ABDA1D938911A6749AC5E1EB2E84F93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493328, "uuid": "a6e698f9-a449-4a7c-a664-fbe4eb66cf26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493328, "uuid": "a9cc6e45-3666-402b-9911-2b65f5470de0", "value": "24576:oyWuYzzI8C7pWy5JAFCCMr58qneW2i4IFoYYOiG:vmzIls0OMr58qneni4EoYYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493328, "uuid": "9d2b65b3-2b61-4b84-852b-041e10b24f35", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493328, "uuid": "d3c26fcd-25ad-45e0-85c2-328d1b8ab0e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493328, "uuid": "4418d83b-fd4a-4dec-96a2-1567c3dae75f", "value": "f2a435288af42881303cdb4793ee7400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c12028-241c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689541697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689541697, "uuid": "a10b9486-2288-407b-85b5-5b8f445e0598", "comment": "Malware payload", "value": "41b808ea7da55ebeb10d5edea0072114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689541697, "uuid": "8311f3ae-e3e1-4f0b-b4c8-cc0fac334f1c", "comment": "Malware payload", "value": "6b0f1fbd73fcb8eef3c3c3aee2f52d5295d16a725178bb0e8b556ad291f00d31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689541697, "uuid": "e6bfa923-276e-4e86-a5dd-4a60abb19493", "comment": "Malware payload", "value": "b39704d9e1956b876ca068bcc197fa49b3e88742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689541697, "uuid": "2632b175-f8e8-47a5-b08f-3fd6f7a702f2", "comment": "Malware payload", "value": "6d5366bfd47a09443cabb2815c90fc67519cd8587cf0857920b1f9066bd77a7aa869a73512f1ab64d5a1060df091d698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689541697, "uuid": "a33e1ac4-fcdc-4fa4-b12c-558952dbe92f", "value": "T135C59271F54198ADD82B01FA8E27C1202907EE094568982D3596FBCA57B73D390EFE4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689541697, "uuid": "8cc874b8-8eaf-4d86-ac7b-f699ef817fe5", "value": "24576:uI8/AUHkswkjFyuts4HlDT1zEOt6uqV16FcuHUgEuEadrpwrpicpycpi:uDlwcBGKaOtLD0d/adrpwrpicpycpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689541697, "uuid": "14831170-850d-42af-9885-a2f1d0492c58", "value": 2641928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689541697, "uuid": "f004835f-e956-498d-8b39-0db712860004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689541697, "uuid": "bd78a822-c1b2-4ffc-89a0-4f5a448fe924", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59e0d9c-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492713, "uuid": "79696b70-b6e9-4fd7-b36a-c319ae79e769", "comment": "Malware payload (Amadey)", "value": "8efb07a568a23703474da80875bb4666", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492713, "uuid": "31d55b19-b557-4c5d-89ea-b92f3f07a227", "comment": "Malware payload (Amadey)", "value": "6b1e3980e44a918ec5a9c56aa5a81b998ebc95ee54e4fd0359fdc16241a29618", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492713, "uuid": "b7fdfb59-81fd-4023-a1bb-361fee590912", "comment": "Malware payload (Amadey)", "value": "78a63695def06066f10d97c32c49b266884ef6de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492713, "uuid": "598466bc-f770-4b7e-8b6e-dd9b00e26971", "comment": "Malware payload (Amadey)", "value": "7053f25175cf5b085d8c3e5b058320c6fd5c8c85e970270caa20bd910350424a9b2e95c2e26229fbe61cf537263705da", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492713, "uuid": "64c2ccb5-627a-4118-a350-ecc1873f9047", "value": "T14EF41222BBE54032E9BA277518F657D30F35FD228DB457572285A99B0CB27C0A53233E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492713, "uuid": "2b629b77-f5b6-49ca-b7ee-4da84970d4d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492713, "uuid": "d2ebdf63-8e81-4dc5-a1fd-9b8535e8c202", "value": "12288:dMrCy907pxTZO+x1l/oR1r6BXBScefoM/EWnpA1UJNghKP3EJHe6J:fy8lO+x1l/xBXBVeQM/pn7JuKPQHnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492713, "uuid": "ec378de8-1ca3-4334-b523-05432174d9c1", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492713, "uuid": "90cefbaa-3b02-4144-bc08-4aeb21daf8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492713, "uuid": "c83d88f1-beab-432c-b22d-298695161460", "value": "8efb07a568a23703474da80875bb4666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215c8058-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492410, "uuid": "91ed4f52-49f8-4fa7-a6e5-dfcc4beecf16", "comment": "Malware payload (RedLineStealer)", "value": "7dc01fe162857c837ec42c043f06a250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492410, "uuid": "36be2908-a706-408d-9009-58c6b532a026", "comment": "Malware payload (RedLineStealer)", "value": "6bd55afbdee9bee40494e1ad8d221009af60fed046a9028662aea7d0d54f2d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492410, "uuid": "41291d5a-8e8e-4d63-9d9f-cd561a022036", "comment": "Malware payload (RedLineStealer)", "value": "c3f7888a5be49c458cdf5edca546ff6fd0b4da6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492410, "uuid": "b867d1d4-8098-4083-84b1-60ee38ee458b", "comment": "Malware payload (RedLineStealer)", "value": "baa3c646b652c75f9bc515adf470baeec0ab3d23130cc91f6b1a5ec2eaaadfae7e0ea96a0a950a2538921dc0edafbc5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492410, "uuid": "b729c31f-1454-430f-8537-de9292113b87", "value": "T1CE45236163E4A272F5B26BB40CF501C31ABABCB15575C7AB3312D89A0C723D0997936F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492410, "uuid": "3e3e68f9-5e44-40e2-ac1a-354058264c5a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492410, "uuid": "4b79688e-d2e1-4b2c-a167-7448cddac31b", "value": "24576:MyVY5S9UGMFXStmUpJeZyTxB7Sc2mGafGCLun8tczXSZ2Lk:7VS3GMFXYmUpME+DzaS8tcjSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492410, "uuid": "48620aaf-6e8d-4a20-8847-675eb6bd602a", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492410, "uuid": "eb46601a-e3ee-4533-ad7d-5010f21fa2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492410, "uuid": "9b57436f-168a-4285-89e6-215291310022", "value": "7dc01fe162857c837ec42c043f06a250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7e07b8-23da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1689513340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513340, "uuid": "6ec0021c-c36b-42cf-b3b4-fb70ad10e631", "comment": "Malware payload (CobaltStrike)", "value": "38fb3f3eec92218cf45049625d861d3f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513340, "uuid": "e43b7989-5481-4969-a408-2bf74c9d1db8", "comment": "Malware payload (CobaltStrike)", "value": "6c164e7b8698fe634374181710aa0cfc9316ecb8102ad0ecf4e5e44d9ded50b5", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513340, "uuid": "291dfe39-28f5-4288-adbf-80e26d995e87", "comment": "Malware payload (CobaltStrike)", "value": "db903ee96e66699b0c7c1a8c1033d57ca453ae42", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513340, "uuid": "60ec19e1-8e94-4357-985f-865077306165", "comment": "Malware payload (CobaltStrike)", "value": "68cc6c1237d2fe9bbb4f1b186dedbdd5215195fefe76476152319c671f8180177004d7563d2fe061d855ced2e37b390d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513340, "uuid": "4929f22c-4011-4150-aa31-fc304911cd49", "value": "T1E7563380A6802AE9FC67613E8962C926C6B13C6B5714C79F06F446573F333A4993FB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513340, "uuid": "eaa436a4-b061-43fe-ac90-f9b8032222aa", "value": "69eb46a9f63edcc604b0bdaaa8e0f2f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513340, "uuid": "15f0ae74-0c7b-428d-924d-8916d70c4711", "value": "98304:n68LzZ5Sb+sX1ZvbeAyJZ/dJolTlPNs2PKToa1FptF07TNEOVFpMndH2RFO7ZjbA:n6mzZ5SCsXDjDyf/dJolpPgToa10/NEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689513340, "uuid": "051d75af-19ff-480a-adea-6f0116f25be9", "value": 6263596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689513340, "uuid": "7f7e22fc-5537-406f-b1fe-69ff9224d217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513340, "uuid": "388052e8-4392-4c26-870b-82b1ce2cdd39", "value": "6c164e7b8698fe634374181710aa0cfc9316ecb8102ad0ecf4e5e44d9ded50b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05660ae-23f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526204, "uuid": "0e8bac86-1dc8-4e90-82c4-41539d6e2469", "comment": "Malware payload (Mirai)", "value": "4eb74fcf90deefe6a465e14af51fb43c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526204, "uuid": "21be8dda-71ae-4b01-97a6-c5c01f972399", "comment": "Malware payload (Mirai)", "value": "6c7ea44a7a879579176864f6ffee26fd7947e180ff8263ed1958eec7d1e52844", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526204, "uuid": "da74d962-08c4-4316-891b-296e413a6ff1", "comment": "Malware payload (Mirai)", "value": "2f90585fd141b43358ad2577c19989ce6a637443", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526204, "uuid": "54db41cb-e3f2-4896-bfbf-44788f0b56de", "comment": "Malware payload (Mirai)", "value": "5f31b5d079e7f01a4e1305f4dcaffd467b7e4bb47764ace153ef43f868f469cf4012bffe48df715a7a8ce1bba5c06a04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526204, "uuid": "f42c5070-7aee-40b4-a3b2-9901e4f27539", "value": "T1C1C2E1B53FEB6DA7DE0A003A785DED375172B592D36B7746F28081052D071A9AA33CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526204, "uuid": "a20d846f-2818-42c5-a77a-fb29db936678", "value": "384:Mm1DMwk8JPyGgZDZpEXVZVBm6UIadsiWLRYJ4SwF/pfUVlMWEbo28tEe5mjWZSls:/MwqDZ2FbBm6UaHRYncWnH5C0NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526204, "uuid": "cd479f89-47c5-4c29-86a8-7e02b99e0a28", "value": 28040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526204, "uuid": "6387f8ff-cfb5-4d43-91bf-d3604ebfc186", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526204, "uuid": "adebacbe-acc4-4380-87cd-ec8b1ca7fa63", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc8b147-2375-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689469856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469856, "uuid": "ff8066ca-1438-4670-8cd0-e62c3e59172f", "comment": "Malware payload (Formbook)", "value": "e334cf88aea3e5976c84f896e1323deb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469856, "uuid": "d3dec893-87bf-4aa1-b550-2765c3a5aefc", "comment": "Malware payload (Formbook)", "value": "6cfaf0baaa146cc03026051292210d4d4fc57b8217450ca391415e6dd27f8b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469856, "uuid": "b060caba-d678-45d4-b051-f6c765156fb3", "comment": "Malware payload (Formbook)", "value": "8654cf7240da8903f46c5e009fe1762ac079c6a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469856, "uuid": "d8d9aa01-0c54-492e-8faf-f1482f871cd2", "comment": "Malware payload (Formbook)", "value": "84449bf54a44867a7b0380b9bbebbfe16eb04036fc7b76e2d621f4f5eeea752eeb8825c1932fa91c7dba9eb1f553b8eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469856, "uuid": "3f707f0e-5849-4e0d-a0be-eb7d5d2aac87", "value": "T100658D017E04CE55F0092233C2EF45488BB4AC556AA7E32B7DBA376E25163A77D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469856, "uuid": "e1b5340c-1fad-4e8b-aea3-face578b969d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469856, "uuid": "97ded6f8-d2ab-4896-8c67-10041a5a55d0", "value": "24576:JzrOavQuO51twUy+pIVp32SqXF1hjFK1jwk88kJkj/97XDz7y2GtNkz:0xQfa5XH5FK1Eh8997TP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689469856, "uuid": "1c889c49-543c-4e4b-8081-c73d2a592bbb", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689469856, "uuid": "c720dee1-278f-4325-b50a-41b85a679415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469856, "uuid": "359103a4-7072-434d-8642-a4c05cb67ce4", "value": "6CFAF0BAAA146CC03026051292210D4D4FC57B8217450.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce726887-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492701, "uuid": "c2863aad-4f6a-4e9a-858f-16933385d669", "comment": "Malware payload (Amadey)", "value": "7600c12a3184f6d0f2c86b4d4e7a22db", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492701, "uuid": "2384c3c4-d9e6-424f-8de4-d79492dcbba2", "comment": "Malware payload (Amadey)", "value": "6d50565f9ed2f82b9a6ca1b822640d74c41ae485bd612cbf3743d59da77900ef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492701, "uuid": "1b17f0a4-f98e-4ae9-85a0-be82a75367aa", "comment": "Malware payload (Amadey)", "value": "5af1f9851d3ebe8800da5daed91fce25964d36f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492701, "uuid": "c895887a-e525-4b1f-8661-eca34bc60f4d", "comment": "Malware payload (Amadey)", "value": "e4c8ba92eb13dbf52fb1611c7b77202ffb77025fd7eca8dd28db77e2167601e1bcebeb37c3dc8bfd01d0b407eeb5fd99", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492701, "uuid": "9635b187-c1b4-4a8a-bf19-e9fc999137fb", "value": "T178F42302BAE88172E9F527706CF757D34F353CE2A9B5C2773389690A0C725C0A47676A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492701, "uuid": "3d4c8ce7-26aa-4137-b05b-54cb7a686bcc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492701, "uuid": "759ab4cd-1240-4de6-8977-7e19f803e9ad", "value": "12288:bMr9y90CID7+yJeJZURuzlAfvY4CV6Gb3LZY1b1wV7yaNOx3c0f:2ySDKfrEuzWQ6Gb3Leb1wV78j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492701, "uuid": "b499a674-efd5-4b60-a798-1699f89a830b", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492701, "uuid": "86dc7d59-9a2e-4572-a3a1-284e1369ae37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492701, "uuid": "7e7280ad-e58e-49ef-bbe7-eaf84f6afa71", "value": "7600c12a3184f6d0f2c86b4d4e7a22db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6102e6b-239d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GurcuStealer)", "timestamp": 1689487157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689487157, "uuid": "2b4abb57-1b75-40ef-9c55-d2003a5460b8", "comment": "Malware payload (GurcuStealer)", "value": "9e34dec936ee3b2466549aa73e9ce0e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689487157, "uuid": "d5351c06-1ab8-4498-85bd-2ceb7105a54a", "comment": "Malware payload (GurcuStealer)", "value": "6e06151acda178f646ac88c18a40d4cd390f83509848e553b8f38b13ec5ea7e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689487157, "uuid": "8aafb4ca-8026-4e7b-88b7-f0a87e9e9336", "comment": "Malware payload (GurcuStealer)", "value": "b15ddfd1215293d43942d41f67bf5a581701d323", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689487157, "uuid": "4c81d6e8-55e3-4e80-96c8-0e988268cf28", "comment": "Malware payload (GurcuStealer)", "value": "8056bb0ac47197cb91b8107a09282e4e27a8c6caf46efc0dca56a990fe1f7d456d7228c0d23bedf0d7817d41061cba8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689487157, "uuid": "385f7180-ee56-4860-b120-b77ba32d9538", "value": "T152E39D1DBAABEA51C2DE8433C0C215144370C7575503FB2B3DEB66551AA33EB8BC1E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689487157, "uuid": "e7c1541a-7d2c-45ea-be63-400c7d858a89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689487157, "uuid": "e89502ad-f9c5-4f9a-a3f4-731c933fefde", "value": "3072:GZZxK5dGEbcK0dOPOz22gIZOHjsP+3n/v/vfoJ:GZZknbcK8OS22JE+AvXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689487157, "uuid": "40fe50b6-4208-4536-8523-a9dd45d5c7dc", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689487157, "uuid": "8f5c53db-7c3b-4669-9891-27635438027c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689487157, "uuid": "448ab8f4-0b09-4161-bf13-cabc11ec06df", "value": "9e34dec936ee3b2466549aa73e9ce0e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a443b19-2408-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689532905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532905, "uuid": "c410d6c0-cf8b-41c5-83ff-73641ce2c16c", "comment": "Malware payload (Mirai)", "value": "8fb79e2f9433893fc4577fc211e504d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532905, "uuid": "668fc46f-84e2-4e62-a4fb-ff379060cf52", "comment": "Malware payload (Mirai)", "value": "6f8ab1e34fb6d07524e6ea04237a4e0b598a5d5094520792a7df058c63ef8f24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532905, "uuid": "9881ae9c-9aed-4a9e-bb52-700f9cd90a05", "comment": "Malware payload (Mirai)", "value": "f25f089805b04884f489f5f8a229716731e3d643", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532905, "uuid": "43848bca-a009-4b6a-8591-aabdbaceb465", "comment": "Malware payload (Mirai)", "value": "75cf01fb6b3892f6e5322ffcd54fc4887c3817d78b5ffe63e60fa021e4b00a1381c224b4da78b3cd0e010a3d9339e743", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532905, "uuid": "f3661830-1c51-45b2-8681-6d1cc2bee980", "value": "T1E7338D36C87F6DA8C5444638B82249342F63F50885A7AEFA9BC187655047FFCF6183E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532905, "uuid": "4170b7a0-2fff-4a03-8c80-ef9dd3a19c01", "value": "1536:0ndIcnkW5wtd44ZhTZJNexd+3+PkeEtCQNd42+:0nFnkW51EreO+Pke09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532905, "uuid": "1d291b56-4892-46e6-86e9-8cfce7ebf1af", "value": 55116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532905, "uuid": "0e0f0173-836b-40cb-845e-be23af2538fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532905, "uuid": "82bd6ced-bdf7-4080-a6ef-179cbb9da644", "value": "8fb79e2f9433893fc4577fc211e504d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8eb288d-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493631, "uuid": "04789d4d-a05d-4340-bcee-c77669790ba5", "comment": "Malware payload (RedLineStealer)", "value": "c1e2279b611ad24ae7274354e8eeb158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493631, "uuid": "cf57d75f-c30b-43bf-9b10-aa2d66124123", "comment": "Malware payload (RedLineStealer)", "value": "7083b921793ed1b8620d787d58e04f3d42de000acd7760122c5b2b622137179c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493631, "uuid": "0c2d7401-f711-43c1-9b4d-464af36150c8", "comment": "Malware payload (RedLineStealer)", "value": "44afdb189811577b17c1e28822979abdfab78b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493631, "uuid": "0a46d5de-6d51-429a-867f-066b893b2c8b", "comment": "Malware payload (RedLineStealer)", "value": "b086517b9099a8b328fb3a4b5067992513e5381825aa85cdd6c11b40785dfcf22be85920fd9d09c43db8b1602ffb1dd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493631, "uuid": "0350a718-7d39-45eb-85e3-5d6694863aa7", "value": "T1FEF41207E6C40463DDAA27B018F613C73A367E629CB8835B270A5C9F1C73995DA72376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493631, "uuid": "f0233269-d039-4e18-8dba-02b6be7ff62b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493631, "uuid": "052e0d62-dbb2-4bf6-ae31-10ae0ccc1243", "value": "24576:Gy1y2C9TijFpPPjZtQ99GWmQkv/GIGQ2Ut:V1y2CZ4FlZtQTGWmxmxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493631, "uuid": "2d8919e2-de69-4bdb-9a45-0237b645776b", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493631, "uuid": "f243d64b-07fb-4ffd-a9e0-cc6aae0ed0a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493631, "uuid": "bdf6eaaa-724f-44af-9c93-28a6345f0e28", "value": "c1e2279b611ad24ae7274354e8eeb158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7bacd9-2380-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689474445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689474445, "uuid": "86d7432f-f594-41be-b4f2-47133a7b9f5c", "comment": "Malware payload (RedLineStealer)", "value": "ed164e11ea8f141236b6196dac5bd879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689474445, "uuid": "7be535de-e026-4a05-812d-71763cbdf689", "comment": "Malware payload (RedLineStealer)", "value": "70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689474445, "uuid": "f1a31ae5-5d1d-465d-8c82-0850e39d8ed2", "comment": "Malware payload (RedLineStealer)", "value": "d06277b3d82a10ffeced147870a1c7cc65947ae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689474445, "uuid": "0ab5d8ac-738e-4aa3-9777-6558d35c3893", "comment": "Malware payload (RedLineStealer)", "value": "b74314d0b448adca74127a93afec478beab4620dfa459da0120a39f4bdc1c0eaf0cb69205de06270cec16649295ff7aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689474445, "uuid": "5ad1040f-8582-48ae-b0d8-ed9ff51826a4", "value": "T1F4655B9C365071DFC86BCD369AA66C24EA21B86B4F0FD243A41325ED991DA97CF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689474445, "uuid": "993538c4-0660-4736-b337-5d19c44583c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689474445, "uuid": "6cf08dd7-b4e2-4b54-9acf-9975fd2af67a", "value": "24576:7fdsbW0F+Rhk0JgdIpsiwO/QGoWP2qQF+2:O6k0i2qAQGoie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689474445, "uuid": "ecb807bf-123d-47e8-8d7e-90bbee2ee698", "value": 1432576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689474445, "uuid": "312d2fd5-0725-47fb-ac23-98f090d64209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689474445, "uuid": "63cdd8d6-e005-4426-b52e-cba866c10c27", "value": "SecuriteInfo.com.Trojan.GenericKD.37666747.25006.734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0bbbcd-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689493128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493128, "uuid": "df4fd152-ca2d-4e24-b196-962cb7c4ea7c", "comment": "Malware payload (SnakeKeylogger)", "value": "1b5067cc0611da1ce71f903853130e08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493128, "uuid": "ecee00c4-81be-47a2-af3a-14bb620a8716", "comment": "Malware payload (SnakeKeylogger)", "value": "7190acb0296e76093f033d2656820befaa0bb790336c27f846c4a3bd8a6882e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493128, "uuid": "fe6da248-a0a3-4e9c-95b7-6ff2db56bf50", "comment": "Malware payload (SnakeKeylogger)", "value": "93eb2526fac22859666b38ebc83dda94799edbd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493128, "uuid": "b63c01b6-53a0-491e-bb7c-ee5b9f5ea7a5", "comment": "Malware payload (SnakeKeylogger)", "value": "1e0070b5743fb6ec2f3c3e35c5086d78b3251621b881a187c691ed7890bbb4b93b3ac4c6d01477c5d78296293d85405f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493128, "uuid": "81a9c6ab-cfbb-4670-bfd9-c22570f449f5", "value": "T1F0E31A1D67F8D800E1FF897705B16222C776FC42192ACE1D5AD2F5191B3DA908E1AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493128, "uuid": "5a3c75a9-47eb-42fa-825b-ca224f42691d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493128, "uuid": "e666ec1b-d337-4b3f-a215-aa0e1889e91d", "value": "3072:3BjbK/Pcwyly02G8H2NRlRXb7zWewBVjVHgbY:V0E67bubvAVAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493128, "uuid": "7f322801-9251-4925-87ef-8167804522c3", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493128, "uuid": "8f63f7a0-8f51-4302-b878-1622b17ff1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493128, "uuid": "44706996-2f21-40be-a4a3-f4a34a13f0b7", "value": "1b5067cc0611da1ce71f903853130e08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6256741e-2408-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689532892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532892, "uuid": "cecbb0b0-9749-40bb-a051-aba24e70f70d", "comment": "Malware payload (Mirai)", "value": "50e88edf13a743619ab23bd7f11b7e6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532892, "uuid": "29f55e0e-4d47-450d-9450-5209817f250c", "comment": "Malware payload (Mirai)", "value": "7240a678cd8cce731a7126772b46fe01d5edd880754d5cc36ac6a7376a5c4fa3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532892, "uuid": "c136d2da-88f3-4ea4-b521-ee5a4fa40a46", "comment": "Malware payload (Mirai)", "value": "86fc453018f2aa0f7fecb092d14a48f9d4a8b9f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532892, "uuid": "2d9c2edb-6447-4862-be1e-212ac004659b", "comment": "Malware payload (Mirai)", "value": "113acecdcac187c8f03e1f76205a8a568d02b4318125675a028e6d789d8c30c7f28b94691359bab9fbfa675d31bd8104", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532892, "uuid": "9db0b6a2-2689-430a-925c-26dffdbbce92", "value": "T139735C24A97D2E26C0D4B17B62FB8365F2E5230E25B0965D7C720F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532892, "uuid": "7448d5ff-7923-4293-9f8a-08dacf663242", "value": "1536:pms+geQfvznpCR8ee84cNeAUfAvFQ7XdldPws0K:owfdNu4cs8vFyXlIjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532892, "uuid": "c111ff35-368e-41a4-b320-df7f76b3a0a6", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532892, "uuid": "d363b8f7-8949-492f-b13b-a62c36a335da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532892, "uuid": "734cc581-39a9-4f7f-9dcc-7b025d1a7778", "value": "50e88edf13a743619ab23bd7f11b7e6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687e404d-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492100, "uuid": "d7905103-efba-4e7c-a3c9-7883a743ce0b", "comment": "Malware payload (RedLineStealer)", "value": "4f6b85a5fb349bbde2d780f1982d64d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492100, "uuid": "6f9deeb6-d5ce-4019-b54f-7836a3a3e333", "comment": "Malware payload (RedLineStealer)", "value": "72ea89a5791135b0c3f0968dab56627fcf472d2a7486b5c99624671e5bb649d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492100, "uuid": "67b7535a-e6bc-48fb-8261-f8d7f7e5dbc3", "comment": "Malware payload (RedLineStealer)", "value": "2ccb916af5e9cc978cd9b06513d12d659a105cdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492100, "uuid": "ac7b35db-ee40-4e2a-863f-b3d6ec81b54c", "comment": "Malware payload (RedLineStealer)", "value": "302f3d3f703d5c4b1ff7d6d415abaa7416fa5ee3f22e1554fa39c74f6b202a24b1f48a837d0df62226cca4c9ab9106c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492100, "uuid": "69fd6884-0824-4f3e-829e-3d9fe1e8b44a", "value": "T19A15235253D44036D8B117B04CFA43E70B793EA19DB4D29B27A5FEDA1C72A90A47233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492100, "uuid": "e3fc61ca-d8c7-471f-9cbf-2a185ea8b448", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492100, "uuid": "26c21405-304f-4851-9f49-9ac132219eea", "value": "24576:IyvXZGzwAx5Vp+RoZWw0570A6rX9yHNm0eWhx4N+NRw:P/Zsv5vaoUwM7H6rwNthc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492100, "uuid": "2fbdd044-c986-423b-b8da-9661f037e5e0", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492100, "uuid": "55b24592-0eee-48d2-8eae-c8b57585ecee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492100, "uuid": "9efd4d2e-46d0-488c-b616-a6cc1f9555ef", "value": "4f6b85a5fb349bbde2d780f1982d64d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4463ac21-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495905, "uuid": "7a396ee6-f5bc-4d76-a14b-32263272b5a9", "comment": "Malware payload (Mirai)", "value": "3a93c2c4890dd0fcb30ff81bce07f91d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495905, "uuid": "de814970-c242-476d-824b-f61a6704fdfd", "comment": "Malware payload (Mirai)", "value": "7464494142940360b13767b0ba237741611a96076fecf7ba1e498395542d0447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495905, "uuid": "46b38a61-a548-4d07-90dd-9aef1f14747f", "comment": "Malware payload (Mirai)", "value": "a6dc710b249a786ab32deac780fd71e5e4390037", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495905, "uuid": "cd7614bb-0a64-42cf-97e8-1026a78d6efd", "comment": "Malware payload (Mirai)", "value": "32f5e0597d1fbd31685c4b32861847ec5a80a107d13f9518bee752bbd435c75831a2d2069d7ac9c18f75e0ccebfd1b58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495905, "uuid": "55b0f7e7-686e-478a-82c3-733a540e13cc", "value": "T1B0B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495905, "uuid": "15cda186-6314-4efb-bb40-0b35131f2933", "value": "3072:pC/4rdZHsXsZwwR9rNk5mm/QcuLmHniPNb:pCwrvHwsZwY9rOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495905, "uuid": "995e73c1-9292-4717-86bf-b389e19e64b9", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495905, "uuid": "415c3f53-ed2c-4712-be97-31f55719eba6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495905, "uuid": "50378d4a-40d2-458f-b1fa-fc03fcbeeded", "value": "3a93c2c4890dd0fcb30ff81bce07f91d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cb4698-2407-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689532581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532581, "uuid": "464bc8ca-f692-44fc-8b10-932877365bf5", "comment": "Malware payload (Mirai)", "value": "efe815a327c3e1c3cc461fce92299dfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532581, "uuid": "f86db56a-e9e4-484a-b034-87ac6f29c09e", "comment": "Malware payload (Mirai)", "value": "75cae3436f3069be3441534ae9ddc0f6f4c3bdfb3703e46c271928216cc17fb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532581, "uuid": "8fa92642-bc91-44f9-a446-0a30bddc196f", "comment": "Malware payload (Mirai)", "value": "b348c959373ae4a8b67641359c1a943731a4401f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532581, "uuid": "34def9dd-2454-4e1e-8623-3d7d50bf19f0", "comment": "Malware payload (Mirai)", "value": "75cce73588d80d1a183520e193d88e393192812360ce2f1df90ed01af27811b6fb982347d5238786bdb1bec4950696ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532581, "uuid": "42ba164a-52e8-4369-a134-f5db803b9a34", "value": "T1BA43D555B8C25A2BC1E423BBEA6E518D3331A3F8D1DE3217CC111B24B6C952F0DA7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532581, "uuid": "c16e86e7-ad63-4035-9ed0-e005b614c858", "value": "1536:ztdJZAUw6iOYyX8zL5zI2MbrEQvzalG9WnSfxHZd42+:zHJZE88U2MbhvSG9MSJHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532581, "uuid": "c94894af-08fb-4cf4-ae9c-56590c74079a", "value": 55560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532581, "uuid": "5d41467f-96f4-40d1-b4d5-0463eb20ca5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532581, "uuid": "7c710442-cfdc-43ec-a3da-229f5435a483", "value": "efe815a327c3e1c3cc461fce92299dfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db69142c-23b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689498735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689498735, "uuid": "3c82830e-2080-4463-be8e-8caa48cb7be8", "comment": "Malware payload (Amadey)", "value": "7b850001f5713cbeaa0078d2b4a1f406", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689498735, "uuid": "880b1a6b-8efd-4ff7-9e68-cdf3120bd97e", "comment": "Malware payload (Amadey)", "value": "75ccbf328f1e4ec3537ebd63e6afcf1b951f8765d8b1c734b87a7073333332af", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689498735, "uuid": "2350d04a-875d-4a1c-abab-f95b195709b5", "comment": "Malware payload (Amadey)", "value": "e68fde0f08bd2353d118de3cefcbf2e6aca2ce7b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689498735, "uuid": "b4f2f469-808a-45d0-897c-9e546768d69f", "comment": "Malware payload (Amadey)", "value": "a853064bf359c3bb3ef5426b98cb05a53d20e062ffd7c1cf6c0130b446bc4083f3f5f95ed379eade861e4a64c7e74f3d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689498735, "uuid": "50b5d5ee-bd82-4324-a0d2-cb6e736db27c", "value": "T192F422535BDD5833D4BA1BB05DB726C30F3ABDB25C78936A2A41942D18B3A90B631337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689498735, "uuid": "73d5a00c-66da-4ddc-830a-ea6f64e08b79", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689498735, "uuid": "7d699356-0283-4619-ae7a-c924452aa1bb", "value": "12288:9Mroy90eCrZAz38uIrbDgTncDTLc97yZe6r5H+LcPyK:lyUaz38rrvgQfLc1ylwoPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689498735, "uuid": "3379e99c-85ab-42b8-a6a9-29b64c0ba787", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689498735, "uuid": "8da389f5-4528-41c2-a40c-201510e60765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689498735, "uuid": "bb84960e-781b-4a65-be0d-fd4dde9288b1", "value": "75ccbf328f1e4ec3537ebd63e6afcf1b951f8765d8b1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb50a8ae-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493635, "uuid": "8208dc4f-b610-487f-af64-e273a25f0427", "comment": "Malware payload (Amadey)", "value": "3b9d187db3955aa2a97d6d57715a11a3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493635, "uuid": "08ce23dc-661a-4343-9cff-b3afdafbc419", "comment": "Malware payload (Amadey)", "value": "76dac424ea7b723378b458bc9d720c5cacecdecdefccac4f892325f4fe775653", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493635, "uuid": "10593fde-0987-4763-8ef6-ff3b8cf95743", "comment": "Malware payload (Amadey)", "value": "8bdb63304461792c36718986b6214445897dccb0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493635, "uuid": "6dbf26d9-c6d7-43ca-9379-317f62367fda", "comment": "Malware payload (Amadey)", "value": "c41131713b2c9bf5a1960546f92d59dc56ff682bd96a1439a1b3f3e65e897b2ada238ed85ad77d331547ef4fd0daa28d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493635, "uuid": "ffd6d559-4b11-4f51-b3da-31f540f97fd1", "value": "T10E152243EBE58137D9F52B706DF603C72A347CA1C9B452AB3686181B04B398CB5B572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493635, "uuid": "a734a06a-9185-4f4c-ae56-df857f8be58b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493635, "uuid": "70dedd01-c345-495d-8ca6-b01447f005c8", "value": "12288:nMrdy90tkqlUp5J/Ugy6sQMXrltP3mdHx6iHbyl3VgpW4PTduXY0f/Fv6YVoUXwv:iyFnZyAM5AKAyVgzQY6DeF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493635, "uuid": "75dede19-9994-4450-8065-4cb7919e26a4", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493635, "uuid": "a38c63d0-2ef6-40e6-87d4-0d2274fe2f1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493635, "uuid": "0e13434e-0532-4ffd-bf72-9cb55d4d4e81", "value": "76dac424ea7b723378b458bc9d720c5cacecdecdefcca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e237d5d-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467252, "uuid": "a2967fdf-b178-4193-8eec-f2ffd686fc5a", "comment": "Malware payload", "value": "8ed0c494f546cff88a23a72d8bf19a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467252, "uuid": "0100d6b8-0647-40f7-b75f-d2bf8e7b8bb0", "comment": "Malware payload", "value": "7937c69da48dc31f36ace0353d2dc08bd31187ae818867c7641caf0507c94192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467252, "uuid": "1be1edb5-7520-40b0-a046-02f6a0ca81fb", "comment": "Malware payload", "value": "8c8266fd79a9e1c70a4b3812255694c032597742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467252, "uuid": "44346dfb-9c68-4ee3-bf97-fd155f54b100", "comment": "Malware payload", "value": "cbe2698743595d4ca4df8bc3f19d714df30b0d7d0d8396dfa86b7862f474bc5bb114ee7754181923a53b1815782b754c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467252, "uuid": "4b597155-f071-4e84-b2fc-d3aad62bc875", "value": "T1B5159F22E2D25837D1732A749C5B86A9EC367E103E7C7C866BE91C0C5F3968139393D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467252, "uuid": "8b49d997-5f51-4ab5-9363-3a068fa16e42", "value": "12288:10fnvV6B8if5NCYKn/zmLJRoVLCTl/pU85TXERe376fHNyn3TaQdHq4WWQ2:12n96AYKnu8Lk77T0276fts3TjvWWQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467252, "uuid": "c4643587-9ff8-4c7a-8b62-52b0a3d84d03", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467252, "uuid": "b24429a6-1d71-4e44-8c8a-c0d419f4a9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467252, "uuid": "d23e1025-989e-44d7-95cb-f68f5f8639b3", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.15521.14277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45de9ea-2404-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689531311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531311, "uuid": "c4615947-74de-4a9d-bedf-251c4266aa0a", "comment": "Malware payload (RedLineStealer)", "value": "d2d46c5aa50f9218f9ac83784f9bbc5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531311, "uuid": "d1cec07b-6a29-4cd9-9c51-b82d1bbadf4c", "comment": "Malware payload (RedLineStealer)", "value": "799c6f0780b063a98ca67e217ac920733e5ed59742300658a747457ef30a3ed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531311, "uuid": "41611146-565b-43ce-89b1-3e4724dc3d48", "comment": "Malware payload (RedLineStealer)", "value": "e93289ebabf1b405250c3cd6505816bea63e1c13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531311, "uuid": "fc4f68d2-7f6f-4a92-9478-b24c87ef5051", "comment": "Malware payload (RedLineStealer)", "value": "aaf2e8f8c2e1591d0718ce98fdbfc94f30e882dbb3e167e7e20df8c67ac8480276f26b1db287fab5780f71f1f600d196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531311, "uuid": "74130b0c-ae23-490c-aca3-11ebb3b7e273", "value": "T13F64954392A17D48EA268B769E1FC2E8B70DF651CE4D7B75321AFE1F00B1076D263A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531311, "uuid": "329c3475-d4be-4ee9-ab49-ce11e8976487", "value": "f3a1a6c560f808b7f46a078e7eba3d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531311, "uuid": "3a6dd557-6326-4fca-94c7-3374b0cac410", "value": "3072:XQLq8USud4tem1FJy4v0bipkTJFQ655oM5SZwlgZDGWeT3:ALqNSud4UEHy6hAjHoHZFGtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689531311, "uuid": "0a71c579-aaf0-40b7-8e5e-7b73fefa93f5", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689531311, "uuid": "5e87efb5-810c-4428-807c-c7218868cae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531311, "uuid": "e713994f-3e6e-4225-bb90-068983d50f30", "value": "799c6f0780b063a98ca67e217ac920733e5ed59742300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc8d554-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492082, "uuid": "371cabc6-4fba-4d96-9e54-1f45e3fac02f", "comment": "Malware payload (Amadey)", "value": "21150b773bfe5ce3cb16ea03e18d03e0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492082, "uuid": "20871631-664b-42fc-8b67-5512a23fdb22", "comment": "Malware payload (Amadey)", "value": "7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492082, "uuid": "b6f8d0bb-9574-4847-8b3f-60446a3ecb20", "comment": "Malware payload (Amadey)", "value": "4b374d61fa92d29f777a82c7a42d558c697f1a44", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492082, "uuid": "451b052d-fbdf-4c84-8323-aee37632eb40", "comment": "Malware payload (Amadey)", "value": "bfd0bb4027f5caec32fe6076e94a15c12aeeb70a99e4e8eb1b5dcf9a125072c067b117b7f386899932f20a66e4cb5a3f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492082, "uuid": "0437bbf8-b3dd-4730-b354-abf30d8d17bd", "value": "T107152385A7E46473C6F057B088F217931B3AFE625E788B2B63446C5B0CB32909D72767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492082, "uuid": "d07e11dc-ed7b-430e-9ac0-d377360be256", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492082, "uuid": "14d2680f-99a6-450e-bdfb-5d4b5d76d3b4", "value": "24576:CyFllbMVwT/Q0K3wHNpWhHUZn7CEYfbu:p3lbMVwTIENpYHInXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492082, "uuid": "66f08c6a-0a76-439c-ace1-dfe366f35ad5", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492082, "uuid": "109fbd3f-48ff-467a-867d-8c714eb95aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492082, "uuid": "7196ec79-627c-4209-a34a-6690d298581a", "value": "21150b773bfe5ce3cb16ea03e18d03e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fe8284-23f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689524342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524342, "uuid": "3ac7f796-92f1-46e1-892b-662107878af7", "comment": "Malware payload (Mirai)", "value": "3f30362ce8c01be0283ca65911116b70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524342, "uuid": "1de76710-b43b-4e2a-8292-6b0d2ae9084e", "comment": "Malware payload (Mirai)", "value": "7a81f6ac4e57cf52c8866581d4d26f9387a765bd059805c74ac6c4f3b052d25b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524342, "uuid": "717c9024-32cd-4fb0-b59c-04ab35e98587", "comment": "Malware payload (Mirai)", "value": "6a2eb8567c821f71a4040d9145e1d11dd362d3a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524342, "uuid": "3ee0f1b7-f697-4720-bd40-cf7878803659", "comment": "Malware payload (Mirai)", "value": "ea9761624144c9d14a8ccfa3e58bc140f75b167679bece461fa37f57b99554d1d93a213882245f12f8a7b054edf6ddc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524342, "uuid": "fc770c15-07c4-4d07-97d4-0b0177645528", "value": "T13D431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524342, "uuid": "c857dd90-f1e1-44e6-bfa8-26e9176eca5f", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwb:RqtmZPuutfbltZFBSJsBcfDSTFI+BEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689524342, "uuid": "b2e9b2e4-57f8-44c7-a102-275723ccd3d4", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689524342, "uuid": "084bc4b3-8fd2-4249-a6e8-b17c69553e15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524342, "uuid": "5ce97a94-7df5-48f0-b2b0-b1d07aadfbda", "value": "3f30362ce8c01be0283ca65911116b70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851c4bc8-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467237, "uuid": "9372f285-d88c-4ac5-8eb2-0191541e125a", "comment": "Malware payload", "value": "2f679b30139928ecb68ad4b3fd63b5dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467237, "uuid": "0960a1ac-a069-4a04-b6b5-bd231f6cee80", "comment": "Malware payload", "value": "7bebcdbccb96ac5f2637942f2a4a5c709b9507cf852e11ea911b7ac938f7edf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467237, "uuid": "95ac5edc-4ea4-432e-b16e-a770a12fbb26", "comment": "Malware payload", "value": "ff982cd63396b816432d611bdaf240f964df782c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467237, "uuid": "b35a7b22-59e4-4c71-92b7-09ec18971e9e", "comment": "Malware payload", "value": "aabd9e810668e1b89a6b557746e552c9e1b2dffbff2816a34a89a7beb4a8a440546f44e325eece05b0598a6d2c87d556", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467237, "uuid": "c80eed90-32e8-4d2e-a5ba-c9b93eb0cb6d", "value": "T19074D042B3D78079F9F6163989B680116D223DBD24F1A01D2D70F64F28B99D698B7F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467237, "uuid": "646d04d2-f542-4c50-b07b-73a6f90c5915", "value": "cccd8ee47c8800024c2fef5b2da820a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467237, "uuid": "19b2b588-9247-420f-8ebf-5e782a5d905a", "value": "6144:tAJn+aC1meyUGimMIMEy73f+pv8vtD888888888888W88888888888/ZJ:tqW1meyUGpNxpkF888888888888W888P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467237, "uuid": "8a11feb7-a797-4963-a70b-52e9522a7be1", "value": 358428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467237, "uuid": "76ceadc2-23ba-4279-9288-0514810d0b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467237, "uuid": "70f7c7a5-1104-4e8d-998c-9043ea2196cf", "value": "SecuriteInfo.com.Variant.Barys.660.84.13600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd68ff4-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492112, "uuid": "71cd3377-c8ed-4aa5-bb7a-7ec5e32257be", "comment": "Malware payload (Amadey)", "value": "59e3ca8cda0c34785621ce53cbc443f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492112, "uuid": "98496d94-3d46-40e2-a02b-7731946e6964", "comment": "Malware payload (Amadey)", "value": "7c0286554ac9381c9063b805018449ecbbcd29f8ce4cd23f2f0899846f42c802", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492112, "uuid": "32cca2d1-2f30-4686-ba0c-4f1a6dfdef8c", "comment": "Malware payload (Amadey)", "value": "8c5b70c4b8a48f01470dc1db50bfd40ee04e60e5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492112, "uuid": "eb7c2db9-1ec0-41a7-8349-8fc20fd0d410", "comment": "Malware payload (Amadey)", "value": "e70053d9bddfe74825a6b994189ae9f19a1b9b5d023ccac0139409280ce34db4b811cdc3545146035d88ead9ab1410d8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492112, "uuid": "3952d4fe-2946-4305-9be0-694903aa61e3", "value": "T19F15220BB7E89176ECB02774A9FA13CB0B327CA1D974426F2746596D08724C5A871B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492112, "uuid": "22aa6314-ba18-4143-894c-7c5ff73a77c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492112, "uuid": "65ce3578-3f62-464d-8bf2-286e0de056d1", "value": "24576:WyN9l2hKmLvK2da6iBraMH9oFh+AjiFZj6vuQkl7:lNvSbja6i4oov7QZj9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492112, "uuid": "53f2ccc4-03f5-47f5-a1d9-ac3376676eb5", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492112, "uuid": "f542de58-74e4-4d9d-ae06-2ab0973a7b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492112, "uuid": "20dfe11e-0ea2-47a2-963d-45d73c5318d8", "value": "59e3ca8cda0c34785621ce53cbc443f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e660cf-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493008, "uuid": "f548b501-2a31-47e1-8bd6-b088f3137e49", "comment": "Malware payload (RedLineStealer)", "value": "d206f84bd9a4b182ef978addb9c3363a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493008, "uuid": "29837635-6e27-4fe4-81a7-79eb53e60808", "comment": "Malware payload (RedLineStealer)", "value": "7ccfc85da5bd6677fe2ecf402b3c8bc9767358d5a8a4e5ea9fd5c87c7739019f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493008, "uuid": "a2e6d845-d0fd-4080-b53c-9ded053beb66", "comment": "Malware payload (RedLineStealer)", "value": "4590f146db5f00ec345b1c3a5b84b1cc94f366d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493008, "uuid": "79870fe4-03c1-4a67-a9da-1f705b66b95b", "comment": "Malware payload (RedLineStealer)", "value": "29ea5009d07f20a88caf44d4cf832ba3c4a6236350f5f448832db775a82ebdb94aeb76018249d892ba90ef0b06459fec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493008, "uuid": "6d091b6c-aee8-4950-8a85-a26e685e683d", "value": "T14F252313B7E444B2DAE42BB00CF962C35A35FDA59778536B32859C9A1C73EC9A43071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493008, "uuid": "d1f5ccd0-118f-454e-9a81-6922b5483100", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493008, "uuid": "8bc9e0ef-bc31-48b7-9765-45a9ff679955", "value": "24576:eyJKJS46r1n2B1g3kR8SU0tVH69WYDtSXRgeCe6xy:t4J8qa3y8H07H69F8xCe6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493008, "uuid": "2d87e5dc-fa75-496c-b52d-3ae807e78cc9", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493008, "uuid": "272bfc1e-0140-444b-a5c1-c09136d28d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493008, "uuid": "7091fbde-2930-4a75-b3fe-3c622a8f8ee3", "value": "d206f84bd9a4b182ef978addb9c3363a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2f65c9-23a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689490256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490256, "uuid": "10e03be1-f571-46e0-8c02-ce62c0db6e92", "comment": "Malware payload (RedLineStealer)", "value": "8ea91555e8e1e73b84b7e7bda2f60a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490256, "uuid": "48c5468a-2d3e-4ac8-bddd-d33444208542", "comment": "Malware payload (RedLineStealer)", "value": "7d8bbd50abc440118b64454944dae3867694962d6c0db97c5d5b2fafd6e107c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490256, "uuid": "db302c81-c491-457e-8689-ab8b3bb7a223", "comment": "Malware payload (RedLineStealer)", "value": "f5b3c782b63953210783495162ed120512a4d2e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490256, "uuid": "e0cc0cc3-41a1-4002-82c2-4106134434ed", "comment": "Malware payload (RedLineStealer)", "value": "ba7b2816442cf123a437819ef5541416f230300e1cf0056a6ae449e40e6df510a4dad603860c59fa31b4ef9886098629", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490256, "uuid": "ae64ddb3-894e-4c3c-a591-6b588666b5ae", "value": "T1FA152343E7D59163E9F047B04CF702EB1B3538527978872B13D19D4A0CB3A98A572B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490256, "uuid": "eeb984e5-323f-435b-8325-63b501c59fcb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490256, "uuid": "daf85dba-a16d-4d96-bb78-be546199a9d8", "value": "24576:ry8DmLIM9SnfWAaK89OUQMblNV/q9pI2EG8:eFIM9GfaKh0xq9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689490256, "uuid": "c8071066-36e3-417e-a881-14926a14f527", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689490256, "uuid": "9f794619-8703-4cfb-997d-8cb9f0c4230b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490256, "uuid": "01e31038-74c7-4504-906f-04d80ad87ee1", "value": "8ea91555e8e1e73b84b7e7bda2f60a15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59064177-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492074, "uuid": "1dcbed34-961f-4ac9-a022-f021e0cc764c", "comment": "Malware payload (RedLineStealer)", "value": "4d6bc87a5035be0d2eff75f9a663f7a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492074, "uuid": "7e6ed42e-7289-4e85-8eae-f6766e6af4d1", "comment": "Malware payload (RedLineStealer)", "value": "7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492074, "uuid": "6f1ce224-84c6-4d7c-85a7-2a3aaf0a7beb", "comment": "Malware payload (RedLineStealer)", "value": "a427033287f275020232a2f96e8413f7ffc9b400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492074, "uuid": "e973118b-6431-4a02-8d18-831bf61eecaa", "comment": "Malware payload (RedLineStealer)", "value": "68a9209baf222d54b94ae9e2104d62ef738bb9b6956fb137a71a41f195ec9a6dc17805b47f2ed76c17b5bbb9c20715f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492074, "uuid": "6a4d4461-7aaf-467f-9693-36ee4944a5af", "value": "T1211523936BE91131D8F6137068FB06C31A36BC50D968876B33A6DF571EB3281723176A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492074, "uuid": "cacdb0f6-e0ed-43b8-9291-8c76e3e0927a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492074, "uuid": "8e94cf48-6282-4216-a1cd-18d4ef608e1a", "value": "24576:QygOXaCEQ2qvM8W8KNJv+w7pg9uz8aPjsER:XgOqCEYk8W39g95qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492074, "uuid": "ef46d46b-41dc-4a5b-bef3-10acccacdf23", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492074, "uuid": "a711dd6b-075a-43fe-b797-60267411e7cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492074, "uuid": "b292d4d3-ae29-4e00-aac2-e0ae8d8eb11e", "value": "4d6bc87a5035be0d2eff75f9a663f7a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2820fde1-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491992, "uuid": "9f4649c4-3d07-4e31-9ee7-c4e81f321f6d", "comment": "Malware payload (RedLineStealer)", "value": "1074f3858ed4f2e3ed8c945e13396bec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491992, "uuid": "4d904e52-2ee8-438e-a2fe-0132df702af7", "comment": "Malware payload (RedLineStealer)", "value": "8004bfbed6a65d43e8278bcfaf6eb153b9d37067e0a1c1ed6b7b7d428de93a2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491992, "uuid": "f08ec6f3-a97e-4e47-a8e1-0f440e0e2634", "comment": "Malware payload (RedLineStealer)", "value": "b9d784ef01494cd2bca3eb177280691972efc299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491992, "uuid": "c40a4cb7-5f86-4644-8c20-7f7b8ffb70b1", "comment": "Malware payload (RedLineStealer)", "value": "fcb47fc34c0ce5376d7fe03e7dd07e57d96a63530d8980c34faa7af1a5f4fd6a7abffbd5f1ce04bdd9767e6bdda7f9ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491992, "uuid": "65fed919-8310-469e-a0bb-b3f886015160", "value": "T1EEC5BE1135C0803AD67721320669F7B64AAEF9301B658ADF17E81A7E5F746C0AF3225F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491992, "uuid": "d6ca9d61-3c1c-46ef-af27-a8233b520358", "value": "f2e65001186390eace6b619d2da91ac6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491992, "uuid": "9ea459e4-d7a4-4368-89df-ac6aa7781117", "value": "24576:1cXqZ0eU+3n3aFGkcBzWVET2fgWSHxEGG+R:CQU+3n3aEkcUpfgRREGGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491992, "uuid": "dee8b0cd-076d-426a-87b2-e75a6bb9ecc9", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491992, "uuid": "e47c5186-2648-4b0a-ab3f-6d1fe284c8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491992, "uuid": "6ddd4336-285d-4f87-b5cf-c5ae0fb1ac4e", "value": "1074f3858ed4f2e3ed8c945e13396bec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d75d7c6-23db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1689513449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513449, "uuid": "eee291bb-626a-433e-930b-1576a09e1f7d", "comment": "Malware payload (Rhadamanthys)", "value": "b271a785ffc4e33bd3ffa018b28c26e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513449, "uuid": "eedb20c0-b9a8-4460-9127-b687a89f7180", "comment": "Malware payload (Rhadamanthys)", "value": "811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513449, "uuid": "2bd05352-b06a-4ce9-b0d6-bf936996c81e", "comment": "Malware payload (Rhadamanthys)", "value": "7757226b475981467ddac73649175d8e99778d02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513449, "uuid": "5ed1fc4d-c848-4f51-b9dd-0302abc68597", "comment": "Malware payload (Rhadamanthys)", "value": "c925b6d6b48600653b944f12136e380bb8e75431063010e18a753789d01b0aee3e6fcc09032f701ef184d404b1c4a58e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513449, "uuid": "b06a4eb1-0e74-4459-9c5f-8a573ceb1601", "value": "T150B44A4393E17D48EA268F769E1FC6E8B70DF6908E4D7B653119EE1F00B10B6D263A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513449, "uuid": "4c9aaf9c-5829-4b27-bc4a-3b9c69567f32", "value": "326441378ca815656cabd6c06990bf3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513449, "uuid": "52e13d74-caeb-4911-854e-334c2c31aa84", "value": "6144:6LET/MC/wLma7hvJ8w9cyp4vPfbdqHrRG0qMJSJH8kBDeuzvFG:6ozzpW68cyavPTQrRMISJccDeujF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689513449, "uuid": "54e58015-7060-4f15-9979-4d0e25e477f4", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689513449, "uuid": "7b99e345-e565-4c33-b2bf-91d4c29cbfd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513449, "uuid": "be50a365-8fd7-431c-8e5d-241c8cc56a11", "value": "b271a785ffc4e33bd3ffa018b28c26e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17757502-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492394, "uuid": "1b532d75-0c05-4f3f-b248-fb81ab917ed9", "comment": "Malware payload (RedLineStealer)", "value": "6b0c925f92ec28ada8bf67f45cd122f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492394, "uuid": "9782a4d7-2edd-495d-829f-21020c88069d", "comment": "Malware payload (RedLineStealer)", "value": "8125e38d294b63689bbfc2ecb40c115663d120adaef87da5955ad9cd844fabb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492394, "uuid": "f050adac-267a-4158-8946-d84c3f712c4a", "comment": "Malware payload (RedLineStealer)", "value": "d7484eaad4623150b49277bd25d6bb6cd8e47dff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492394, "uuid": "c1799bc5-1e3b-4312-93be-60c859390a61", "comment": "Malware payload (RedLineStealer)", "value": "ab1796b75533e3bdc539312e40048b3774cc75ba3088eac7e489a5bcc1d4a354830018946b37a19e5cf154a4561a2f0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492394, "uuid": "79df4113-d935-4612-afc3-ac15d52625af", "value": "T163452353A2DD8561ECB0477484FF12C31A36BCE6B97C433B274998CE09B3498A53936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492394, "uuid": "b1a62667-76ec-46cd-8d6c-9da4f3053ffd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492394, "uuid": "afa04eb6-ca51-48e1-a2a1-84b5dd7ca908", "value": "24576:ICyxBPAydJQrDKL48hZiWMP4Ok3t3dhSIzfYNitVqwyf+xUtv7C:6xSydJRVhZVqaJdhNY3Wxqv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492394, "uuid": "a20799ca-ea2b-4455-a1b7-44780d77d391", "value": 1213440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492394, "uuid": "9151bc35-86a0-49c3-8fe1-520b1da4e7e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492394, "uuid": "ebf3c4ab-c885-4210-a743-05b3c4aa1da1", "value": "6b0c925f92ec28ada8bf67f45cd122f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ffed10-23a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689488854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689488854, "uuid": "ec985a08-bff2-433d-843f-30a3cfbffc4e", "comment": "Malware payload", "value": "795bbae7940b849a6b8f60f922edbc2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689488854, "uuid": "0cd04edb-c118-4bf4-b5f7-e1cca1810fd5", "comment": "Malware payload", "value": "81bd257cc7da2bd3b4a524afbad0873f1609494208bad4572d23cb809581a6a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689488854, "uuid": "500f4972-bd26-4b9d-809a-ea6561392454", "comment": "Malware payload", "value": "c4d1d418395ac524289513aacad9f8c050f992bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689488854, "uuid": "05ddb7e7-a01a-4c1b-b097-3db7fba4f3e5", "comment": "Malware payload", "value": "5b9c6c5d2d81ae88a456b2bc677ebab59abc38ad15701896ff2fbfca4117f6c7c837189f0acd94be6bdc75c542e899d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689488854, "uuid": "47c9d60a-b7bb-47da-8226-c690da2eb4b4", "value": "T15473F746A9919617C5C10B7AFA0F134A73334728D3DF63521E286E74AF87B6F0E3A911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689488854, "uuid": "aef5ef38-206d-4fbd-84ab-24bac85e8287", "value": "1536:5tn4SaCq9vHpFeeCXaNS4NTxIkiciHWIVuvYn58YKYyelZxz:USallHpgfaaHWIVuvYnGJSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689488854, "uuid": "20f167ca-4e79-4a10-b8f5-e5f7b274daf2", "value": 77681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689488854, "uuid": "5de3a13b-870c-4ba5-92b0-b408e6d1e3af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689488854, "uuid": "580262e3-5fc2-444b-b35a-371d27385e7e", "value": "SecuriteInfo.com.Heur.20230716052907112781455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500a0a30-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495924, "uuid": "c80b5836-c2be-4a57-bd65-7accf6f6d889", "comment": "Malware payload (Mirai)", "value": "b30ba440e4b9cbb0dfd3c7729889d5ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495924, "uuid": "b65c6b00-018d-4e47-8d72-19a28d8c2b3e", "comment": "Malware payload (Mirai)", "value": "8278e7aae1a04514150d5465d6be197e00230c0879058f16744ce79033aed04b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495924, "uuid": "87e737a2-960f-450d-91bd-c3e6ea7c8a6d", "comment": "Malware payload (Mirai)", "value": "404749f2fff0f99330c9b78ab5d0fcd664d1f4cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495924, "uuid": "bcda59af-6eda-400b-97c2-2fbec3b54f80", "comment": "Malware payload (Mirai)", "value": "3d4a63e07bb3dae2239c338e2e31cea57dea1e1f95a28d5d81662c47cf705c49233965ed6b170d63c2faa08d3646dcd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495924, "uuid": "1badc4db-5fb9-4e32-b40b-e56c96dcf1b7", "value": "T159B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495924, "uuid": "48b4d0db-b47f-40b2-bb67-77abc88d51cd", "value": "3072:MDVLSItJP+Xsp4JlN3H1jmH1cuEgvniuN/:MDV+ItJH2l3H1jmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495924, "uuid": "13b7aa2c-4cab-43b4-a751-3f85fc1c769f", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495924, "uuid": "ec9a4143-86c8-450f-9011-3f9735445a74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495924, "uuid": "5a3d036a-9012-43ae-9fbf-4ebd9200b561", "value": "b30ba440e4b9cbb0dfd3c7729889d5ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57bd2d58-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492072, "uuid": "db34959b-d58c-467f-bdac-0238cb73f995", "comment": "Malware payload (Amadey)", "value": "39bf80eb44acf1a81fada3d27fc3d228", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492072, "uuid": "d17dfe54-7d83-40f8-ad56-f8f89ff36f67", "comment": "Malware payload (Amadey)", "value": "82e97b51cae4985f5a2abc5bbe0fe4c23fb25fa8072e45d5e34ec789cb7fcc5f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492072, "uuid": "e2078fbf-a1d4-425a-a630-093f8a74f6bb", "comment": "Malware payload (Amadey)", "value": "ab1b7c12d61733d2ff88c01c76fff9d8bdd15b0e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492072, "uuid": "ecac43ca-fd42-4467-9827-65108cfbbdb5", "comment": "Malware payload (Amadey)", "value": "0d14f00ac83717ed7a4ea9476c3fcca1013a2b83f2ef881f7ce3d48144ba542307782393447e60255a4b1e1676dfb473", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492072, "uuid": "309b36a8-99e5-4add-a3ed-11313aadb212", "value": "T1F0F42312F6E59133CC761BB458F213932E3BBDA02974837B6755AB4A4CB36C0983176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492072, "uuid": "4b45492b-0ff8-4fb6-8b37-11e7c90b94b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492072, "uuid": "54b36de8-3c5b-46eb-adfc-93571fe92a41", "value": "24576:XyHqqDah9D/bplKzYEkXOsb/xnZIuPhG:iKqSD/bHOYEM/ZiuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492072, "uuid": "7265228c-d90e-47b3-bf02-e22f21050c2e", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492072, "uuid": "2e0ae239-547b-4e34-8238-5679454acd3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492072, "uuid": "d36172bb-08a5-4821-a69e-bdee28bcdf32", "value": "39bf80eb44acf1a81fada3d27fc3d228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fe7a8d-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491794, "uuid": "be2e54d9-7ce5-4d4a-893d-67e8973b31fa", "comment": "Malware payload (Amadey)", "value": "3d56fe60879ef137225e115ea42923cf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491794, "uuid": "55cb5564-973b-4e09-86dd-528e7ac1a7b4", "comment": "Malware payload (Amadey)", "value": "841ea03e181082fcf7f5533397a6731021c045058047518f2795b78fd69dda82", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491794, "uuid": "d08bdc2d-8eae-4ba6-acb7-26d452b37fa5", "comment": "Malware payload (Amadey)", "value": "e13b6d13fe9d23e1e67b2b9136fc8ce25aa8a3ee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491794, "uuid": "3c485092-cc75-471a-b3e8-e5fef3eafdab", "comment": "Malware payload (Amadey)", "value": "6a5e8da4a2db9daed9b1c84ecde48930e5de6b96febea09fd2518ac854945ddfcc95f66b0b9bb4b3fb40d219e030bf3a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491794, "uuid": "78676aa2-3c6c-4f64-80c2-c896c6047a66", "value": "T13A152213BBE8C532D9F117B02DF64BD30B3ABCA48AB487276740B54A1D739499436B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491794, "uuid": "412dfee9-ccc0-4dcb-a0fb-1998f8652eee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491794, "uuid": "cf6ff0c7-c5de-440a-b50a-1fca0f364d0e", "value": "12288:kMrHy90QFfLsOpAvhgQTDKstwuoHAb8ce092kfJZGwgb3N4R3pQZp86GqWLYWiyk:zyNAZvhPKstwuoHeBXjv16p86GS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491794, "uuid": "278e5314-f067-4e2e-87e2-53a637675a49", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491794, "uuid": "b6d2e61c-d222-483e-9127-11d6ce189c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491794, "uuid": "2be16bcc-f31a-447d-994b-4213f04cbcfd", "value": "3d56fe60879ef137225e115ea42923cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48407273-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493334, "uuid": "fb559984-33e4-4c1d-9733-065ebff751a7", "comment": "Malware payload (RedLineStealer)", "value": "fd7d1d6d7e37d42f7fde59ea1d5600e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493334, "uuid": "45bb39fa-5a05-4692-afa6-d0d572ebf908", "comment": "Malware payload (RedLineStealer)", "value": "846dda125569eeb29c3dfe43747dd0a19bebf5677772c54ec7fda44aebadfda8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493334, "uuid": "047134b2-d135-431d-a0f5-274cfc0cbb41", "comment": "Malware payload (RedLineStealer)", "value": "27f42411c4ff2a44dce981e113090b4298024528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493334, "uuid": "bdd1af54-e1ab-425d-b22a-04f611f0b222", "comment": "Malware payload (RedLineStealer)", "value": "2964d4f42cc61ccaadacde224a751b86d66fbb5e4dc76641a0be618691430f63eba3ce1f2ee85d5cb9eb04015c991912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493334, "uuid": "b71685b2-ad18-4c34-afd6-f0a99e7f81c6", "value": "T1C7F41206FBEC4872CDB1977068FA1AC31F32BC516638935733419A1A1CB2785E974B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493334, "uuid": "0700ba72-587f-4351-b7cb-da3440f4b992", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493334, "uuid": "cc8ee949-c5c6-4a85-abac-44eac84570e5", "value": "12288:6MrQy90eHdaxClb+ew4Cf7wVc9kFLwSPiS5tBkytB3RU1XMSYcXIP/sWdlkx:eytax3z4EU8CLwSPiSjBLAXMze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493334, "uuid": "0b6c8514-aafd-42ff-bfea-b98d983ad29b", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493334, "uuid": "f601b2d9-e2ff-4268-a949-c84a2d7a0f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493334, "uuid": "a059ba90-5455-4f13-a56b-6baf253f7a42", "value": "fd7d1d6d7e37d42f7fde59ea1d5600e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593050e5-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1689493363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493363, "uuid": "b579fdd3-56d6-4177-88ec-9b9f01ef405c", "comment": "Malware payload (Vidar)", "value": "0bff0869cb5d05654c2721ed130890ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493363, "uuid": "11f1b89d-52e7-434a-b63d-973844f65615", "comment": "Malware payload (Vidar)", "value": "857c8efd9dc51444ef97b2058ca1246eb31edd3c023b0f20edfc0a34cee256e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493363, "uuid": "bf651099-97ea-4fcf-99c3-e2bb5578e93d", "comment": "Malware payload (Vidar)", "value": "62d32bc1cfd2fb323386d2ebd32a4a61f7e67c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493363, "uuid": "d268c7bb-b6c2-4b0f-bbf1-84ba6521031f", "comment": "Malware payload (Vidar)", "value": "2b55ab17ec5a3aaffb3ee23b854da523d0e8d7d925b2882b3029ca5b267efff98b0e4a822f3c780e512ea3ccdbea16df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493363, "uuid": "bc8e5d7c-12e3-4f89-983d-70b9824894d5", "value": "T11F34F15E96E460B7D4A9837484E342B7AA71BCB02B5526FF12D0E5BA5F033D07134B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493363, "uuid": "2a784c3d-ef5d-4b73-aecb-1ce2fb87f096", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493363, "uuid": "8751f4c1-f803-424d-8203-5b77c1b08c7a", "value": "6144:tahOfriEdcv2vswOb815E8IwcxcEROHkQg9I1FE:tiGOGg2kRmq8Iwscn1gG1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493363, "uuid": "3776d548-a02f-48ba-bbf5-c5ff35d340ba", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493363, "uuid": "ce1eb2fc-e284-44e4-ae00-2ab3d909897f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493363, "uuid": "b9acab07-3a83-4a2b-a0a6-28824bcd68f1", "value": "0bff0869cb5d05654c2721ed130890ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82510ff0-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467232, "uuid": "87a0abe7-1ba3-495e-ba0d-e58fc820137a", "comment": "Malware payload", "value": "9c50976541bf42d1416bab718c345c8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467232, "uuid": "b9bac3f5-a855-497b-839f-07eff839f85f", "comment": "Malware payload", "value": "85a46e5b3e5f93a456439d5b37fd3fd3e1717db2a7b5162c008a94e4ca796245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467232, "uuid": "ebdbda32-79fb-45ef-853b-c23f6c824966", "comment": "Malware payload", "value": "5b592b519d9fcdd2f1836b9409e46f2d31e4a1bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467232, "uuid": "6b4742a9-23b3-49ea-8cf2-a530a5347571", "comment": "Malware payload", "value": "7e9e29f9ee25bcf0cd38f40ccd71aa51192dc7bc2deb997b161d19e89674505f0c7e6f8e6392e8e799f748ddd8a82e8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467232, "uuid": "614390c0-6c02-4c47-b7f9-7f54dd6fe5da", "value": "T164B45C22B3F19437C1621B789C2B97AC9D25BD106D68A8473BF43D8C5F39681393B297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467232, "uuid": "79da361e-508b-4a27-aefc-6aeb13bfe470", "value": "8656a4885837fe2dfa3320c60e2d90fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467232, "uuid": "8bfbb3aa-842f-4f9b-a4d6-09d8c7bbfb28", "value": "6144:KRzn53atGGtiPgj9PqZlroaeKx+8un2r6ASRnyfWKtNUrp/2AW48+qUqmMkIHW2/:kzn53atnRPHhXKtNgZ8PcCRU4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467232, "uuid": "0f9646ea-1187-4ae2-8353-3c64ea89eee9", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467232, "uuid": "f118acb6-0fee-4d0e-a3db-dd48222755e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467232, "uuid": "0797a6b3-bb9b-4983-92db-43764a16999a", "value": "SecuriteInfo.com.Trojan.DownLoad1.2461.62.82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fb27e5-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495931, "uuid": "e42e0a9b-648b-4521-b888-64a34aaeea16", "comment": "Malware payload (Mirai)", "value": "80d34186cc8fe9518f1b5e3c13362441", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495931, "uuid": "c327a003-b42f-465b-bea6-c2707411a9b1", "comment": "Malware payload (Mirai)", "value": "8692103253caac4009280382164e80a6e02df4d4a15e860d060f7eb26a1ff6dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495931, "uuid": "51875e68-b90c-47a9-9ab6-3a73da36952f", "comment": "Malware payload (Mirai)", "value": "e4ee9df9c69a1c51856f5a709cfdc7f6e44563b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495931, "uuid": "4e0bd204-d090-4b25-8f00-aecd39b1615e", "comment": "Malware payload (Mirai)", "value": "b0253169011e3752f0b985b243eedd1c7638e46a1149b8ef9ebc58c8c910823d3a04b2686fb0885bb0df3c55aa758c4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495931, "uuid": "4cea6435-4607-4119-a43d-39d40855f929", "value": "T1F0A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495931, "uuid": "aab992eb-ae66-449e-aad9-e7b623ae6120", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fXHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fXHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495931, "uuid": "f0082a7b-4b18-402a-a25e-8d20347634b4", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495931, "uuid": "040b08ff-6261-4e6b-804d-4434a16d9748", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495931, "uuid": "4f24d88d-eede-43f9-b258-8714d737ed02", "value": "80d34186cc8fe9518f1b5e3c13362441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbf22b0-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1689491166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491166, "uuid": "b3461937-4dfd-46c9-a169-1b573c04b8a5", "comment": "Malware payload (Stealc)", "value": "07403438ec1629458ceee404001b11d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491166, "uuid": "0a32189b-288f-4e3f-a419-b7906c862aef", "comment": "Malware payload (Stealc)", "value": "86d03db5bc38058981a38f02f81530fd8fabb10d2911377ecdee221cc525c63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491166, "uuid": "1109b909-18a9-484b-91a6-b5d21e4ec875", "comment": "Malware payload (Stealc)", "value": "13cbf47cb54f9f4d5d9754ab5b39154819764226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491166, "uuid": "17bdbb9a-918d-4151-8f46-a9dece0c8e3f", "comment": "Malware payload (Stealc)", "value": "618fcc6ea0b0a5ea15ca08c8c26b7502a818009705921fa80a83bcb3784f50e4eae563cd82facd9563c76367097112a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491166, "uuid": "b08269d2-de9b-4187-a175-c4659c32dc95", "value": "T132255B2078A08872DDF660F906EDB531C56DA4B3D3E519CB56C90EFFE72C1C06A3658A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491166, "uuid": "b967aaf5-8299-4f52-84ee-0ef6cdffaab7", "value": "57423b5afae18340d4d20251213d0ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491166, "uuid": "0a6eccc5-39b4-480f-ada2-559e6ef74c9d", "value": "12288:hSm7/HZDpCZ+6VPwEiuHA4iBdu9L/uaeZKbwzqqp2GV1:MWXEiTlE9MuqoM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491166, "uuid": "417fea4f-7793-4893-8043-474a6f5ee41b", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491166, "uuid": "10d3a5f1-4e72-47dc-8f02-87c23d33450a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491166, "uuid": "b7f1621f-fe23-471b-93a7-8024cb781e6e", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72541232-23f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689522611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522611, "uuid": "4f8d25b1-0075-41ee-957f-7c6ae39ac999", "comment": "Malware payload (Mirai)", "value": "203c9ee0604190c82342cd5e9149025f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522611, "uuid": "ece134f7-78eb-40b2-8287-51e41d1fab3e", "comment": "Malware payload (Mirai)", "value": "8719866fc80c25aa6ff215c7dbc0a7f3f19ad1e0f7cde3893d15260285fae8e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522611, "uuid": "ffbf4eeb-ccae-43c8-b235-1574a5d77c2d", "comment": "Malware payload (Mirai)", "value": "4d0f95450c2ba13ddb9a99c8be97aa8fd3d15b4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689522611, "uuid": "5dba125d-9880-4f46-8cf5-72e8c10ddfdf", "comment": "Malware payload (Mirai)", "value": "490d9ca388086873bfbea2f4de047b49501597e779db187f9a1be43e729ba2c70847ed17615bafd85d285d450748280f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689522611, "uuid": "3e121281-4726-469c-89b0-7e38f3285afa", "value": "T1F7A2E01472A72E56F3ED183DC96A8357F9671BFC90F6327679401620C94D24A3E38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689522611, "uuid": "432eca2b-fa19-47d1-aeb5-7ee0b0878142", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjBPwhymdGUop5hO:TvQn4j+ZO5fKAlxlPws3Uozw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689522611, "uuid": "ca3dbbd6-e93c-4b82-9f33-673bdbba1526", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689522611, "uuid": "b3f4f6a8-dd9b-4c34-87a6-becd0acd44fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689522611, "uuid": "05ef7e83-3cc3-4baa-a007-e66f91fa5c19", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89afcb0a-23a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689490867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490867, "uuid": "49df2c4e-8d1e-4ce9-85ab-e81040c55b0f", "comment": "Malware payload (RedLineStealer)", "value": "721e955a8100f8488232088ca00bd2a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490867, "uuid": "e3a5f0bf-b48f-4b5e-8f82-1713522a389b", "comment": "Malware payload (RedLineStealer)", "value": "88619945ae8c773480dbabbff8f1979fc94d406d3ec795780189260a2a8ed7e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490867, "uuid": "ed2e9f3f-fa87-4da1-aecd-80fa6cb9b572", "comment": "Malware payload (RedLineStealer)", "value": "43a1f6f23fc042f7bbcf60cc8f01ddecd6b68bf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490867, "uuid": "c73cc244-e6db-4ba2-8af7-2d710a621726", "comment": "Malware payload (RedLineStealer)", "value": "6d37da07e9836cf52bff685ac36471dd6c673d8db5af6a76fb966cec7830aca4281fa1882870666647dc4c89fb287595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490867, "uuid": "6290ac5a-cf3f-49ba-b7e5-5c806108b996", "value": "T17E947D0392E17D59EA258B36DE1FF2E8760DF651CE49BB653228AE1F10B1072D273B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490867, "uuid": "5a302d66-e012-46ff-97f4-a4dde6b41805", "value": "171ca87c7d79f90a7375ae3063387bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490867, "uuid": "509d2264-676e-4cfa-9e77-def271015006", "value": "6144:xLbb9kYwhtCQ3aAUNK9UVoyV5G7iQyRLfj:xnb8H/PUNK9UVF/S8lL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689490867, "uuid": "56e8e35e-14f6-4601-aa22-8985a4a354d9", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689490867, "uuid": "f73d989e-d843-4601-895d-b37ec1a2aaff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490867, "uuid": "0bb7beab-efc0-4bf7-b83d-06f5ffa19dee", "value": "721e955a8100f8488232088ca00bd2a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d86062-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492414, "uuid": "ec64a57f-9521-45e0-9c49-f4634ee4f1a0", "comment": "Malware payload (Amadey)", "value": "84f14d13651fe1d6c02b77eca1655246", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492414, "uuid": "b690925f-bffe-419b-9e19-42830843c371", "comment": "Malware payload (Amadey)", "value": "8952758e0bc734bdd2485822a22b1d0a01ffe7954585aad8d6565107bcb4b69f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492414, "uuid": "d5ba17b2-eacf-4db0-a077-853a80a09564", "comment": "Malware payload (Amadey)", "value": "6a048fb775179438bb16091aac456a718a10d4c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492414, "uuid": "29823d21-0b5a-4a03-9c0b-6b94489256ad", "comment": "Malware payload (Amadey)", "value": "fa7a8a506fda3ec97f89a298f23cd5ed77c0e75b09015c63785c59c721d0fd67a2e4fe37ab824251100b66e013510996", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492414, "uuid": "8fc788ef-cb76-48eb-a0cc-aefdcc41a738", "value": "T1F2F41253E6D85436CCB267B24CF712830A3B7C75A978A3AE6315684E0CB26F0957172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492414, "uuid": "cb7f1549-8fc3-4d16-ad1c-cd5a0fd635a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492414, "uuid": "0134e70f-5d03-4894-81f9-2fec3031fe65", "value": "12288:rMrmy90IA1y84gToGcs9QMg0jbaCG941SG3GQ7r2UmazH4PyD8VI:xyj8J0n6QM9b/GcSoGQ7r2UmJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492414, "uuid": "502800a2-2707-4578-8c35-7836b35bad3c", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492414, "uuid": "519b6637-e700-4acf-b175-b10006389751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492414, "uuid": "1172a133-878a-4bb5-b842-10e9e13ed424", "value": "84f14d13651fe1d6c02b77eca1655246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b44ba9-23db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1689513461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513461, "uuid": "51353e40-a5ee-446a-a8c4-58ff4a78fb6a", "comment": "Malware payload (Stop)", "value": "f9558b909aab7ece09ffe2f672934081", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513461, "uuid": "3668b515-1427-4a88-9940-b96d676aa76d", "comment": "Malware payload (Stop)", "value": "89b81f7a9a57f90a7fed998522b188a027499f98e51c35f923b9312e7dd548c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513461, "uuid": "72f637bf-5b18-4450-953e-196f99dfa9a0", "comment": "Malware payload (Stop)", "value": "a8fb343aa1ee9b0946d90c3e6dd9ca9d129ab9f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513461, "uuid": "0a213b29-1c46-46cc-80f2-de5e65f45bd9", "comment": "Malware payload (Stop)", "value": "8879dc71fed83696a8bbc8eea56531a6d4b0377b5b633d0d571d0e3835297e4a2298ad830f476da9ead8fc21024fdf65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513461, "uuid": "28f2f6df-db56-4264-aaea-060f6162172d", "value": "T12A059E4392A13D44EA358B729F5FC6F8B74DF650CE5EBB653218DA2B00B10B6C263B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513461, "uuid": "61020def-3dc7-42da-b0e9-36ca4e120d9d", "value": "f3a1a6c560f808b7f46a078e7eba3d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513461, "uuid": "f0be7ea1-043e-441d-8b93-cc44aeeef613", "value": "24576:7TeulVfSyuBBqPi8NcSi2qdfYFv2/5tQF:7tbvubqP/NJi2aUePQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689513461, "uuid": "660b1c89-05e2-43d8-b583-74e6cfd7aed5", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689513461, "uuid": "d9666c8f-6e2b-4e88-b651-955cb5a71cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513461, "uuid": "85213021-efaa-42d3-b490-c24d359c5765", "value": "f9558b909aab7ece09ffe2f672934081.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7beeb37-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493629, "uuid": "c2f8cd0a-4cde-4776-aba9-5756336a0fb8", "comment": "Malware payload (Amadey)", "value": "f0a54a9b183122528fee45f65fcf1eba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493629, "uuid": "de8ef18e-37ca-4198-b766-5ce200bee1e3", "comment": "Malware payload (Amadey)", "value": "89ee0af8cca4d0c31c4bae069aa004b61812011ba049ff241e3dcf250e293417", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493629, "uuid": "2ddc0984-7bef-498b-bd2f-9c4f20ff654c", "comment": "Malware payload (Amadey)", "value": "7efb1bf589838215df13c0c74f5f374c121bf2ef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493629, "uuid": "50cf8acd-1674-4aad-bb21-767e1c25e365", "comment": "Malware payload (Amadey)", "value": "60f508510ec1e7eaf432e7caa69b90eb49f4081423086cdffb8ec019190c3497f9048e9bafb43de1369d61a0b0dd1818", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493629, "uuid": "e76d37aa-e966-49fd-9566-77b850453ed3", "value": "T149152343EBE49532D8B21F7018F603D317393CA28A7CA76F2745A45E1C63686763636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493629, "uuid": "7682ec88-bc28-4b01-a95c-e8c43530f7d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493629, "uuid": "ba4eba52-4e14-4b2e-bb90-1ee80e3a5a08", "value": "12288:dMrLy90WRIcNPT0uu+4NEpXlxXctDwBF4ypbraT8+sWiIhRCSv/jMcwNSNCyE3Jx:GynHNPT0xN8/XctURNN4hR5IrIN/xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493629, "uuid": "d2dacf6f-6757-4a0d-8e42-d8e13310c96b", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493629, "uuid": "8c470d91-2e2b-4d73-bf53-29537cf4585d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493629, "uuid": "16f58ad2-8527-492d-856a-24521a8d0d9b", "value": "89ee0af8cca4d0c31c4bae069aa004b61812011ba049f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0994db2-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491469, "uuid": "fc3b539e-e4e8-4d89-9dd6-e4ec7ac5e5e5", "comment": "Malware payload (Amadey)", "value": "1256f708f701022984164fbee3ae9434", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491469, "uuid": "a1db3d9c-9811-43d0-9416-f124a8477522", "comment": "Malware payload (Amadey)", "value": "8a68d5e2cebc81b87ef22282e4eb9af0b0776fe47cb4a1e39aaed96f3b5fa171", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491469, "uuid": "16a50c44-ce56-4111-8774-66f24f02ec1e", "comment": "Malware payload (Amadey)", "value": "4c7032f4aea509e7dab6d37602c79e2478611936", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491469, "uuid": "fc5c5eb7-f51f-4a4a-91aa-3e1ee61d47d5", "comment": "Malware payload (Amadey)", "value": "63a13789a7101f6bf743dcae53b65230145523a79c20371265743745155c36b3de33e8904681270624517021cbf66440", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491469, "uuid": "6151112f-0666-407b-8cc8-544a623220e3", "value": "T172F412829AE44421ECF413706CF347930B367CA5597483A7264DA95E4DB37C4B83ABBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491469, "uuid": "020bd9f3-349c-4603-9992-67937afe0246", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491469, "uuid": "2a4b7bc4-f146-47d9-9047-3d27d743e1a9", "value": "12288:8Mrsy90bwIM4l9soPBH8D0eRmQWnFQ3oas8VuA0Nb7+yZQvMou61+T:gyqZKcHM0ZnGYaxUA0Nbi+QkB61+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491469, "uuid": "99531f93-6401-49c1-ba46-178bdafaf11a", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491469, "uuid": "678cfefa-ce26-4fc4-82fd-3112485a19ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491469, "uuid": "54b7530d-7fdc-44e6-9f6f-948bb3d7fdb8", "value": "1256f708f701022984164fbee3ae9434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa770c2-23cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689507082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507082, "uuid": "611dc539-592e-4df4-a433-8e6828dc4b1d", "comment": "Malware payload", "value": "f81fce9a24f86bc909a66fe44cee29f6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507082, "uuid": "b1e84207-43f0-4067-8f98-835a06ae5179", "comment": "Malware payload", "value": "8b4c5be2959be0804af9a1cfd0926ac4af7f808135dd5a09e228fbb9f35a58a2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507082, "uuid": "22712832-7f23-42b8-abf5-e973b6661a4f", "comment": "Malware payload", "value": "55fab2ad2f9efd79e42385af29692687dcfc03c9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507082, "uuid": "1bab3f85-0cbf-4c98-b0cc-d52353057cfa", "comment": "Malware payload", "value": "9b09976eb8ce8f0fa190237798a8171f2297300e4dde49255e60cb345d3cf1cfcb015a923a1df1656d41ebb42a966dca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507082, "uuid": "5b23b13e-7364-4fc7-932a-10a28a6402b5", "value": "T1A9E533AB5285064D4E6BDA105F68C8EE606B162C8961C9B317BCEF40B744ADCB1D7CFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507082, "uuid": "32a07b2d-09f2-46e0-a731-6065d105a4f1", "value": "98304:a7X8Wdc0VfTES1YxKAMixiX8hBIwwRS386aQv:heHVfTESGFC8hBITU8he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689507082, "uuid": "0590ddc3-2645-4365-86d5-dd4665876c45", "value": 3156387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689507082, "uuid": "9ac5eb1c-053c-4354-8348-334b47ab47b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507082, "uuid": "bda69891-2888-498d-a739-8ecd4e1dc5bd", "value": "f81fce9a24f86bc909a66fe44cee29f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360020e0-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689529811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529811, "uuid": "fd84c4a2-0461-4cb3-9e56-dbc4be360293", "comment": "Malware payload", "value": "47b1c69899d7f2070a3533202c67a1f3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529811, "uuid": "cbf0e1e5-e9ab-4fbd-bdc0-f801d3773fd4", "comment": "Malware payload", "value": "8baa96e032253378a753979a14ee1cfbbe0a3cd868a77a538f05142b5b15538d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529811, "uuid": "ffeb2286-b960-4efb-9555-c5863bfdf868", "comment": "Malware payload", "value": "07748985158745f689fbcadab30db05be8421a9e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529811, "uuid": "f9faf8b6-b940-4d1f-93d6-e70a2e469f91", "comment": "Malware payload", "value": "b02d8e5ad7944bd0e895672996984a531d018c7e60e0cf47342a457911c58cea4918bedcf69772c7d8eb57b344ebe389", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529811, "uuid": "9c098e52-093a-488d-8d55-9ee9e342f3e0", "value": "T16DA37DC9E783D8F6F99701B1203BA7729733E83A2029DA42C369AD35DC51661DB1B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529811, "uuid": "b21f1941-7d16-42af-938d-9addcf3d49b9", "value": "1536:MrlD6gnBbMumOG38TvtzptKKpbdypT52Iclhb0PD2seXymSbyrxN1:cD6mbxG38TrtKKpbdy9Rcfba2sfcN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529811, "uuid": "cf760a22-b78a-4f0e-a1ac-b5dd31ed4e48", "value": 99784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529811, "uuid": "110419da-6f97-42e5-81c4-4d24a85b8676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529811, "uuid": "30df58e0-6578-4283-a2cb-19470b35bd6e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae2060c-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492695, "uuid": "d0c9b4f7-0aa3-406f-bcf4-67bbc74cd33f", "comment": "Malware payload (Amadey)", "value": "8d2646b8c7de6ed6e8ffeb8220861af1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492695, "uuid": "0d98b376-c00e-4076-8851-9f809c40513b", "comment": "Malware payload (Amadey)", "value": "8c791e603d67f45abc8ac3c89ce61bd53bde39aebfbd24ea2cbdaf81d4f64e44", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492695, "uuid": "a4b93af7-2277-438f-8f4e-550a77cb86c6", "comment": "Malware payload (Amadey)", "value": "c81abe2cc16515e6c6644926189591e012af5b9b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492695, "uuid": "4d2c0a17-cbb1-4a22-8f9a-d1a581ccbbb4", "comment": "Malware payload (Amadey)", "value": "85d25a35ed3b870d4456a7c487ff2d67b9dcc5e4431db5293234d593f1acd61d4ba0f3b668ebc2609e80c3a29dee380a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492695, "uuid": "1a744af3-bd2d-4899-a2e3-a736c11b790e", "value": "T1B215222377E81432D9BA57F059F603832737FCA2DD64C66B1A83A4461C72B88B931727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492695, "uuid": "f9df2246-3a35-44bf-b294-e1f016b055f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492695, "uuid": "ee704a86-9e45-4037-a332-b47ec111acbd", "value": "24576:9yI8L0HqA67u2NWFYMZYSndsHov1zAF3103nY:YzMqTMb1eh31Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492695, "uuid": "97250d74-175a-4c40-9a14-43346ffca8c0", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492695, "uuid": "06e1c382-24d3-4227-b59e-df806a35f3e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492695, "uuid": "97a579c0-6c4d-4b38-bc08-d51c83e7dc56", "value": "8d2646b8c7de6ed6e8ffeb8220861af1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b77a448-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492078, "uuid": "9083fb5c-7063-4476-ae17-9cd0812087dd", "comment": "Malware payload (Amadey)", "value": "3e90b5f8e46ec833c865faa7b4d1bc60", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492078, "uuid": "d65ea0e3-5902-48c6-9285-795efa43f48a", "comment": "Malware payload (Amadey)", "value": "8c7a2623ea0bfbad72a17add57243068958fa7289cd1319d5cbc3af84eeac07d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492078, "uuid": "ebebd28a-b014-4522-9144-92c3a8febfd2", "comment": "Malware payload (Amadey)", "value": "28f893f8c74afb560f3d58113176a6417d561fbe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492078, "uuid": "e062d11e-1186-4cfc-aff9-ef91d2b75351", "comment": "Malware payload (Amadey)", "value": "70050a07469b56c7ad29063dac67d82d9b782c5faf3d7914f1953f6fe3b7b958bef1386742e3636ce773fe902c0428d0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492078, "uuid": "4ab95397-f4a5-47c4-acaf-1107d9a84eaf", "value": "T1921523537AC95071ECB01BB168F713831636BCA099B803AB5B5DAA5E1DF3094B1717B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492078, "uuid": "4772ffa7-456b-480d-9a8b-a754afcdbac4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492078, "uuid": "e98db9ab-1808-4872-925b-7a3106e1841c", "value": "24576:zySEW8KZohbEF0cN+j+EQJBBenV9CSEsVTrPhc:G1WLZohi+jvQJBULCPsZrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492078, "uuid": "b5f33b83-ce87-4e0e-97c2-957572a546a0", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492078, "uuid": "274ddc38-7c06-4a97-88be-acc974eb9f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492078, "uuid": "61d99e95-6f7e-43b3-9f59-58de78e29f9e", "value": "3e90b5f8e46ec833c865faa7b4d1bc60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3a4690-240a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689534011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689534011, "uuid": "3c14890a-1a1e-4fbe-a4ac-0fbb1e88c707", "comment": "Malware payload (RedLineStealer)", "value": "30fc960a44d4d5cb19e06e814418b0af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689534011, "uuid": "76817e23-96f7-4cb0-bb8b-5d138a051793", "comment": "Malware payload (RedLineStealer)", "value": "8cc35f2979fce31089cc162d74b03dfd0eb08e3c928674e89114a65c1691008e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689534011, "uuid": "757d64cf-d218-41ab-befd-fc65add9498d", "comment": "Malware payload (RedLineStealer)", "value": "cff299ed6b01e5bbf3c04184eae22d9710dbab20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689534011, "uuid": "107a6255-d697-472a-bece-a9e67cc24c7c", "comment": "Malware payload (RedLineStealer)", "value": "ac02192f99b8191460af5cb6ca84eebf6a3bb8b893956892b54c3866010749058efedb3e15c2f690e5d3d32d07a18f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689534011, "uuid": "f2a10ddc-bc2a-4daa-94fa-2296d96bc018", "value": "T1A9D40103BDC1D8B2C0621C361B695B62753DBE202FA98EDB77D42E5DDA315C0E7316A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689534011, "uuid": "1bd51ff9-df04-4502-89ea-8bbc9c97c13a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689534011, "uuid": "52f8ee20-460e-4c24-8f30-fcb622af7b60", "value": "12288:+ToPWBv/cpGrU3yDT+tjIAgEKeJZZUdCV9U:+TbBv5rUlIdeJZZ1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689534011, "uuid": "76ff6422-a2a5-4964-b6c9-77a6fcb3de83", "value": 645287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689534011, "uuid": "9a42a18a-70af-430a-8305-9713ec82ca27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689534011, "uuid": "cafa54b5-13f3-4a07-9147-3810974cec1c", "value": "30fc960a44d4d5cb19e06e814418b0af.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423ee186-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493324, "uuid": "30be4c02-c500-4f50-955b-cfbf8572bb67", "comment": "Malware payload (Amadey)", "value": "659d4d161c522f889d6d679b9cdffc98", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493324, "uuid": "6e38aaac-aef2-4ecc-b736-198791f1041c", "comment": "Malware payload (Amadey)", "value": "8ccf7f2a7db6ca2fcd0043176da937f1b0a7ee1598ad991f84fefcb224640c20", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493324, "uuid": "98d8b9df-68ce-449d-81d4-d8b15b528cc2", "comment": "Malware payload (Amadey)", "value": "42c5e6737b9bc97c8908d1dab4174b473d9ff1f9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493324, "uuid": "5c123189-c628-4241-a941-507706f4027a", "comment": "Malware payload (Amadey)", "value": "f893add9d807289ea07353d65e34f6d6fb803b1ae8ff5b6919c4338fb40a053bd32ea0bf594057cb13d0c74389ffad90", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493324, "uuid": "10a413e1-c5da-48ab-8f61-9ec0bee95ec0", "value": "T1C015232397F944B2DEE52B345CF702431E31FC615A79B3BB3B41A899097228475713AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493324, "uuid": "afe8ee7c-7515-48c0-90d2-ac240a621c54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493324, "uuid": "e9233d7a-47fd-4765-86db-19c52afa7a51", "value": "24576:iyl311qO6DeXSlD9rDEECuRtCYaWeAtXoHVZ:JF1QO67lLRcYZeE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493324, "uuid": "2b377ce2-bb4c-4614-ab76-48f7df6ee900", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493324, "uuid": "403044b7-31ee-4bdf-8206-0db0ca3c6c63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493324, "uuid": "625ff2fd-f5cc-43a5-8b17-a80f82341428", "value": "659d4d161c522f889d6d679b9cdffc98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58020327-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529868, "uuid": "995eeca2-18f2-4356-9d44-e905a241cc8f", "comment": "Malware payload (Mirai)", "value": "50ae1b45fe5f57f3c039c245ed530607", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529868, "uuid": "bf71eb57-9026-4277-8d23-523d97aadc38", "comment": "Malware payload (Mirai)", "value": "8ce22781e88639d40d8b65d79fc0672778d0c03ff613aa0767251b5f8921f20e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529868, "uuid": "1d6fd648-df36-4f03-838b-9ceb4cca7f84", "comment": "Malware payload (Mirai)", "value": "6bb6739d288e5188f25222f48fc9e3af09deb20d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529868, "uuid": "f4101990-f35d-462b-8e09-f179658139fc", "comment": "Malware payload (Mirai)", "value": "d62eb29c9971e73a53aafbad4184a152fc31b2ad08304daa2fbc2c990f310213f7350937031d944c786fb209781bd338", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529868, "uuid": "313c89c8-4e31-498c-8f37-fbdb2f646a18", "value": "T1F9D2E12CD95D7D05CAAD3E7A51CE56B6398C70C0A35DB6CE17268448B627B87FC0B0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529868, "uuid": "f5747f9e-589b-4deb-becb-b91d390be0e6", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNHX4AJbUWU6:kbDs06t4BEub4sU/MbUH1Y6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529868, "uuid": "088fe1cd-ed18-4cce-af58-a61f41ba83aa", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529868, "uuid": "d796c2eb-f5ab-4792-9ac3-18337b9bfbf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529868, "uuid": "cb2837a7-8e53-4c47-8580-c60d6fb46f29", "value": "50ae1b45fe5f57f3c039c245ed530607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39477511-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493309, "uuid": "b3c89154-a1e9-4384-88ae-048d3a62bc5b", "comment": "Malware payload (RedLineStealer)", "value": "e74d27a23caf1316c99c25b8743ab6f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493309, "uuid": "1e4dccda-8197-4f14-8286-90f187db4dbf", "comment": "Malware payload (RedLineStealer)", "value": "8d023fef7e456c86ca58cc39190c9af5cdfb759f13952f663b03c029d42191b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493309, "uuid": "3a446877-c6b9-4d7e-a200-0612913c5845", "comment": "Malware payload (RedLineStealer)", "value": "463feceb3c35abd318b75aac05a0879160af32a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493309, "uuid": "5852aa9d-edd0-4fef-8a8b-d667ece23451", "comment": "Malware payload (RedLineStealer)", "value": "d5eec959a00d8fcce0dfd5f9c4d056006d84bf2581b61f5fb600650d61b2ebdec9245cd71bfe6848a59b31075a80413f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493309, "uuid": "7c3fa36c-33bd-4352-b2cf-d50eca18982e", "value": "T137152353A7E861B3FC711BB148F602931B357CE19A79835F3382A99A1C723909171B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493309, "uuid": "cea86af0-8d45-460b-b82f-ac3d46e07214", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493309, "uuid": "560cf995-d619-46da-9969-d0e7cf6a54b2", "value": "24576:HyPdhRHHlfijSfk2TeN0bxpqS7UvjWjPdXRfbgrwdLym3h:SVhRVfk2T1bxppU7m/cr0y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493309, "uuid": "3fbbce9a-d52c-4545-be36-6440c2c818b8", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493309, "uuid": "a0d8b0bd-3ec7-45ec-b9a8-f88984a1d787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493309, "uuid": "d3821f1a-b549-4244-9c8e-3f21b22d49fa", "value": "e74d27a23caf1316c99c25b8743ab6f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710a91c9-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492114, "uuid": "69af4a78-cbf4-4ddf-95d5-ff84fc5986bd", "comment": "Malware payload (RedLineStealer)", "value": "5dadff83db4a29c664c879dd6914620c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492114, "uuid": "cb4205b9-7b6e-4082-8087-1cf33cc19814", "comment": "Malware payload (RedLineStealer)", "value": "8d92f2b93e45a5c90d0522bf5fd662559d413aca7d3a991f38c7114b550f794b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492114, "uuid": "903c6d23-ea0a-4ea0-8115-9945ae2c720b", "comment": "Malware payload (RedLineStealer)", "value": "81a1c1d6de714faf97afbcd9ec71b8e67c8430b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492114, "uuid": "ae50c569-568a-4fd0-81c1-bdb79d4a5a46", "comment": "Malware payload (RedLineStealer)", "value": "063cf29c8a11792a97c0454b934415f44b482ad0f1b73dc66a34a561d31078770ce76d7c8ef3e189318ef7e134d1ede8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492114, "uuid": "3c3cf4aa-6e5f-402f-9614-9f71ee2a5060", "value": "T1BEF42203B7D91837DAB92BB168F712830E36BD651C30C7677282A9AF0D726C4A575327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492114, "uuid": "6aca9dc2-2c23-48ce-bea4-f7c5993b4b0c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492114, "uuid": "117a3f26-332f-4b9e-b9e7-d7877e8fad79", "value": "12288:IMrMy90wx1H+7chM2rEAp5PNvF1oakYL9m9hvGFU2Us7Lj+5S4Z3:Ey1mItppNvnpOhvy9Uz5Sm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492114, "uuid": "5a679414-268f-41b8-a776-e4239bcab014", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492114, "uuid": "44acafe4-3887-49f3-a81c-1bab269e020f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492114, "uuid": "acbaba2d-344f-4be7-a54e-ea13c04ca347", "value": "5dadff83db4a29c664c879dd6914620c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62931715-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492090, "uuid": "0bc17bf0-2cbf-486a-8ac4-8157ee3dad5e", "comment": "Malware payload (Amadey)", "value": "5020dfb2e862ce15ea4ef495f44e9247", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492090, "uuid": "6bf28209-b88d-4740-b118-a3f735e052e4", "comment": "Malware payload (Amadey)", "value": "8dbd39ac590497f05eb8203d914d57a87fc608aef833b96dba96630e516d5a0f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492090, "uuid": "c3785b32-1408-4e2b-8f37-830e918b23bf", "comment": "Malware payload (Amadey)", "value": "96b2491ab3026040b9da07688c3b1aff008c4f01", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492090, "uuid": "45dfdf5c-2afe-40fa-9a8d-6f079a3f00af", "comment": "Malware payload (Amadey)", "value": "ce7a2547648566a58824134ad223a9a75142d6cbea6d7ff4b28ff04edcf850611ce7078b2756165783d2bc9b923be2c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492090, "uuid": "5f0d96b2-a299-4ffc-8484-1fd059ed8b43", "value": "T181F41296DBD96433C8B22BB058F303C7093B7C621D71966B1786A84E1DB35C4A5B1B3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492090, "uuid": "8f91509f-7d32-4ea5-a5ff-c65df27d742c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492090, "uuid": "7791b46a-dcf8-42ae-be65-90ae9bd7708c", "value": "12288:FMr4y90Wxifb3h3ANCd6Al3BdoluJGFAxkdFv5wIheWDSKMiTxKAGHtvD3yXoR5F:RyzMjmN/0BGFvXhwIheWH/xGVNR54gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492090, "uuid": "89ae4566-e31f-4c74-a5ba-e9f9aaed6866", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492090, "uuid": "a6de2478-9155-476c-af69-01239dcb8ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492090, "uuid": "23085270-dcb2-4bb1-b996-e3f98aa222ff", "value": "5020dfb2e862ce15ea4ef495f44e9247.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1615f6b-23f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526206, "uuid": "33fcb583-7848-4c73-8ac4-376be68d4673", "comment": "Malware payload (Mirai)", "value": "c68d17e74c3085ff8a830338331bb1de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526206, "uuid": "eaeb350d-cfb3-458d-9b17-e1fde6202593", "comment": "Malware payload (Mirai)", "value": "8e0eb5fe7a77b5ee352dcd38642912ea5d34fa3e55c99b01258a935b9e75b401", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526206, "uuid": "ccd23171-d352-4b8c-97ce-598753d176a9", "comment": "Malware payload (Mirai)", "value": "f12646cde5676ee95938123bfcc392ef853504e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526206, "uuid": "e164f73b-5dd5-44fb-a3df-d2246a02ec93", "comment": "Malware payload (Mirai)", "value": "68c95b2ab6f6cb38d1709cbf8ce82d85592d76841ab85a0f434f66faddaab2d5bdedd3788c314ad3fd32677a31de94a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526206, "uuid": "8dbcf622-18e6-46ca-b6c9-bd84ee19a8c3", "value": "T1E3330272677E29D242B09777BC33AC5AA69C17E89D6730DA2CF0551577C18024FF2282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526206, "uuid": "dfc07246-70b7-4d1c-9f7d-a98a69d30419", "value": "1536:j9O/ZMAXIxNUk0RpBwBLcPqF1aBexo4opKZbH:j9O/ZNKyd0LGqFUFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526206, "uuid": "80960c81-c562-4b30-803b-2fc2b6da71af", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526206, "uuid": "8be12611-e407-4c38-81fd-ab04913b823a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526206, "uuid": "0d3a5e80-183b-4dba-bb7b-80e9b60c99bb", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf9d01b-23be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1689501154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501154, "uuid": "7af853ec-e4f5-402a-9deb-82b7883cfe7b", "comment": "Malware payload (Glupteba)", "value": "d52a5f6d591ea015b18fe22d2dcd92f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501154, "uuid": "082201c2-4d2b-4bf5-827d-349aaa8f1ef3", "comment": "Malware payload (Glupteba)", "value": "8e76b8195a7b4b91ad0d6f1ce7b6481dd6dca9078c1c74ec490a35ad3ccf8c42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501154, "uuid": "0fb82b02-b7d8-41d7-b3f6-ffadab7d9b23", "comment": "Malware payload (Glupteba)", "value": "109e3631e9468718b6849ec32bb95b9d40b2faa2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501154, "uuid": "09c2f3bf-39c0-4343-a3a9-ffe9503b4e48", "comment": "Malware payload (Glupteba)", "value": "430609245b6fdc3b407e06e6bc581d9334709b855bf15ccb53c544d481347ea926fe0fa011b2bbc0c25849556ec8a842", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501154, "uuid": "df227946-84f3-4be0-8141-57acf0df890b", "value": "T14616234396F1FD40ED1ACB324E6E86F87A4DFA402D4A3BA5225C5E6F1073972C2A3715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501154, "uuid": "3d9d577b-5587-4373-8514-aec23a994299", "value": "0af0ab32fec6d387d477684bace95bf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501154, "uuid": "e4dd86cd-2dbd-4805-bf22-fd1f091b10d7", "value": "98304:eZVZxvb2cl6rdqoeYZOnrisna1w2AGTibHghBCndzEYRqIrKFKGw:erZxvb2c0rd1ZOnrisnf27mrgHMz1RqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689501154, "uuid": "72cbf36e-2cd5-4d40-8166-6cf75c090194", "value": 4348808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689501154, "uuid": "3df21f8b-1caf-4caa-b953-19600a633ce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501154, "uuid": "afa0794e-66e6-4149-9fd0-e7bd3aeb336f", "value": "d52a5f6d591ea015b18fe22d2dcd92f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c207f1c-23fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526976, "uuid": "81967cc5-3295-4408-9731-ef72d96f2f36", "comment": "Malware payload (Mirai)", "value": "18a0faddfebca89cb133bfe2b2f10687", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526976, "uuid": "00ae0436-f0be-479b-aa46-c56456d16498", "comment": "Malware payload (Mirai)", "value": "8ff5d89b0a87b106daffa6fd4b44c82f911c045d1c7f39b7b428a08616018a89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526976, "uuid": "c1b54d3d-915f-4023-a738-a16ea7826719", "comment": "Malware payload (Mirai)", "value": "973d0a19289fb7d8b444f070f1a060a16879d2da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526976, "uuid": "f7c2308b-28c7-45c8-8890-e7c2d6275d1f", "comment": "Malware payload (Mirai)", "value": "f28d7affb0867ee7a5e98f59803ef4c9a37aa5cc35a69f829e04e00111d562a894fa997bf33c78e9828127262b003036", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526976, "uuid": "2649d4e9-fc93-4ced-90cd-9307979b3af5", "value": "T171D2F19D76C262FADDC9CB76300E4075B08A789D63F5632A3309CE43066B341DA61D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526976, "uuid": "a9419c14-58cc-4c4e-8585-cdf1197ca320", "value": "384:Mod/PxEDLd2TwcAzT6lowYcEeqsM9udC4h0LwnoAGgkEtojN6fQKTBNyi:rlxKd2dAKxE7sMEkCBFtoBOTSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526976, "uuid": "fa4630d2-0cf0-44c5-a0d3-72652f5a6fb8", "value": 29448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526976, "uuid": "74b92d98-a258-4518-89cd-b24d9418cacb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526976, "uuid": "4296d6b7-139a-4674-bd2c-3a946ce92336", "value": "18a0faddfebca89cb133bfe2b2f10687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb55f13-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491463, "uuid": "ebfb9d61-faf5-4449-8407-cdc5ae0477c6", "comment": "Malware payload (RedLineStealer)", "value": "100ce6e46698ceab988f306b05f88998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491463, "uuid": "be334063-af3c-42c0-b296-1eae3d7ec6a2", "comment": "Malware payload (RedLineStealer)", "value": "91b4d90a5c0f3762463bf1fe9c0db1d716d1d862df473f7f55ed320d84a3f059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491463, "uuid": "acaa1487-ea1d-41f3-9656-1011949f8789", "comment": "Malware payload (RedLineStealer)", "value": "a112f1f9810b7cb1f0ee51624e173dd5c42e6942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491463, "uuid": "07f33bde-b805-49dc-850e-b8bec962b17a", "comment": "Malware payload (RedLineStealer)", "value": "dd4c7b4b8ee2fc6d0c59f2416d5f162876aa2393f3aa4d212db1a57db25547c3e873c4c25a716cff679e334c28d73a97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491463, "uuid": "b4547dfe-2313-4846-adbf-92984b8ea153", "value": "T1D7F41202FBE8C472DDF13BB468FA02571A35BCA19DB482A63704189E0D73654A536B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491463, "uuid": "102a725a-9b96-4e19-b29d-db29eb937ae9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491463, "uuid": "d2f165ae-7e00-4777-9ce3-7e112332bb16", "value": "12288:XMrVy90c2UWiQ42ZeLh2hfTYNDsbhiFhHb1xlkzvwNDCGzGhPJLzvShvE70JnB:2ybl4eFq/Ub1xS+DLzGhPJLzWJnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491463, "uuid": "119cc508-3cde-4e9f-a722-f59c268bf1c7", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491463, "uuid": "f68c0b14-70a4-44bc-953b-b96bbdf550fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491463, "uuid": "936b7b6f-b4f2-4077-a1b7-95e2ba1e1efd", "value": "100ce6e46698ceab988f306b05f88998.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9441f32a-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493032, "uuid": "b2157cda-06a8-4e11-b66a-151372d59ea8", "comment": "Malware payload (Amadey)", "value": "e1f17d4e3104255d7e5f10c598873421", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493032, "uuid": "a22df8ea-663b-49ec-9bc9-ef76be70d95e", "comment": "Malware payload (Amadey)", "value": "93cc0b218af5fa6bba939d6cfd87fbd1bedd0a1a8b202f41682f558dd2465c99", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493032, "uuid": "d87891aa-9752-414b-86e2-13438abc4188", "comment": "Malware payload (Amadey)", "value": "6845d786f99f6c3f273a43429cd4bca06cad4236", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493032, "uuid": "ffc4fe08-57fc-4f51-a912-96439e81b729", "comment": "Malware payload (Amadey)", "value": "0011c3c2911a59b937a1ac25d50c5ab9e82da189024a5015bca5cb2eeefbb688fe7a141d75a3ee4cc7371926a10c1c0d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493032, "uuid": "ac634cc3-f9aa-45cf-9c64-5e175e01b07f", "value": "T18B452342B3E890B6CDE607705CF613C31B37BCF54924A37B2688981C4DF7582A5B5B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493032, "uuid": "6f82af8e-feca-4c05-9640-893341fef592", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493032, "uuid": "4d664ec1-d50f-4378-bf0b-9c717e742657", "value": "24576:hyL5I4dCj5jF0mUmqQK7E2UXuDZQxIU+CChc8eE8wGaM43DB:UVI3jFPUBqe+xrYcg8wGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493032, "uuid": "bd2d6273-d2b7-424f-a7c6-87c4f1181300", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493032, "uuid": "af0700e9-2128-4068-8c32-5cff394f9b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493032, "uuid": "1a0acc8d-6724-4a11-a5a2-ca25f5724ee5", "value": "e1f17d4e3104255d7e5f10c598873421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8127ecdf-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493000, "uuid": "72a62e87-070d-47e0-8eb2-cfa6cbcc0cd9", "comment": "Malware payload (RedLineStealer)", "value": "c12748db90046b82b19eb35ffb7062d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493000, "uuid": "9479be67-a558-4c5e-a3d1-aa8217e9212d", "comment": "Malware payload (RedLineStealer)", "value": "946fed7f77da1d255b9d04cb0952c91e3665b657221a11b5a971a74be3f8b0d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493000, "uuid": "775583bd-c940-4a88-93a5-4bb2caa3c551", "comment": "Malware payload (RedLineStealer)", "value": "8e143b7145346745f5794ebe663d0d05ae4b9aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493000, "uuid": "e5ad8438-7f3d-4c50-8f3e-62e880c30bbf", "comment": "Malware payload (RedLineStealer)", "value": "ada89364b50a90bcb68c9dc9eb6f47298f5108be3c1010c89cda08e7ffd78d10143a0b44e6e80e76a9c78517ee27daa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493000, "uuid": "54a967cd-92bf-47ca-b0fa-4c6805ff7128", "value": "T142F4239BB7E84073E8B92B705CF306930B3DFC615A78412A37D6994A4C72AC4E1B1367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493000, "uuid": "44815859-2471-42c4-811e-19274e81a6e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493000, "uuid": "31cfff0e-05b8-49b9-aaba-998f92363ced", "value": "12288:SMrOy90YfhEcymQ5gBh31BCCNd2u18lhQtfuqBq+v1w39gwutPDwYpzFR3h728Q2:oyfuc7Q55CNylOfuqB2tgwGD3BcFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493000, "uuid": "fa9d419e-231a-477d-a351-db3283b1fbc1", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493000, "uuid": "8cd0eb1f-0dd1-4150-9753-9f5f842ecf9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493000, "uuid": "2a7051ed-612b-417f-8f91-a0840d671acd", "value": "c12748db90046b82b19eb35ffb7062d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d60722-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689491906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491906, "uuid": "05ca9c1b-ccb3-464e-8ae4-a3ea0a4427a9", "comment": "Malware payload", "value": "d1fc4612e7d824d63437824913096dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491906, "uuid": "25e022b5-3aa1-4c27-bf4d-0f0458d7dd95", "comment": "Malware payload", "value": "954150cd83146ac771a7c4ea1c572cca82ce712187a2e05e512e5a597d3f4a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491906, "uuid": "3802176f-e77d-4ea0-abb0-01f261fcef8d", "comment": "Malware payload", "value": "26ce99e82855cfc045d081de08c21a7afbfba4a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491906, "uuid": "8cb530a5-2fda-4ed6-b930-cc13bb681c35", "comment": "Malware payload", "value": "e897207757649a15c06eb5d7c0d18f9b00cf6ae1d477abee2dd3a6db76a8383ef6828eec63efb677836b681a94d8b1bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491906, "uuid": "89fb894b-e6d4-4ba6-9d59-fdaccf0f658f", "value": "T140D45B316890F2E1ECB260B655FCB553209C5EA03BE999CB03C61BFAC1514C36677AED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491906, "uuid": "921d7c18-6a2e-46e3-8503-896538b0de8b", "value": "57423b5afae18340d4d20251213d0ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491906, "uuid": "c61ae7f5-d649-4aeb-9bd3-9275dd46f179", "value": "12288:USiBTTZDpCZ+6VPwEiuHcciBdu9B/uaeWLeZk5fdX:RMnEiHpOJh5fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491906, "uuid": "c1fc5e87-a049-4022-8bc0-b7488cf7459b", "value": 651187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491906, "uuid": "a9c75106-1edb-41bd-a05a-160378ca64d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491906, "uuid": "a34bbe58-f1b0-4fb7-9553-6b5ff4f76220", "value": "d1fc4612e7d824d63437824913096dd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa185aa-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492702, "uuid": "1cc85682-289a-4bfe-a104-6f0c6f22a37c", "comment": "Malware payload (RedLineStealer)", "value": "922477130dfb607e7db9a9b5e9adad1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492702, "uuid": "9e90828c-1e82-4014-aa95-c760752f03a7", "comment": "Malware payload (RedLineStealer)", "value": "95aa0b6b93617c84c86944a14200bbbb9e32c9646baaf86c3e538f59863bcd0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492702, "uuid": "bb4ef8e7-0ea9-45da-b00c-8a9dec51eec3", "comment": "Malware payload (RedLineStealer)", "value": "742e06204ff85da6ff400440c017abddb9aeec37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492702, "uuid": "57f70708-bfac-40ec-8142-af83aa358c07", "comment": "Malware payload (RedLineStealer)", "value": "3ee729c03214cc8fc89cb6d4a76f585afd898279f0106aa83a63bfb1c72d8f79a7a4f7dac4f222060837f94c536c7df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492702, "uuid": "83b203d1-2093-404b-a070-7d798adda7a7", "value": "T12E452313E2E00522C5F21B745DF602D3523ABDB08D28876B37C6AD5E1A73694EA7137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492702, "uuid": "bfb15e4f-4140-4fe8-90b6-ea93cb08c0a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492702, "uuid": "ea8bd744-6cee-4617-8cb4-c4670ea83d06", "value": "24576:Xy5AqsMRGYD4RdYl7UhSVkPZGqhvfLjQf:i5AqsDDi7pG4IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492702, "uuid": "98cb7472-0cfa-4576-86ed-ab297c03c9eb", "value": 1213440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492702, "uuid": "5ddedc11-7d92-4939-8406-91456cb672fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492702, "uuid": "10abd405-20fb-4f03-ba74-6b52d611d41c", "value": "922477130dfb607e7db9a9b5e9adad1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b95640-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493006, "uuid": "719a2dba-1c84-427c-899f-127fbfa650f5", "comment": "Malware payload (Amadey)", "value": "c35f7c60d22ea19192092bd67c48efb2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493006, "uuid": "f29ea017-42d1-4177-9ea6-c920f1b72960", "comment": "Malware payload (Amadey)", "value": "975a670cf49f0e115502ddf2ca8b223cc55f7d943a5abc8e8e4fd3e7666e9b8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493006, "uuid": "4f79345f-1a5f-4661-abe9-5c88710459fd", "comment": "Malware payload (Amadey)", "value": "d4f8ca9a010f1567cdb50f10b7d6ab82ff0c600b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493006, "uuid": "a82b4b22-78ff-4de8-8804-03c1c59a75e9", "comment": "Malware payload (Amadey)", "value": "8f98d34de3fc393e17abc8c4f472b87dc6d4bde080e7f39a193fe06a4b7f925d9a38b4ca85786665b67a69fede5cceba", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493006, "uuid": "b8fe4feb-58fb-42f9-8e22-723532dfc61d", "value": "T1C6F42253A7E84172D8712BB448F602C30A327DA57D38579F3395985E1DB3B90A8723BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493006, "uuid": "bde70e41-82e9-4ae6-8168-83a55ddd0b1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493006, "uuid": "1c87106a-8e46-401b-80ef-b279a953fe11", "value": "24576:Uy8df2L2tOYhvVmPmtIWD6OWlF7bxcsnO:j62L2uPRWDM7bJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493006, "uuid": "edfb72fd-d553-401c-ac42-bd1efd2814a2", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493006, "uuid": "6e75784b-9bb8-4cb0-9627-bdc34ca8b663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493006, "uuid": "3e813994-4bf6-456f-8da3-aa0245a1f5d7", "value": "c35f7c60d22ea19192092bd67c48efb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9daab49f-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493048, "uuid": "7b2e28f5-7f33-409d-84a3-4b593ed19444", "comment": "Malware payload (RedLineStealer)", "value": "e68aef2112099992d8bd731049c04335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493048, "uuid": "1bb1fb1a-9ca9-436c-830e-be1a0623842a", "comment": "Malware payload (RedLineStealer)", "value": "98343c36e77645126144c5ae6d93bf1db96482a03a5e2266da75b01beac4de7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493048, "uuid": "f65b7e59-8ab3-4cd6-b186-030d28ee3c8c", "comment": "Malware payload (RedLineStealer)", "value": "20a53ae207fcef20d2e5ae78f411abd8f40ec0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493048, "uuid": "dad4bcb4-3fb4-48c6-af48-b86d2f9f4fd1", "comment": "Malware payload (RedLineStealer)", "value": "8c482a25b1e47a5063b2de54df551425f566356ac4ed66ba942a81882271d7b63de41f348fac69cdef86755cd5875c80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493048, "uuid": "b4d3748c-82ad-440b-bf80-95bf05ecc4fb", "value": "T1EF152342F7DC6132E8741B7018F606870A33BCB54E29836F7749D9AD2C71A89B53972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493048, "uuid": "11099f8c-4cd1-4ae5-8d7c-9d3248c3ca2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493048, "uuid": "1a067a70-14f5-41a9-91a4-ff6ef47568d0", "value": "12288:eMrHy90t2XzWZjZdv7BgmC5jCcjHNVd/HuadfuKDEpSfhwzIjUi+yrn9Pqu:xyDXcZdvd0jb5v/Nwz1i+yrnlqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493048, "uuid": "0f003a3e-87aa-41de-a40d-05a35a45ce31", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493048, "uuid": "6666c329-5a8f-4337-b8a8-919301fcca55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493048, "uuid": "e9438536-cdab-40ce-8a04-84a590397d87", "value": "e68aef2112099992d8bd731049c04335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd54e7b-2383-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689475711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475711, "uuid": "d77b27eb-218d-4122-8a1e-4cc424baf4ff", "comment": "Malware payload", "value": "7af2b9b0e4f1ce5117a5e451374ca178", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475711, "uuid": "838bb1c5-13bb-4e16-b697-a27e2efb5868", "comment": "Malware payload", "value": "989da057a63d68ef90e09d91b545edb9b4e57ee5b55dd26a8467c1f9e1432bea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475711, "uuid": "151bd543-93b2-4c11-96f4-5f80521472c2", "comment": "Malware payload", "value": "59e82f54edf1e25ce0a35eead73098327ca05b59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475711, "uuid": "c9fcf74d-efe3-4e24-a6f2-f44a0366e614", "comment": "Malware payload", "value": "8a38d9d3dccaea9a8415e7da4053e1b66dff17662aae038f355275ece7ecedaeaa778bc2bd5e1413a6d5277020285842", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475711, "uuid": "a516183c-02fb-43be-b547-04f2f74ddf19", "value": "T19CE2E14E90D66DA1C22F0DBBD57E23B56C64B4E476980BD747025E88C51FC02B5DE0BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475711, "uuid": "9229821b-03c9-4b8d-aeb3-f12d37a4c081", "value": "768:zDLiTHtK/LJxyIWPbZLzjRJgG9FwCnxvc5EzpWRx:zD2MVxUzZvdyG9FXnxveE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689475711, "uuid": "d54ca43a-9e21-49cc-a32b-63a7908357d2", "value": 33776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689475711, "uuid": "51e429d4-9f76-4aec-a979-41bb839c7c62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475711, "uuid": "3473fd65-d65a-4be9-bd4a-9888305f350a", "value": "7af2b9b0e4f1ce5117a5e451374ca178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43dd125-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493623, "uuid": "585a9a63-e95f-42ac-bd47-c9821a5f1ac8", "comment": "Malware payload (RedLineStealer)", "value": "b6db32fa07281966c5dac21e8d853645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493623, "uuid": "8a610005-5366-41ba-a7c9-f008c895b2d2", "comment": "Malware payload (RedLineStealer)", "value": "98aceb71c23824c45671abfa7c1379cf69c7bda30c050af7abb9de7fbaca7d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493623, "uuid": "7494a074-650a-496b-86f8-e1d5a82396e5", "comment": "Malware payload (RedLineStealer)", "value": "712bd5f848c9995dca6074b1cefd8147b3efa056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493623, "uuid": "e920415a-6476-4204-93fc-3d8dbe80e6cd", "comment": "Malware payload (RedLineStealer)", "value": "5b24ef09f538c854be76f8ba659a76fd26c2e718c0d1c7ab3662e1ca24d3126263a8a0b20c53200ae68ce9589cba80f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493623, "uuid": "e9f1ebe9-071b-43bc-94b2-807ccf2cc403", "value": "T1104523823BE84073E9E11BB440F313930A34FD5099B9C76B674AE91B0972BD4A93576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493623, "uuid": "a789f682-bc36-40e3-8323-2dd3090705a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493623, "uuid": "b6a6d02a-5266-42a3-861d-5773d6610c09", "value": "24576:1yqNYlyTdlkQSNxkBl1Oe+VEyI54Mzz1y2l3VRdfvbC:QJaUZNxsB+WB54MzJT1nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493623, "uuid": "1f654e12-de5e-4965-9a2c-889288d2da2e", "value": 1214976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493623, "uuid": "c5007fa8-f7d7-4e02-8f7a-41fd95e75cd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493623, "uuid": "efcd27db-a8a7-4b57-a932-875d1a3d90b3", "value": "98aceb71c23824c45671abfa7c1379cf69c7bda30c050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a939ae1-23d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689512558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689512558, "uuid": "34f69bbd-b956-46f0-9675-3f5edc5c99ff", "comment": "Malware payload (Mirai)", "value": "e64d7b08cc00ff46789373686d78fb06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689512558, "uuid": "4c5f9431-af1f-46e6-bb74-322b3e681645", "comment": "Malware payload (Mirai)", "value": "9c7b731cd898b9066a313cd5c7bc382da2c1f7ebcc418cac5f70322d940baa52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689512558, "uuid": "fe7c1c7b-a898-448b-99ed-725443aead88", "comment": "Malware payload (Mirai)", "value": "a723f9e360e011b405cd4723d529ff122dbb9706", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689512558, "uuid": "aa5c294a-5481-4dd5-945f-948c15799aed", "comment": "Malware payload (Mirai)", "value": "12ec57e23df4845a2c169ed3c95ebe990c666e4b185652fa94115191b072d26607ae0359e15638a24713963358efe0bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689512558, "uuid": "2e863124-d7b7-499d-a1ac-37b07bfbfd5e", "value": "T1C1537209BF650FB7ECABDC374AE91B4525CD641A21A87B797934E818F20A24F05E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689512558, "uuid": "1aee501f-4001-4c4a-88f3-2f057856c884", "value": "768:67XcZwXetdmJRLp2gpS+Xcz9VH3IC5IEegesQew6eIZPXiBd8DO1k:67X4wX3RLpzS8sUCFhRQn6eOTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689512558, "uuid": "65d6befc-23a3-40c3-a48b-6edc699fa25e", "value": 63272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689512558, "uuid": "0201ffd2-4728-4bc8-b32a-8a9740b04bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689512558, "uuid": "46ab2e8b-806c-4d17-a2c4-97d89668f8ea", "value": "e64d7b08cc00ff46789373686d78fb06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976845ce-23fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526968, "uuid": "a06528da-26c5-4b2d-90e6-1f34215d188c", "comment": "Malware payload (Mirai)", "value": "75aea10704b61bde6ea5bc00109f7e90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526968, "uuid": "c0f88123-b48e-4f20-92d7-e30386cd6379", "comment": "Malware payload (Mirai)", "value": "9e61cc8bbb6ee51e71a8384e57868f4cc543e1ecf016b630d50a0510b4acbdf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526968, "uuid": "8e370b5d-8641-4010-9d7c-cbf8cf8d3cb7", "comment": "Malware payload (Mirai)", "value": "c3858d4e08403e7f908d8e6588b756c9dde5f268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526968, "uuid": "2a1c667f-85af-42a7-8330-70708c0ba88a", "comment": "Malware payload (Mirai)", "value": "1b939cfe49b3f72394e9a917576b492c259d7fc068f0a874bee0b9547ee6e2b0a21fef5e6e658ae9a9000947a58543fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526968, "uuid": "3f77ba4c-40f4-45cd-89d6-a3a6610fe284", "value": "T10CC2D074F0815EE3DBFABE705C91EBA137B0596AB7D9895234818F136C0319DAA40EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526968, "uuid": "945a9b5e-e8fe-403e-b13a-d0e8bce31233", "value": "768:4iQLDqbw2DR5CLn+nlSBhLC1Rq59RU4uVcqgw09+:4ybwyXCz+nlqTRU4u+qgw09+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526968, "uuid": "d67a5a60-f4e8-4ad0-b031-f880569100e5", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526968, "uuid": "3a0b422d-8133-4bc8-a0f4-c9e035756c46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526968, "uuid": "0ab93c12-ea69-44f6-ba52-c15530ea71c2", "value": "75aea10704b61bde6ea5bc00109f7e90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72405c58-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492116, "uuid": "12617986-f733-4a5c-a140-b9eed7072d07", "comment": "Malware payload (RedLineStealer)", "value": "71e8215f45ecb1d3b3b28bc579b27922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492116, "uuid": "c4d9a0bc-335e-4876-b962-685cfd5db5c0", "comment": "Malware payload (RedLineStealer)", "value": "9e8418826f07274a00f90b02756f693711350696a60867c9adff98b6c0268e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492116, "uuid": "7316287d-bbcd-4ce7-bef8-4869e68aeaa3", "comment": "Malware payload (RedLineStealer)", "value": "8e7aae40eb5db95d0481bf9b72eb4a7d106e7849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492116, "uuid": "756a78b2-64e5-486b-810c-de916537a620", "comment": "Malware payload (RedLineStealer)", "value": "f498065831c41ae5bcd77f02605b167acb7aecc8d6b43427f32cf83bad54fc7072ce6e7a374681aafb5e9e2a925a5d55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492116, "uuid": "796af529-5b77-452f-bf03-aa46b74e5b94", "value": "T1BA452356EBE68A32D4F4A73095F603C71B3A7CA149344387276AD94E59F32D0923236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492116, "uuid": "169abc74-9ff2-4b3b-bff6-5721892101eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492116, "uuid": "40f3f3dd-7575-472e-80f8-683e87759162", "value": "24576:VyyC6D5dkr0Rke7qmSYMn6nJq+u/jQPGiEXP5JQ0kvLI8cLaMaV8ceZVyMKwk05j:w0gr0RNqmTMn8JGjyG9ScT2aZVyek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492116, "uuid": "342b6e53-713e-4953-ae92-24ecb069d667", "value": 1218560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492116, "uuid": "931da6de-b5f7-4f3b-b785-c4cee6ad892f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492116, "uuid": "897283bc-3a6b-400d-a3d9-5d77ff42f325", "value": "71e8215f45ecb1d3b3b28bc579b27922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3e6e56-23a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689490257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490257, "uuid": "394cc14c-e86d-45e2-8278-82dad5403235", "comment": "Malware payload (Amadey)", "value": "6ad01d34477fc63efff302ea1b319c31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490257, "uuid": "2eaead11-0915-4bb8-b902-1eee22960af8", "comment": "Malware payload (Amadey)", "value": "9ec9b0e9a433354aed5e5048cdb01a6f694dc2f280273c7fd3270b7a92485a8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490257, "uuid": "1926b970-1a9b-4b19-861d-ba42cc244c41", "comment": "Malware payload (Amadey)", "value": "c350185aba95c5adb5b7d27baf46b4df6f1ae233", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490257, "uuid": "3c01418b-72cd-46f9-a962-a2bb7af9b888", "comment": "Malware payload (Amadey)", "value": "ec29d9e94a793fe4db533a0b3e931b4a29fe4a7d83ac9e06ad3a17712c6885c0d813682ff6a71c6d6edbbe10c7de48dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490257, "uuid": "aeed0bcb-3bae-4844-bd4e-791ca3ac53f9", "value": "T1C0F41212BBD80072DC751B300AF613CB0B36FDA19CBD875B62558A1F1DB2581E6B636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490257, "uuid": "a6c46350-d996-4b6c-be38-6cf7cf9438dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490257, "uuid": "168415e5-d778-400b-862c-f4dab1f4d30e", "value": "24576:pyHADiKk9XlK/31uzrw2B+MGe6zYDCaQx1nf6Pv:cHjRFlK/1uzrw2B+Xe6s/i1fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689490257, "uuid": "03b62ee4-a5e6-4f4e-9913-6a57766cdd23", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689490257, "uuid": "49d0b789-7f75-4706-b2aa-fd9afe78000d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490257, "uuid": "56e4a3b0-3658-4d7a-a01e-7b58bdd5ecbb", "value": "6ad01d34477fc63efff302ea1b319c31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf80533-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491465, "uuid": "222837ae-2ccc-4aa7-8aa1-9ea40f6d0af7", "comment": "Malware payload (RedLineStealer)", "value": "0b34cf6f73a36f5cbe3f2f735fd46da1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491465, "uuid": "9990d3a4-6662-4482-be08-e169b4f4725c", "comment": "Malware payload (RedLineStealer)", "value": "9f083a1010099feb1cab1e37a3ce3c86966173ce0136f10335ff5bd31157c3d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491465, "uuid": "0bfb12da-367b-4f08-ac89-675c54921b64", "comment": "Malware payload (RedLineStealer)", "value": "90f6c1a0d3259bf8ba7ec7f57199c65a446ac036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491465, "uuid": "7f8f6df8-a9ca-4419-8a91-dcb6e32d0419", "comment": "Malware payload (RedLineStealer)", "value": "525b0de14009aeb63ee3d534c9af12aa88d11d0b33a81a499ccb92c1cccde3281e55632c423dd63621bd503525c016c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491465, "uuid": "0df9f10c-de8b-4d85-9280-7b6f853f6aed", "value": "T12AF42372F6D58032D9B62B7018F202C3073B7DA25B79D3872F06A9596CB2584E5B173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491465, "uuid": "0b404bbe-b891-402b-b098-d4fe55667ed1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491465, "uuid": "bfab0d7b-cdc6-4116-9308-dded11497ac0", "value": "12288:gMrky90kSDrDrHVVXiAoFVLT8ApwrqfdRYJvvfGoeuuHd9JP0cQHW/41J9x5B:0y9Sn3XidFJXf/WvvfFU9Z9QHX1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491465, "uuid": "01104726-74cc-47cd-a0eb-3faee10e155b", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491465, "uuid": "e5f10ed6-7074-4200-87bb-7d689197e475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491465, "uuid": "7a583e74-70c5-46e6-a0a4-8fcb848477ec", "value": "0b34cf6f73a36f5cbe3f2f735fd46da1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a169ed2-2411-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1689536717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689536717, "uuid": "a59d6257-8914-4ee2-8b40-8efc00e709e9", "comment": "Malware payload (njrat)", "value": "1dfe93c432a71787bec625e9f37aea5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689536717, "uuid": "45242a48-ac5b-4f6e-b640-44bf516f2b9c", "comment": "Malware payload (njrat)", "value": "a01ef3fdd7c3df2e845dca28c37e9244cb1823c655da892ff5d5dacb9db70afd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689536717, "uuid": "cacc37a9-73b2-4859-b2c0-c9d43902a8d6", "comment": "Malware payload (njrat)", "value": "c733d9b06b59e9cd883787998d36cb890a601ef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689536717, "uuid": "0fe8a587-f462-4e28-b27a-a4c6d485afbf", "comment": "Malware payload (njrat)", "value": "6287df4284a52bae023c2c5f203aebe7c9c0ec4ba50b559f3272ad61cb464224e090a9cc271774ff83ee4183f9947a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689536717, "uuid": "a30472c8-c15e-4526-899f-4f998dc39519", "value": "T120032B4D7FE181A8C5FD057B05B2D412077AE04B6E23D91ECEF664AA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689536717, "uuid": "558eeed2-a50a-4d45-ad26-0fe84377a0e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689536717, "uuid": "1226c1b3-c999-4c00-99c1-2d0960cf6ea8", "value": "384:tdKvEiTbHvpWNcZ0y8f7CTvvrILkCwE3rAF+rMRTyN/0L+EcoinblneHQM3epzX9:DKXTZ38f7CTv8FwKrM+rMRa8NuLGKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689536717, "uuid": "6aa47cf6-a6d4-4671-9c8c-dc97c785d8ac", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689536717, "uuid": "6b00598a-c304-48d6-9ba2-75bd61178295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689536717, "uuid": "323427b0-d310-4109-9a74-8fd457d21e78", "value": "1dfe93c432a71787bec625e9f37aea5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33fbb17-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492709, "uuid": "3a5e7760-5f11-4ee2-980f-7a1178839475", "comment": "Malware payload (Amadey)", "value": "a5ef4b454e5346949af9f4a435285ba2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492709, "uuid": "3d96a969-274f-430f-9665-79c7473d3a8c", "comment": "Malware payload (Amadey)", "value": "a09d74896b2bf4b85f4cea6e5191509aeb62cbb8486c808066691cfdf1e945a2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492709, "uuid": "f8478fd5-7948-446f-bc9c-3d8fc771fa0d", "comment": "Malware payload (Amadey)", "value": "da0468e8ebf7d0e750450827301a8b81b40ce095", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492709, "uuid": "a1cb8030-a11a-4cd4-af45-8a35be60e6a3", "comment": "Malware payload (Amadey)", "value": "05f50dd00166f02d8f38a10a64efae54e5095a651015dc587103454482aaca378953ea900d6b596c10b666ceb7ee3941", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492709, "uuid": "dd10badc-f94a-46b9-8e95-610f594d3c3a", "value": "T12DF4235266E8C973D9BA2B703CF506D71B397DB16D7843AE27629C4E1CA2380E131727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492709, "uuid": "38cfc2f5-f96b-431a-bcf8-67248836a4aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492709, "uuid": "d5ae0c02-0303-4b9d-be40-e5d0f5c8eeb7", "value": "12288:cMr2y90gLSQziXjFnMA9m1DqsHMb3QSdoxxr3jk3GZwwj5boXV6RwGkdDgaF7uz:6yzS1jSA9usb31ohd6XV6iGkd/uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492709, "uuid": "216f8c77-8066-4e9b-8d51-9424b9ffc8a4", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492709, "uuid": "70ea71c9-47dd-4070-927c-9088cec9ab96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492709, "uuid": "8c1d65b1-2d63-4ced-89df-c8f38e39860e", "value": "a5ef4b454e5346949af9f4a435285ba2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d158c845-23f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526206, "uuid": "ad81c415-4105-409e-8e26-dc1bb7a94602", "comment": "Malware payload (Mirai)", "value": "d319bc4063bd1b76354194c6dffb5790", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526206, "uuid": "408882cf-87a9-48fe-b13c-48ad11daf0b4", "comment": "Malware payload (Mirai)", "value": "a0c8ea12d9628b0987ef151c214c42c96da0765eacee7ed38a921aff774fe3c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526206, "uuid": "291550c0-87db-42d1-8eaa-fae1522cf75d", "comment": "Malware payload (Mirai)", "value": "d6cbfb663ae3222ce644b68d3664c0bafe39fa8c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526206, "uuid": "637a0c56-0593-4c07-9115-1f6ddac7fd11", "comment": "Malware payload (Mirai)", "value": "32cc2e663d3eba9a6cba11d0b27c68b33febe95cba4aa74ade9111442eca64f5411391d58abf93f7597f60bae6212673", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526206, "uuid": "7c5e0909-8d3e-41a6-aa1c-ea16091c54dc", "value": "T1C63302BA36ADB412E6315B36AB31AE02F0D867E861C73237774523E69DC64170C5CAD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526206, "uuid": "35d807c2-d54f-4b3f-a163-d739ce61e4e3", "value": "1536:EM2IyNG6cZnTFax5wL8PqF1aBexo4W/vP:EzfcZnZLmqFUdvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526206, "uuid": "6693f439-adc6-4134-a52f-3987b4d3d13a", "value": 52544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526206, "uuid": "dcca94ee-72ed-41f4-bc47-bc3f32ccd269", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526206, "uuid": "b7d9865e-a1b7-4eca-8c60-0b342049c256", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a72d5a-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495899, "uuid": "417820b2-d2bc-46c5-abde-4e373722c37f", "comment": "Malware payload (Mirai)", "value": "11f41773f63e30fa6377a1202b23c2e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495899, "uuid": "c5d3270a-d9be-4497-8654-383fef204720", "comment": "Malware payload (Mirai)", "value": "a0fdc3d4accacc4969baa33ac231869700518dd390200cdf3cb502c5873cd312", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495899, "uuid": "3d9b0280-58ea-4837-8f94-19166a2cf8ab", "comment": "Malware payload (Mirai)", "value": "48f0826e822d9a84677d2803e7f9b7d5c85aef01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495899, "uuid": "29f9137f-ddba-47ed-81ca-7ed1f57c65d3", "comment": "Malware payload (Mirai)", "value": "19683882d06870b18ed9ac284c5907dc5eeceeaec7d286e51546819a46666b9532ae8357af04f2e28995f447852fc874", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495899, "uuid": "7dec1eab-4c24-40fc-9663-8523d5c2bc6f", "value": "T12EC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495899, "uuid": "cfad0b21-d8e8-4bd9-a459-c74f26b246b7", "value": "3072:4jDy/+mh1vtbPIKarbpcUPium7/L7QsvmGfIiNb:mOJ1vxfarbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495899, "uuid": "2f7d46c0-a48c-4cb7-8302-180cc7df6600", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495899, "uuid": "97452833-b511-45f9-ac2a-1bf9fabb8a41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495899, "uuid": "b8c1a515-9053-412c-b123-92afcd30083c", "value": "11f41773f63e30fa6377a1202b23c2e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1d69c9-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493633, "uuid": "a3924886-9e64-4c48-bb2f-1adb8fe4a2ec", "comment": "Malware payload (RedLineStealer)", "value": "891f1dc06713b9c0c010f03349cc76bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493633, "uuid": "9d05b02e-f77b-4f71-b3ea-1cd193f2bd86", "comment": "Malware payload (RedLineStealer)", "value": "a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493633, "uuid": "988f8226-562c-4135-9f1c-76cf115b9c8b", "comment": "Malware payload (RedLineStealer)", "value": "b9898973e542acf5172b5fcb94f52111036cfc52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493633, "uuid": "617e6d1b-cf4e-44c5-8eb8-aec9afef47df", "comment": "Malware payload (RedLineStealer)", "value": "571de61088f45feaf018756a31c62adcbd37c6beb0b6ce43dbe1737e023b0de543260cfca961449251dbd0fa784a356c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493633, "uuid": "0fb2e243-025e-47ae-a05c-c7549da1f3b1", "value": "T19A1522123AC99133E5B16BF019F203931A347DE49DA8471B2B109C9F2DB26D4E53AB77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493633, "uuid": "ea661aca-5ae7-4945-a681-00a2b569e2bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493633, "uuid": "0a2df602-3bd7-47a8-b677-eb22ed2202e6", "value": "12288:6Mr7y90xRF1KUynJmZMQ/uYVj62Y75r7qtDA75J6aBOoJe0vPd0NOs2g:pyYXaJmZMQGY62YiuJBBOoJe0vPkug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493633, "uuid": "9d56e30e-6ea0-4340-841b-6db4bca16a1b", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493633, "uuid": "9f38da69-2897-42d8-b8d3-0240add541c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493633, "uuid": "d5133849-0693-4a6a-8a2a-251d3ba927d8", "value": "a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e74c677-23fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526953, "uuid": "41d3770b-4d9c-4878-aa1b-010c1f61893f", "comment": "Malware payload (Mirai)", "value": "85b683183057599ba2386d87bbde40d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526953, "uuid": "02cb69c6-e858-4df4-bacb-fd21a981d350", "comment": "Malware payload (Mirai)", "value": "a4d9e748efb8e1fb6145551943f472dc0d200fe7b4ad2d3cb13214ce82e10fab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526953, "uuid": "0975b7fd-6cc9-4eef-b514-088cef52ad87", "comment": "Malware payload (Mirai)", "value": "2537ee90537f185d88a1bd6335395286789af044", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526953, "uuid": "4c119e34-7877-4e2d-9bd9-9ed80faea09a", "comment": "Malware payload (Mirai)", "value": "9d78d1d65360aa5b8e9442eb660a03260cfe55141f6190778bcb25eced887bee0d289504af3c398e8fc8c651d1e5f8df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526953, "uuid": "0b69fd8a-67a9-45ae-87e5-92e557fbc615", "value": "T1E5E2D0403A4D29A5DEA105BA5970858BEF4C4FF9ACBFB47E07B2860D8E5848F43F5913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526953, "uuid": "ff874d55-2586-46ae-aeb7-0316af63e04b", "value": "768:N83lxPcOu2LHi5vWSTotZv5m94fRD0zkH6kj/OlORN209q3UEL5L:6lxFu2LHi5eSTo3A94JDIkHV7OlXdLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526953, "uuid": "58f93e71-f307-4014-8f38-996d87027d30", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526953, "uuid": "a372ef41-7da3-43b1-890a-13c04e4894c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526953, "uuid": "97273d33-9822-4a9b-a59a-3b2ba9b901bf", "value": "85b683183057599ba2386d87bbde40d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad23ce31-2407-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1689532588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532588, "uuid": "4b1607ab-7d73-40ef-8fbd-345c95eab41b", "comment": "Malware payload (Smoke Loader)", "value": "f0e6784ab756cf4215b32964932bd3e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532588, "uuid": "d5210e91-621f-4afc-8089-142e54e66fc4", "comment": "Malware payload (Smoke Loader)", "value": "a5cb5558a1fb53b177fd0a683da3e93c4c0149588c7b06b5b8f5570896bd79bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532588, "uuid": "bac06690-6bb8-41f7-bed4-e6f74ec739dc", "comment": "Malware payload (Smoke Loader)", "value": "19069cbc2b9727d46f7ff7f29d409f74a11bb62c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532588, "uuid": "b2708add-3037-4230-a182-4afcf31930c6", "comment": "Malware payload (Smoke Loader)", "value": "2f87d03026edc20b62800ef0ac3d92f1b803475720a57439a8059c5d53918d87125e4bf491fbb2f97a59f923714f2c78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532588, "uuid": "7ff0c5a6-4c99-4522-9b0c-090adf3756ee", "value": "T18D64A44392E1BD48EA268B769F1FC2E8B70DF650CE4D7B653218EE1F00B1176D263A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532588, "uuid": "8af34186-9a54-4b38-9283-c3d84cd32286", "value": "510dd539bc8b58414f44caf85838ae97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532588, "uuid": "7d30d417-8da1-46ec-9952-eb294375f469", "value": "3072:0sSLb8KAonWY/0loFR1dgT4NijBb9PRir2z75iVMcpwwlgZDGWeT:0tLb+bgR3gT4NijBb9c8gVMc6FGtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532588, "uuid": "3ee9746e-93d0-46f1-a7d3-b58c6cbd6660", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532588, "uuid": "14b5d775-39e9-485f-b51a-b9b9ae03c838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532588, "uuid": "272e35a0-ef95-44af-ac2e-d3267a2058f2", "value": "f0e6784ab756cf4215b32964932bd3e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67434f0-238f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689481144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689481144, "uuid": "0d5fb012-d406-46e3-b7f1-adc598bd017f", "comment": "Malware payload (Amadey)", "value": "ae13c397b88228c9300476c26f6758f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689481144, "uuid": "3848b7aa-9dc3-41e9-8874-f87dc95f71b5", "comment": "Malware payload (Amadey)", "value": "a75c766167a44c78f3824d28780078cf2cc31522a55372958cefd5f3f093e4c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689481144, "uuid": "9153aa37-a60d-4e75-afef-6e41c0d12d64", "comment": "Malware payload (Amadey)", "value": "9ba0e0ce12e89dcda1879550fb4493c4887cdcf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689481144, "uuid": "a81ea5d1-7899-4114-9b77-ba93a944927c", "comment": "Malware payload (Amadey)", "value": "a7e56a12667d13095111e3e368e78eceb29b22c14a4e7775844e12f50bf60457fd8ef6e362f9b3d6eefe5fd902932d87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689481144, "uuid": "b0d58269-e4e8-4d08-9c91-e9a1880a218a", "value": "T1D23503827791EA6BB3E2DD67D75B7DC3D40DAB262ABE4EB5C09433150AB012884D3C35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689481144, "uuid": "60874e74-2880-46aa-bf66-bd607e67e094", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689481144, "uuid": "5a3457c7-1a4c-4ded-b4fb-f4f3724c7b4a", "value": "12288:87dr/X5xo3o31pXty9dPORz4NBzESLrAOyLqbiAaGHkf2SRGPNlNEtw4Mri:87drgmy9NORMNxt0OemaxRGPN0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689481144, "uuid": "e6374203-98ef-4294-ba78-ee721945dbe3", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689481144, "uuid": "74bfab2e-3dd5-4bd8-9ae9-fb12d3bc55d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689481144, "uuid": "5a890437-745e-4c37-8eb0-b23b3737af4d", "value": "ae13c397b88228c9300476c26f6758f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be652594-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1689493103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493103, "uuid": "b9855191-955d-4045-88aa-3435319fe074", "comment": "Malware payload (SystemBC)", "value": "5aaa271e450f4be6a269af69aefb2768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493103, "uuid": "0be38d9f-db83-47b9-862d-6ed8cf0dd96d", "comment": "Malware payload (SystemBC)", "value": "a79846e5685f2e79e36614a9f8c17476c6eb140b44954234a8842590cd7e7c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493103, "uuid": "71b5617d-6f82-46dd-8628-cd213b6fa219", "comment": "Malware payload (SystemBC)", "value": "64465c850b883c9dee5dfe9877b2a03d72bc3f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493103, "uuid": "9b530005-70aa-404c-b9de-380f40f3c3f9", "comment": "Malware payload (SystemBC)", "value": "d4d0ab8d999b59f547fc1dd236e6db19d4e65901f76c0c4cae8fd5e20af09cbeffa386ef931a85179cd321c35be71a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493103, "uuid": "44a12738-dab0-48d5-9469-9d4ddb296a94", "value": "T13BF3D0207CD0C072D51BD67458A1C3706AAF78629BB5CD9B37981BFE1F212D08B76396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493103, "uuid": "cd2fbf8f-5c1a-463e-99dd-d97735b0bb7c", "value": "f594022c7da59b0652f413c9086c5524", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493103, "uuid": "dc719cae-e5fe-4d67-bd83-d14ad8940c3b", "value": "3072:amL6TCc9ErR6bwR6cw2LCq/35XfsuMvfxCcTCxNILke5ANn:PL6arkcAcwyCq/VUuMXrTCxhbNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493103, "uuid": "0a4264ee-2760-4ade-9f00-9041c11d11e3", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493103, "uuid": "64a76b74-81ed-430c-8ecd-496c77b225a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493103, "uuid": "83d68334-cb8f-4585-9bd3-8bb886c866f9", "value": "5aaa271e450f4be6a269af69aefb2768.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8fd782-239c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689486606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486606, "uuid": "97e2bb40-b8e8-4def-a799-2a418f246c31", "comment": "Malware payload (Mirai)", "value": "6e8fcf8b0e2ec162e01f281b3aced49f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486606, "uuid": "e93cf54d-8219-4c8f-a055-5e941cde96fd", "comment": "Malware payload (Mirai)", "value": "a7b6fe9527200e1e660313c498aa02c9a548ae1763f5aead33a5359d70caa279", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486606, "uuid": "c94a595c-e5a1-4453-ac55-00d0c9545f8b", "comment": "Malware payload (Mirai)", "value": "8c5e34181f630e217befd199779326b8dcbc3c3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689486606, "uuid": "78206200-218c-42ac-a402-40b10521e788", "comment": "Malware payload (Mirai)", "value": "d5a3c6bbe02cf48e49cd0c02e6c0fa481d446e633d32b71dca073109adcecdfb0f1e37456d67cceceb856ad25da48dd7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689486606, "uuid": "623363df-3690-405b-b7b2-0fb1c28a87ba", "value": "T19FC2D0BC7EFB6F47CA1B0035694CFE3742F065A9D35B72D6B2484101AC131D5AA26CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689486606, "uuid": "8e2b0ad3-dceb-4f17-a520-676422242a26", "value": "384:Mp1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjVAfz:UMw4DZdFbBy6x3K/KdWnH5uA1QfL0NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689486606, "uuid": "bc2e0072-578e-4670-8c0a-7b295de5fd5f", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689486606, "uuid": "3b98ffc4-548f-4de9-8a48-1d39316b4233", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689486606, "uuid": "30552721-e4a7-47b0-90e3-8e1d2ecda4b9", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838f2d19-2433-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689551416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689551416, "uuid": "e8dfefb0-8485-4305-b12a-dec31797d53c", "comment": "Malware payload (Mirai)", "value": "1f28bcd529741306cec83ad461f81b1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689551416, "uuid": "aa26d674-b2f8-4293-9f58-488669700c43", "comment": "Malware payload (Mirai)", "value": "a7f40fc90b5de513301ca672cc0e5c1bcb0808120574340520c37bb9b4be3aef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689551416, "uuid": "df455fcb-2226-4f79-9d08-92259a19bd8e", "comment": "Malware payload (Mirai)", "value": "9d1e5c11315e7c1c8628d3e027be2824d86acaa6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689551416, "uuid": "a797e0f1-3039-46c6-ade9-951199b12e9c", "comment": "Malware payload (Mirai)", "value": "2d054b960e58b444143e38d97bdbb8e1eb090056016838933e2d90e94dbe542769d6a566ec093722938c14b369d38c2c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689551416, "uuid": "9077f820-19f5-45a9-9e27-cc6c3d849c32", "value": "T1D5F2E1E2A6FB4846D0C9B2F906BE660E2C30C73FC51596A558807CB64FD9F3AC438256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689551416, "uuid": "259970ec-3654-4db9-b3d7-20141802b965", "value": "768:cu1XjuVnba29CmXU70w9I3Xmj8CDB7ueQOenbcuyD7UtQRjR:71X8b/9G4whYCDBiLnouy8tyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689551416, "uuid": "cb0f2714-fa58-4f3a-9db3-31eeac9066ad", "value": 34680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689551416, "uuid": "5ae953c4-5f79-433e-be31-b59b34984dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689551416, "uuid": "3206264d-f052-4e04-bec0-3021704e7de5", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97529a0b-2409-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689533410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689533410, "uuid": "c8fbd666-ba46-48a5-9cd1-77e1dc11d656", "comment": "Malware payload (Amadey)", "value": "140c311059096d97ae5282447d0def0b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689533410, "uuid": "f4037d84-c345-4f97-9bff-9494e72beb54", "comment": "Malware payload (Amadey)", "value": "a80ea6d6891a5e7a7dc427c61b99a09337057977d54d6affb989e1e10c4142c3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689533410, "uuid": "195054ed-d8f5-435c-98fe-0eafde395ddf", "comment": "Malware payload (Amadey)", "value": "66c98fd2b076fe412a5e0f3c396ec07634a0edf3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689533410, "uuid": "70967b5a-ae9a-40ef-82d4-212b12247acd", "comment": "Malware payload (Amadey)", "value": "676df4461b4994458a4eae22cce79667cc292f0b43aac5d9f254cd264ef81c01eaeb914d6078faf45e9ac51113307507", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689533410, "uuid": "af107cae-a182-4e2c-9535-46c671027877", "value": "T1AD34AE1272E0E471E4638A304E29C6A43A2FFC618F6957DB33586A3F4D712E1CA72757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689533410, "uuid": "478df2ff-d9cf-434d-ac7b-ed70fd818246", "value": "6eb299d89b5b8df15490721649a42469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689533410, "uuid": "fbaa38c2-7d74-47bf-b4c6-36b09fcfc42a", "value": "3072:79s++v4X0huMy/WZIj82AFsqLE5UTeQdIJsDaGGVkh1N0wezh:p2M/Wy0s+82DaGGCh1Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689533410, "uuid": "f6e1a3d5-1bac-407b-bbc4-067578248610", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689533410, "uuid": "a361d748-decb-4df1-920a-75279bec91ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689533410, "uuid": "dc7bb7d4-86e2-4e30-b439-08bc690b4738", "value": "140c311059096d97ae5282447d0def0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc143fae-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492697, "uuid": "a0a21e57-ac58-4692-aece-ee354f70e0c1", "comment": "Malware payload (Amadey)", "value": "8905438c965cb5ae88426880f68a9211", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492697, "uuid": "3df00128-5811-4905-8402-72eb0ff5ad69", "comment": "Malware payload (Amadey)", "value": "a895848c8228e923ec0683e41140e284381b8fa71d96ab35db733d86d21bfd4b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492697, "uuid": "3b4dd110-587f-4818-b977-029378da61ca", "comment": "Malware payload (Amadey)", "value": "fc7e58b28b2c771321c11621359e86c9e7d79617", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492697, "uuid": "e865d176-e0ae-407d-9b96-be72a31108f1", "comment": "Malware payload (Amadey)", "value": "64851960bc8a4ed2c134e6bcf7389217a6bc03b2c18d78c786d10393d9d4db81a01e07808fc2b7dc6d5d755489a77d40", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492697, "uuid": "823c4e3c-5d39-439c-ad18-ab769be201f9", "value": "T19E152242B7DC9172DDB423B018FB12870E37BC714E19935A3785E8AD1C76A4971BA32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492697, "uuid": "1bc7ec90-e527-46a5-bd2e-1d5fa78f48f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492697, "uuid": "11c5420e-ca84-4058-aed2-a2d177ab3d58", "value": "12288:BMrzy9072iQSP6qUHgKx/7RLW6ua+9VhZ6MLXhwzynmlqZyRnsyT8f+eR8+:2yFXH3xjRLRSBwzynmcy+yYTR8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492697, "uuid": "8cd3669e-df82-4b0d-a10d-f558912185c5", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492697, "uuid": "d8e5f0ac-8b12-472a-a386-c503d2fa8ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492697, "uuid": "83f330c6-f093-417b-a8b4-9899500277b1", "value": "8905438c965cb5ae88426880f68a9211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c4ba4e-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529861, "uuid": "b76342e3-10b5-403c-8c83-58523da36cc6", "comment": "Malware payload (Mirai)", "value": "2195ab5a07782bf8f28d37b0a01b9566", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529861, "uuid": "29c44b45-2694-42a4-aebd-4e05420b87c3", "comment": "Malware payload (Mirai)", "value": "a92cc8f254d4074c53ea2251c0556d5c745c82213a49ab9ad78db3fcbafa9b4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529861, "uuid": "8b8112b9-efc4-4a0b-a8a9-0926b7ac91d0", "comment": "Malware payload (Mirai)", "value": "a25844272ba374b9ee366958329127a2e5a1a32d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529861, "uuid": "489a68a6-9049-457d-9ae7-bed50a3d00fc", "comment": "Malware payload (Mirai)", "value": "b767f773f758b22cf2f50dcd3e79965cc10e36c1caca2a9144c32fa9f734d88a282a34d554a8a8ea504eae585e0df0cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529861, "uuid": "fdac2e22-2ca3-41cc-8199-20ac93084109", "value": "T134E2F157D372E052DE3826F1F969818B2B7D4FACD57B70A2190517282D8A0836F2C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529861, "uuid": "bff13e30-1764-40d1-9735-36d0c8c12c44", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9XitEG9q3UEL5In:Porm1vpALgUJitErLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529861, "uuid": "6af350c1-6a20-4ca8-acb7-e30241cc6a5c", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529861, "uuid": "66babf92-4bce-4df6-85af-d3514c0ec1f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529861, "uuid": "a6ad4761-7cfa-433d-94fa-dd95db445d57", "value": "2195ab5a07782bf8f28d37b0a01b9566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602e3794-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492086, "uuid": "0dbabdea-018c-4d48-add0-4580860c3850", "comment": "Malware payload (Amadey)", "value": "457f53f4348590e277474924edfa57b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492086, "uuid": "670d4e09-b7d5-4d8b-b8ae-533d3406cd8e", "comment": "Malware payload (Amadey)", "value": "a964133c4d4639327e3c453a286874b9441c19712cd3991ff1f182648e45d583", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492086, "uuid": "13db339f-0fe6-43d0-b034-a9a1720c10dc", "comment": "Malware payload (Amadey)", "value": "c4a2dd1f2b85b3b9509dbc0e10afe674e4865d48", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492086, "uuid": "52bf6e15-2329-4e02-bc7e-db4f177478cf", "comment": "Malware payload (Amadey)", "value": "1967451898a9e2ef788aa564e55840a297840e98bc4631c365987c91f1538376fa8a2b01a33f99739b68f395b2e75aeb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492086, "uuid": "30c587cf-57c6-4e02-9a0e-d19651bd8f88", "value": "T1B0452353EFED80F2D57A2BB06CF601831B36BDD18E7486161B8655AE0E237949631337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492086, "uuid": "559b68dd-fd90-4149-9f05-6a4b8a5b0645", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492086, "uuid": "2bf460a9-181d-472a-b851-a901315e9af3", "value": "24576:Qy15nyZ2E4124LVbndmk4wTJ8Dym7/jijsiQAMWsMnY2geSvO:X1BZ24LXonjiAiDMWDVlSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492086, "uuid": "4df12378-d69d-4532-afdb-5f092c8a71db", "value": 1205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492086, "uuid": "96b326ba-38b2-4d68-aee8-1aaef46531ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492086, "uuid": "82d74ad0-7864-4d91-9598-64f9eecba31a", "value": "457f53f4348590e277474924edfa57b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80449ecc-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467229, "uuid": "4acfe570-1193-4bf2-a595-155bd988bd44", "comment": "Malware payload", "value": "868be65193e3353848ea6e19bda8617a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467229, "uuid": "d4168fe8-852e-4bcf-a92d-3e857239de3d", "comment": "Malware payload", "value": "aa3792858633f1c2e3400c961497b98d28e8a82c179ef7c04fabd070fc971859", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467229, "uuid": "cc1dfa52-fe70-4d90-a921-1d434bbdb823", "comment": "Malware payload", "value": "62682cf6359afb802bdad747968079624e615efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467229, "uuid": "754337c5-eadf-4139-b5d2-275cca712771", "comment": "Malware payload", "value": "3af54174a0e17a27b9fcf708235f7d926ab60757469bdf70efa990e40d319cbc4a5306274dc7173cbeb04ca243a1f1f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467229, "uuid": "9ec41208-f778-4aa1-b6c7-44002fc92c3b", "value": "T172C5336FEEAD9085C8C474FA9F6680D11B0E7B3EB90089449FD9C67E01FCC97695B608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467229, "uuid": "e1216042-26f5-40bc-89ac-c42ea30095ab", "value": "49152:kYVJNrJmB1n6fH1tFW9Ek2U6ZtKEYvouqCjbIYhMlPOaWw:kYVJNrJ41nOjw9EkybYvoobXGlaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467229, "uuid": "00038684-0884-4748-9f00-3be1c2dc44b9", "value": 2515960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467229, "uuid": "e3aacdf7-f38f-49fb-9cd0-d54f5ccffe0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467229, "uuid": "20c60a73-0109-4f02-970f-77faefd2673a", "value": "SecuriteInfo.com.HEUR.19592.13833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa57664-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493320, "uuid": "75ba4a0b-4b29-42d6-b5d0-5858cb57b74f", "comment": "Malware payload (RedLineStealer)", "value": "f73bcd5c3a96954a04d6420465769d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493320, "uuid": "3194ad13-63be-4466-9f00-911b36bc9277", "comment": "Malware payload (RedLineStealer)", "value": "aa70cdfcabd9a1e4d6c2a299d9a7a7380191cf7f2295a72f221ed71ea48fe980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493320, "uuid": "500f3609-b1b1-49f4-8f3e-e9bb704aaa17", "comment": "Malware payload (RedLineStealer)", "value": "82ac64dd3ee6f85bc884f1111379051c0d7b6858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493320, "uuid": "4643b374-dcfb-4480-8782-1c935698c6d9", "comment": "Malware payload (RedLineStealer)", "value": "2841eb95ba8ebce01f2f87af6e08cd259cf779b2424980d002a90eb2fe12a50ff3279a914d9f693456d54b897cc9d2ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493320, "uuid": "121e5693-32c1-48ec-b836-db6673aa427e", "value": "T196F42246F6D48032D9B52FB00CF796E30B75FDA14CB487AB738151990CB2A852A713BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493320, "uuid": "0875c646-d249-458c-a2f1-1edd0ebb2c30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493320, "uuid": "2dea5908-04a7-4e14-a6d9-9d742cb57d65", "value": "12288:EMrTy90xCZyOVZMU+Q4v6U32zRbAP3h3g0qSh/NvmbvmFz95J7UqE:Xyvp/Y6Uu+7v/1uqz9H72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493320, "uuid": "1a47c299-fc16-48ca-920d-08f54008992e", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493320, "uuid": "3bbe9f1f-22da-4a23-8736-313022021de4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493320, "uuid": "65620a9e-e0fe-4f9d-8288-3b710de9164c", "value": "f73bcd5c3a96954a04d6420465769d99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164fe7e6-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492392, "uuid": "7c7ffb61-0796-45d8-ac85-69c6f0185545", "comment": "Malware payload (Amadey)", "value": "6ae13efc8817a2e5640ab617edc0ef66", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492392, "uuid": "acddce76-0f2a-4a54-a77b-c969a852b0d8", "comment": "Malware payload (Amadey)", "value": "ab124875eee3aa9c0b98e5ed0dbab9856acaf99e011d97b92abd4d2cf0f5aa6a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492392, "uuid": "470b3880-b0d0-4978-833d-010552afe151", "comment": "Malware payload (Amadey)", "value": "56dd6153047a0cd1cdbd047b63e579fd5b8ae25f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492392, "uuid": "950132da-bab1-4f19-897e-924d642de02d", "comment": "Malware payload (Amadey)", "value": "bfa8b017e983aa2dda73acf6bf753eddf187f4267b7ddfb5d594a4fcb36c22b4a9870fa83841bbaa1faa197065b6d532", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492392, "uuid": "6215d0d0-bcef-470d-9cf2-8a73a761f68f", "value": "T1461523A763D580B3CDB013719CFA07C307327CA2AAB9425B1B15E9691D73685A67233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492392, "uuid": "c6c6c32f-aa88-44dd-b2aa-e520a2e43589", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492392, "uuid": "11d8c4e3-c9b5-4d27-9b05-66a81257bb5f", "value": "24576:GyF7GXiF68lRgtjHF4l/MI6OxDgdcqSvNB:VFqXic8lRg3PDVcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492392, "uuid": "5f738378-03b4-4d0b-9c9b-5dd5dc823421", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492392, "uuid": "dbe0b898-6509-4c79-b8c9-a80ea0c7f2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492392, "uuid": "6874d67b-42f1-4aaf-9cb8-573e7570b8b1", "value": "6ae13efc8817a2e5640ab617edc0ef66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13342516-2428-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1689546503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689546503, "uuid": "a5e22341-4875-4e2a-b1a7-a453c172f6a6", "comment": "Malware payload (ArkeiStealer)", "value": "f46c4f40be41425a103e5b70e4a0143e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689546503, "uuid": "11269438-7a48-45f6-875b-6995bf04507d", "comment": "Malware payload (ArkeiStealer)", "value": "ab20e0ba9c2f1e110bb299a3448a336fd6976e2f69690cf03ebd8892baad2249", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689546503, "uuid": "0738052a-8acd-40d0-9c64-8934e646adf7", "comment": "Malware payload (ArkeiStealer)", "value": "f55a7d686731d95e0ea7c2f4721a240dd5fed553", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689546503, "uuid": "550dfadd-9936-4c82-9771-a831bb94a623", "comment": "Malware payload (ArkeiStealer)", "value": "a14851a9daca36bf802ec60a264fced829dba07cf071295d1242d54814ba055a584b959447911d059a9e287d1669cdb2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689546503, "uuid": "b6c16bd0-beb3-43d0-93ac-5e4c1d199f4c", "value": "T11836234CBE990C94CEEC34351C593F9EF257B31CA72581938AB5B2D7A6247874B0732A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689546503, "uuid": "36463ca9-7378-45d6-977c-674554cb9ae2", "value": "5826e2bea2981d413e896f41d08c994e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689546503, "uuid": "779f58ad-3e29-415a-bbe4-76fa2cd8be8b", "value": "98304:tn6L2shWbtczgeJk+OZuLedBiVOfeGeaAJaB2zXTWjzX4XeFHG6g1:tn6L2shWazge+NRuOGK3EHqzX/FH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689546503, "uuid": "a905d7f6-10e1-4bdb-87e7-b532e9fcb41e", "value": 5045760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689546503, "uuid": "662a527c-4eb6-4e04-965b-253fbeab5bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689546503, "uuid": "b180f99e-8dbf-40c1-b479-702da5202013", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c22c4a4-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689493368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493368, "uuid": "059cfbf3-37ed-4aa6-9848-6633feeb3c32", "comment": "Malware payload (Formbook)", "value": "0765692957ce1a7d381daf4d254e0dc1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493368, "uuid": "01b4bb52-22bc-42d3-b5e3-87af240cd755", "comment": "Malware payload (Formbook)", "value": "ac08f1d3518dfe35c2d802992008d4a6750c6e83b9b7c4ed32be68c49bde40be", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493368, "uuid": "05a07617-bc38-40d7-8488-0b7cbb615a48", "comment": "Malware payload (Formbook)", "value": "d32070796d799a70d20889773f54870b7a564ad7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493368, "uuid": "3e3335cf-b40b-4535-af8f-89455ab8c580", "comment": "Malware payload (Formbook)", "value": "1e6abbb353c4f32fb238986bb842904aaeaf9be91749ea71130a1a6e1ad72a8c48e874bfd63941a1f6be1c8f04770e23", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493368, "uuid": "483f3597-cb71-4c01-ac29-b738f0b5cd29", "value": "T15B45E003D8049BC3D40D83F47E530EE90F0A6F1AE899B9EB14537F8B3A71A72595A51E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493368, "uuid": "5b57ac97-a44f-4ed9-881d-7ef508d0748d", "value": "24576:GHu9V1ZyFw6VzAZypw6V1ipbmcwTA5G8cmuwwzx:GHu396Vzy16VqmjTJmuwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493368, "uuid": "b4e6c774-23da-4ae3-9ca3-f7f419f8b8e0", "value": 1210880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493368, "uuid": "c0657bfc-dfd3-47dd-9307-fa098d3b3886", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493368, "uuid": "169d6e68-1f30-490b-b5fd-3cdcf7fbc6e6", "value": "Compr..NotaFiscal3713.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5908572-23f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689524039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524039, "uuid": "a6c4fe0a-7929-4d3c-ad40-99cbd8c7e4f7", "comment": "Malware payload (Mirai)", "value": "375de19b822159f226c4ed748409eefa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524039, "uuid": "ad6ad27c-1217-4c06-b002-1f5722963ecc", "comment": "Malware payload (Mirai)", "value": "ac3d6c907974652efad2da1293efb619485a4bbb9df4f4d651b675dcd1552bcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524039, "uuid": "7b017cec-16b3-4edc-bb35-1a55a5af77b4", "comment": "Malware payload (Mirai)", "value": "bdb14b7db905efed57374d4a4f3907fffde9b0d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524039, "uuid": "85522826-d337-472b-9466-009335b1c555", "comment": "Malware payload (Mirai)", "value": "5dd8bc6c59a5adb9adf74569dbc6c1dd76997bed60d428cf6cf710b9bb2ef03f6d431dddc4d324c6deb59f1d9032ff59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524039, "uuid": "16e78aad-4535-4e05-b0a9-5ae72d0db19f", "value": "T14FC2D0E0B726FA31C520AC3DE52A4D893A51167C91FF383654259C358FC165B27E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524039, "uuid": "798044d8-e460-4444-b721-c7c754a4a25b", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrIF9q3UELux:PKy4qfqoeJdXWgIYLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689524039, "uuid": "f302ad93-1137-446e-9ea2-ab341687fc68", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689524039, "uuid": "d65fda51-7610-417f-bfad-2eda399128bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524039, "uuid": "b501a322-fbb1-4e07-a4d8-f92babe1cc91", "value": "375de19b822159f226c4ed748409eefa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f312d92d-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493621, "uuid": "76836c99-2b14-413f-b8a4-45a1b33c8f8f", "comment": "Malware payload (Amadey)", "value": "4e8759ab9a8b5f7c4f66a88a89ded7b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493621, "uuid": "c25cb6be-ff95-4529-bc8d-83781278d802", "comment": "Malware payload (Amadey)", "value": "ad95249c96bb70f2fde592c74bf9bfaa2f25de9282a90943574ce4e547731029", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493621, "uuid": "e8a9057f-c175-46ba-94cb-de3d3a028687", "comment": "Malware payload (Amadey)", "value": "0d8b409b1a28cb898951b534878586da01179b0d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493621, "uuid": "149af2e5-de4f-42ff-a33a-8e7b9fcb353c", "comment": "Malware payload (Amadey)", "value": "b1aee86be619c05e691c15658b32ab3286f8437bdbc47cd920dc4112817813557e0b132f338d745443e3eb879139b54c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493621, "uuid": "fffcf339-39be-4a79-84b1-8c6d782f6bc3", "value": "T109152261AFC85013D9B44FB008FB07C31B3EBCB65929425B27D7AE6A4DB35846035B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493621, "uuid": "b0bbd105-4754-4dda-b940-0f6e7a7b83bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493621, "uuid": "f8185337-6c9b-46e9-9cb6-7f4f6b30e3f2", "value": "24576:4ycoiRyR63BFw1QzzRQ3Uc+3k4aMm3KCzylrULA4Dh3nqM:/cois/8NQ3Uc+3XaMm6rgLA4DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493621, "uuid": "e5697e15-5485-4ca0-8e8c-00df0ce741e4", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493621, "uuid": "80b4d91d-0dfc-457b-8dfd-837e796d1173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493621, "uuid": "8b272405-c720-41f1-91a2-460cb0d3eef9", "value": "ad95249c96bb70f2fde592c74bf9bfaa2f25de9282a90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e70db0-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467230, "uuid": "e23cc6d6-ffaa-4a51-a427-351d3d5fdeba", "comment": "Malware payload", "value": "e7f54438d09d94346f75aa18d98cc6e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467230, "uuid": "f40b1061-8baa-4538-816a-c3646988010e", "comment": "Malware payload", "value": "af05b0611a74f925e7f5736efa532ce1d486c9a643f4befc5aae1a2c7ab55f73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467230, "uuid": "423c573a-40b8-4c8e-b640-dd8ee964d252", "comment": "Malware payload", "value": "c6f49174ca12dc0a1e382e4b69eef0563c4dc41d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467230, "uuid": "1e4fccb4-18ca-4b40-a05e-dfb8a2400740", "comment": "Malware payload", "value": "3aa8d2c7eb6a3650e759269bfa93a67791a3f15ebde96f2a80d06a0a3cd2d565c2c88715095261e5c56958d957bdee0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467230, "uuid": "5dfd47fc-2b7b-4b1a-bb52-28af8bc1edcf", "value": "T160D38D1097D380B2CCCADB3024ADEBB7A67FFE44A674B0AF87915DAD5431900A059F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467230, "uuid": "fd823cd7-db6a-4a86-91c2-5cfc24cfc800", "value": "1536:wtg1zeK9GIks0CZEXT/T64TbM3N/A7epomT+y7NKRaeZV/+iSL3:wtFK9Gc0CslbM3N/lTKfGi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467230, "uuid": "7656d14d-9e19-44ed-992a-f3cc0ba22c20", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467230, "uuid": "1714703c-59c6-4315-affe-eb4d0d7b37e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467230, "uuid": "b7932f2b-97f6-4649-bb94-53d00fc142a3", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.21882.13297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b81521-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493026, "uuid": "8252e7e9-b08c-4299-93a7-3b88e58b0250", "comment": "Malware payload (Amadey)", "value": "dd93ee60c259b6d6649066385f4244ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493026, "uuid": "8f998375-c42f-43de-a3fd-85e01f2c147c", "comment": "Malware payload (Amadey)", "value": "b07c30e9c2f5b9fe74bfb66f2c8682edde02cb68cd4e8a75976cca328e48e60f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493026, "uuid": "48a837de-17cb-4931-9057-6059f79a6556", "comment": "Malware payload (Amadey)", "value": "d07a767c2cc5a3f4e22536f80cd5403d48e79f31", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493026, "uuid": "f6caf18f-d34b-4165-ab1a-0552eae47494", "comment": "Malware payload (Amadey)", "value": "b4f346bdb3059ed989def775b403db573a1a6230ac5af8d6cc462c1b1a1d4e1118d2fadaafa5c1210088e15c133a4ace", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493026, "uuid": "1ce788df-8339-40e2-a791-0f6020016012", "value": "T17E1522976BE4D232E8F1473048F907C31B3AFCA05C7982260A648D9A1DF37A5957673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493026, "uuid": "392d4fdd-fb2d-4375-bd0d-88e27cba153c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493026, "uuid": "ba4d85c0-2044-4bac-9392-20b7e3e1ac96", "value": "24576:jyvRZtvqBOv+fxZ0j5MqJu/2vUx4SoSoG:2vXtCVxZ06qg/lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493026, "uuid": "a18e47a1-583c-4e78-bdec-39f0c29d221f", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493026, "uuid": "03b573ef-36f0-4163-82e7-9a93fa9beb3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493026, "uuid": "b6a7fa47-a5d7-4be4-90b4-8a6fe47af356", "value": "dd93ee60c259b6d6649066385f4244ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dba153-2385-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1689476738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689476738, "uuid": "f17722f0-9232-4c20-9524-7cbd4230e798", "comment": "Malware payload (Stealc)", "value": "333ee953bd9146b4823d4b127f59fcb5", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-soft2023", "colour": "#0613C1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689476738, "uuid": "2de53a7c-ed27-46f8-9d34-7ea54ad6d126", "comment": "Malware payload (Stealc)", "value": "b1379cc87627f356fbb19610ac730c77cb9ff86749c519c7397af06179fa1ab1", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-soft2023", "colour": "#0613C1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689476738, "uuid": "3173942d-7f4d-472a-8aed-dbeca115e90b", "comment": "Malware payload (Stealc)", "value": "95e254ea922d9ce3080d52da09c8822c56c0c33d", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-soft2023", "colour": "#0613C1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689476738, "uuid": "d73a9960-99c8-49cb-a84d-dae1e06fee46", "comment": "Malware payload (Stealc)", "value": "cffe99c9e595c47ec1ce27a7561a3bc037208bb2643903b6aa80d988829fe3c9a3cc56e079db98f03b51988b43e2cdae", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-soft2023", "colour": "#0613C1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689476738, "uuid": "1375283a-8815-4a2b-8505-5a4eeaf5caa1", "value": "T1203633DDD7760E28E3EF7AB888461B51F7B01C608791028FB715F28A6E5A3E5404C76B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689476738, "uuid": "f6efbd62-159a-455a-9542-40113b13891e", "value": "98304:si+I+/Ntb+LXwf+1SzyeL3xZoLGv75Y9nI8QjF44YANIiVPtrBwu+gLa:s9/Dj+1SesxbGnItGAiill+gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689476738, "uuid": "67a23280-1ad2-48fd-b3cf-22d26c98af94", "value": 5340654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689476738, "uuid": "1bb645d8-ee2f-4710-8601-1cabb4b63eff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689476738, "uuid": "f21b825c-6abd-4a09-b779-55739866f7af", "value": "Version_Unlimited.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2433bc0f-23d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1689509165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509165, "uuid": "b6bcdaff-aff4-4514-b28e-4a6588f966ff", "comment": "Malware payload (Tofsee)", "value": "4e412cd167bd1f2900f9da0859debe51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509165, "uuid": "3bd993be-dc80-4377-bd20-ebe680db8ff7", "comment": "Malware payload (Tofsee)", "value": "b1dcb6f705467aabe6e6306b0ce17aedfe286ff2c9c35e769bbd3ce530db1004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509165, "uuid": "a56c38b0-440d-48d5-ae86-394dfc983d9c", "comment": "Malware payload (Tofsee)", "value": "0f2e6d100ad8fd45982446b3a26a6f14a6d9c9f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509165, "uuid": "d283698d-d890-4fca-926b-51b0b051f70a", "comment": "Malware payload (Tofsee)", "value": "07807a158427a87c9642a9dc22305e2b9acf1ce7794aa714b446c3bba56b748e43384fc30ac432315fba8fd62b4d33b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689509165, "uuid": "92c82063-3a14-4e96-bd96-d240939cc08b", "value": "T13464954393917D49EA268B769E1FC2E8B70DF6508E4D7B6D3218DE3B10B1076D263A60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689509165, "uuid": "f7c3afd8-ae5d-4114-b4ae-e5cd277141ba", "value": "f3a1a6c560f808b7f46a078e7eba3d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689509165, "uuid": "31b761bf-3e13-494d-aefa-c996bc2ee7cb", "value": "6144:uLXpEeveHtjBHwobViSvneYbU5eV/FGtT:u7pO1BQob0OFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689509165, "uuid": "9d1c93f0-df24-46b4-839a-79859bd252d1", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689509165, "uuid": "146a3d58-000a-44f3-82d5-b375c8bfd34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689509165, "uuid": "1d43205e-4afe-4ae6-b96f-1e1691e0ba0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9f86f7-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492729, "uuid": "2c6c269d-8097-472a-97e9-e2a99b4cac22", "comment": "Malware payload (RedLineStealer)", "value": "aa26cccde046b0e54b832825a5756c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492729, "uuid": "8c936351-d5e6-4c45-adee-59cef3f4aa3c", "comment": "Malware payload (RedLineStealer)", "value": "b2402bf5ca4c67871f6519e689231078532c147c35500668d062dec52e27e9fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492729, "uuid": "20f4851e-66e2-4bca-8617-fd41d214d162", "comment": "Malware payload (RedLineStealer)", "value": "f5c538220421870979edb4d93fdf8b02a4d0ecbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492729, "uuid": "3e7f0a0d-784b-472f-ac48-aea1479fdcd8", "comment": "Malware payload (RedLineStealer)", "value": "e2c3e829d4173e6c3a64837bbdd099570b04a792fefa1747100a2bbaf2fd8ba5c181d3ae4a21be2cdf3ca78a3bd1e907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492729, "uuid": "4c1d20f3-0216-4a39-a77c-11caf7ca58b2", "value": "T1E4152342EFE88472E9B01B7015FB03C30B317C91C565A76B67A5A5A66D332C4A83637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492729, "uuid": "6ccb5834-336c-4b0b-bbc0-eda22ea3ffca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492729, "uuid": "09e36759-6915-47d8-b19b-bd70063d73e7", "value": "24576:IyAXaONmQk2uEBNOAaIGqgK1wjH9AxXChzyvp:PAr+RpItggoH9ARC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492729, "uuid": "a3410047-f188-4d67-b82c-d697c6b7eed9", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492729, "uuid": "e1a79287-4071-4eda-9663-43044516c4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492729, "uuid": "f9938af3-6559-4409-8d79-1cbd5e49ca68", "value": "aa26cccde046b0e54b832825a5756c35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce65d46-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1689493852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493852, "uuid": "1636ed59-829f-414b-988e-3c126a18c0af", "comment": "Malware payload (Fabookie)", "value": "89a5a30fe0e85a353225ac1179ac42fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493852, "uuid": "0bb7138c-3e18-45bd-b012-f8a1cc181f4d", "comment": "Malware payload (Fabookie)", "value": "b29812855ce84bd03a122d7fe79f9e885e578d1954b0a459c1e1b67109905d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493852, "uuid": "bf109453-1865-4e78-9577-56563238c768", "comment": "Malware payload (Fabookie)", "value": "bb1d209bdab9d7ba9f30718b022ead8076907443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493852, "uuid": "a4b3d78e-716d-4f06-b3bb-2dee8ff3acf0", "comment": "Malware payload (Fabookie)", "value": "88f8b8189142039c18b300449b39186e5802ff4d12a017c7b396838c0532e35b358d2ac678dbbdca23d4404d80a7f39c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493852, "uuid": "6bae6e3a-c137-45ec-a324-5288df3adb9c", "value": "T1CAD47D51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493852, "uuid": "1467f435-671d-4b75-9288-d38139237df7", "value": "20a03a21823d3b586003fbd55dedc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493852, "uuid": "96d2f128-ce74-4857-9c60-c8efac5f8847", "value": "12288:Tee9CNmn1yjnivHTJBxPTXzGwDJcaMuGEPnW:qe9imn1+uJBxPTjGwSaMupnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493852, "uuid": "c57324c2-6112-4067-9986-4432ab91d771", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493852, "uuid": "0bfa5b00-42e8-4a5d-b731-a10d521640d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493852, "uuid": "688044fa-2ba5-4edd-a7c1-58c581e24252", "value": "89a5a30fe0e85a353225ac1179ac42fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1f8545-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493020, "uuid": "790d46b6-5ec6-4e85-bc10-eef4c46dddb3", "comment": "Malware payload (Amadey)", "value": "e50a53b117918392983bd6f5946867ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493020, "uuid": "d80b47a7-4eab-4620-8424-019bcc241361", "comment": "Malware payload (Amadey)", "value": "b2a165c626d2145428dc2cfe2a70443f128c29d662b0229f7053f355b8042e91", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493020, "uuid": "0c73310f-e928-40b1-b05d-73ab88e932a9", "comment": "Malware payload (Amadey)", "value": "e600255d8a8303e1d0689564060cbe0653b6c735", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493020, "uuid": "cf352d6e-d7d5-48b6-8864-01630be08053", "comment": "Malware payload (Amadey)", "value": "a965473190175b55a623e288265b27b144a4792937acf4fba75f484ae13cde4e951a49aa58617ec036544750509efb5e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493020, "uuid": "79b1bc08-04f2-4562-ab70-80e60d5f6006", "value": "T1E215231236C99432D87167B049F506830B377C929D7493B72785A96F08B3BD8A93A73F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493020, "uuid": "2c20c27f-b193-4f35-8aa3-42f818d795a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493020, "uuid": "110294e6-ccd5-4bfd-8c8c-1c7c3c87a2ff", "value": "24576:yysqOQKJpx08SCgW9YKNLn4SyXeZfL4y:ZQXJp0CLfVnxyX8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493020, "uuid": "b5b89a7d-6410-4840-b1dc-3047396e6838", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493020, "uuid": "17293520-fe48-4df8-9669-a3de94a9f52d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493020, "uuid": "91c7fb6c-93b5-45f8-9f3c-fa2cb5cc6c28", "value": "e50a53b117918392983bd6f5946867ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2b7fa4-23c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689503270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689503270, "uuid": "8dc3d5b7-fc54-4415-ab35-31bce8bf6056", "comment": "Malware payload (Formbook)", "value": "f299a3572c1ca67f5df9c027c50f5488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689503270, "uuid": "5a894ed6-65b6-4795-bab1-c72d5637324f", "comment": "Malware payload (Formbook)", "value": "b30baea69e5ba92f56e7d7aa79bb30ed9e889dfde1a690244c9fe02baef4617a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689503270, "uuid": "0a7c5a85-e670-4ea4-9783-edaeffdc3e3f", "comment": "Malware payload (Formbook)", "value": "98ae2458837e4f2bc4e518fd867d3edd28c4236f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689503270, "uuid": "07f96478-88f5-4f91-b4d6-2dd0720794f2", "comment": "Malware payload (Formbook)", "value": "eac1832c8029fe6b1373b890c4421dea0dc396c1bab0e6b7ed7ca428d236e72487e6a7e5a2b9b6a294c2c241ab1c1120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689503270, "uuid": "8e38e6e9-b68f-4b66-98f6-914b7b931ba5", "value": "T1D2050F48F3048A72EC4E9BB2D436CC2166277E2B7534460E62CF36D957F730669E5E88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689503270, "uuid": "cc16bb40-4a1b-4bd5-96f2-2dfbe2ed498c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689503270, "uuid": "9886b5d6-a635-4a99-8ee1-350f475ebd36", "value": "12288:MotEJb4xECMrM7I+KA0Z2+8cjtHei+uo0hE/:nCCMrG/R0wTcjtHei+uo0hE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689503270, "uuid": "6c39fe4c-b239-452d-90d0-3e8d2aec3e76", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689503270, "uuid": "5e8161d9-2cd8-41c0-84b8-6c1d504fb991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689503270, "uuid": "c342fc8a-06cb-4fde-94b9-aba74a8c70e7", "value": "SecuriteInfo.com.Variant.Bulz.771382.15623.28477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc29288-236d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689466550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689466550, "uuid": "4b430040-4fe6-48f1-bcda-2d48bfe20992", "comment": "Malware payload (RedLineStealer)", "value": "b146fc7f9952382c0139e1622e1719ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689466550, "uuid": "cae86275-27ec-457c-a71c-1e01233f6fa0", "comment": "Malware payload (RedLineStealer)", "value": "b3141a11f243272416102012de8db2eefc028f7e70b957426bd40cb4210cac15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689466550, "uuid": "14b79189-0719-4fd1-aac3-890dc37726fb", "comment": "Malware payload (RedLineStealer)", "value": "b9f0fe732fc72aa1a01f4211b72b7e60910578e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689466550, "uuid": "d589e5c1-4ee4-4a5c-b483-ba278c22a60e", "comment": "Malware payload (RedLineStealer)", "value": "d5d4090bf2be716e6c797255c849daa364ba871f72d3bc4308d3527529a0512d4e077e7f1036a5823fc1ee72c5c907df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689466550, "uuid": "175ea914-c123-4099-91c9-0030f224ee88", "value": "T1ED852343EFC50523D8A4577019F902C31A37BD72AEBA5307578A686B28F2AD4917273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689466550, "uuid": "3ec7de03-e842-4d94-8d12-030a7467a162", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689466550, "uuid": "2eed30d4-5237-4838-a29f-eeafa1f00cef", "value": "49152:UaDrotAKTnlnr/zFRNeq0IbW+MvW9jRF4i/YWQ:lroi+VXFRkqTs+RF9gW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689466550, "uuid": "8d0bf90c-1e84-4879-a3c1-14dd926286e9", "value": 1740288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689466550, "uuid": "6f537583-7a38-4bff-aca7-faedbda6b3ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689466550, "uuid": "5781e516-8377-44d6-9afa-b1c3a71574a1", "value": "b3141a11f243272416102012de8db2eefc028f7e70b95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2fab72-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492401, "uuid": "5a1fe547-2f3f-4e86-8820-528754eadb99", "comment": "Malware payload (RedLineStealer)", "value": "766779e0d40e342ff9c7a7ce9a515624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492401, "uuid": "37386e4f-2dd7-49e3-88e3-fcde19a71da9", "comment": "Malware payload (RedLineStealer)", "value": "b39128b38fa139e5b310252167b5f16a1b29282488e10b9fa9c5e5ae15546c38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492401, "uuid": "054b442c-a573-464f-ae8a-90f3bc7128a1", "comment": "Malware payload (RedLineStealer)", "value": "291ed621f8e9cb876ed4f9546d65866c6db76cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492401, "uuid": "48232473-1899-41bd-81c9-f3900edc7ade", "comment": "Malware payload (RedLineStealer)", "value": "13393d672b75935c667a87b33669f6b9a9bd6a0f27aede31263ced89368d9bec8032d3c73439f097315cc08227d814a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492401, "uuid": "4f50403c-ccc2-42ae-8358-d0d8d2d4f43e", "value": "T1EA15230637EA4073D5B557B468FA270B1B32BD825D64C7A76F55948B0CB2682BC3233E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492401, "uuid": "e59e8864-97a2-429e-95f6-d5df20af6884", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492401, "uuid": "65ca5048-6aec-4c2d-a4d8-907494d1312f", "value": "24576:IyCirVBTg5EIB5jGPRJOgTXZWZCKc1yG9W+M:PUjGOgTXZWZhgyMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492401, "uuid": "8468178d-2ff2-43a1-8c88-5ada95dd3681", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492401, "uuid": "8169b1fe-123a-4129-8094-f5d76402b59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492401, "uuid": "075c0a7c-aa4f-4387-a633-14d5ee5c1e54", "value": "766779e0d40e342ff9c7a7ce9a515624.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8451fe4b-23df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (VanillaRAT)", "timestamp": 1689515339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689515339, "uuid": "ff9c02cd-f1ef-4d9b-bd53-5ef3208096a1", "comment": "Malware payload (VanillaRAT)", "value": "8c9c29e59baf663d0b071b9efdec3bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689515339, "uuid": "4b9c16f9-4dce-4076-82fc-b3b37eec7a58", "comment": "Malware payload (VanillaRAT)", "value": "b4d092bdd58610ec77ef6713fe7559c39a52f77d37f8a3c5044e1b95e98f969e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689515339, "uuid": "c698712c-2d33-4beb-81ab-b4a919641a84", "comment": "Malware payload (VanillaRAT)", "value": "dbb8afc9bab40bf175322840b01d474303c38daf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689515339, "uuid": "9828f1e7-bc2f-412a-a102-5e7f92bc0d17", "comment": "Malware payload (VanillaRAT)", "value": "7435432b0b21a72c75bd046b3a703051d516fccb13fcdad28e5278ae203f7e4ebfcb9ca91103c962d3c8e4cf7bdf3b05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689515339, "uuid": "fb830a0e-2e04-435f-960e-c3928d81596e", "value": "T1F244AE5E73D4CAADD87D47FB783111405B31E8CB602F8B1A668092ED2EA27604E727D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689515339, "uuid": "8a42bd96-6497-4cdd-a74c-34f57157da26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689515339, "uuid": "48b13b22-a17f-422d-8aaa-6c9b7d75d6dc", "value": "6144:EJZKBI0RyYeY4eoiJ+sCFvTK2/LZZ3Ru79kkkkkkkkkkkkkkkkskkkkkkkkkkkkq:1yYrZos+xFv5RupkkkkkkkkkkkkkkkkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689515339, "uuid": "201e6e7e-50df-4a7b-ba40-b9d946524da2", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689515339, "uuid": "08e7a7cc-3490-48de-82ca-c63fc58b7201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689515339, "uuid": "924fe1c7-a797-4178-96d4-739a70c5a36e", "value": "Bat_To_Exe_Converter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886c4635-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493013, "uuid": "6a4b21a9-3532-4317-828b-cd8423e949df", "comment": "Malware payload (Amadey)", "value": "d86f13a3db074ef7115f9b305cdf356d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493013, "uuid": "a722f323-c622-43b3-85d5-b8adc1d07328", "comment": "Malware payload (Amadey)", "value": "b62068be50129166f539eb32a63746c4245a497e9b72553efdf326582cc5f4da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493013, "uuid": "372e4725-8190-4940-b597-7c444001914a", "comment": "Malware payload (Amadey)", "value": "d0f7e04a160f577a0fc1f2855d4b2a75705f6a15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493013, "uuid": "c97adda7-c26f-495c-b0d3-75400dccd592", "comment": "Malware payload (Amadey)", "value": "167402b5d9f9c63895ba4696fccd4a180902b6892f619795acf5ad05f522a15a095765c3e110b41fb82332b794ac5299", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493013, "uuid": "0e0e34b3-7486-4ebf-b4c8-3eb1db8f60fe", "value": "T179152303EBD85172EDB523702CFE42831232BDA02AB4461F3756AD5F1DB2594B93972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493013, "uuid": "9dfb6481-de49-417a-b7e5-edffa17efc10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493013, "uuid": "a3e93999-a4fc-48cf-a70a-cdd5faf91b67", "value": "24576:ayCGAwe+RYdJNjQiVFX9ZD9I21pB3C8MMdMxeoG:hCUe+R4JNUilZDH/3MkMxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493013, "uuid": "467c7b17-b287-4aad-9552-a0d914453cc3", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493013, "uuid": "cfc233db-bac6-41cd-a806-41b7cdf71801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493013, "uuid": "9c2df5cd-3cb1-4e90-bfda-5780ebdf2f24", "value": "d86f13a3db074ef7115f9b305cdf356d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8826cb4a-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467242, "uuid": "d611c018-fa0b-4ed0-997b-f8044736d730", "comment": "Malware payload", "value": "6356fde3e71fd2d9cee16d0d37374c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467242, "uuid": "4d7a93d5-02d8-4987-8406-2107ae6aac02", "comment": "Malware payload", "value": "b62db0ddc7cbcf38809c08c573d32f5a5b1c9b585ce0988ec96166376b16d29b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467242, "uuid": "b99e0ee5-64cf-444c-91ba-b43ce1bd1381", "comment": "Malware payload", "value": "f16e2e8a4b247fa4bd0cb09c5044ed21dd84a5ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467242, "uuid": "c4844aeb-5b71-494b-b709-303dbdd79562", "comment": "Malware payload", "value": "460b9c049bf69c4265339363e60847778efef0034dcbbdf846321da2be695bdafb149f00568e8e302f30cc1b00756359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467242, "uuid": "f4e02902-47e4-4c2c-9695-47684209dceb", "value": "T1F1033A0F5FD04876D42186B185344F3EEBB3E5A70362C8DB92A0E6991EB85C1F97930E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467242, "uuid": "480b2424-5cdd-472f-bcf3-2f649fb4bd95", "value": "fabe40eef580dcc8c880e6dd603214aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467242, "uuid": "723ad1fd-7698-4b70-9116-2cea7da7e27b", "value": "768:8frmnJ8m3qWUNCRXwSC2EbIZ4Ih3FsTSuBx8:8fcJAWLXwSC2Eb493F8Bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467242, "uuid": "f655e37e-23aa-48eb-a424-1b7835ea72f3", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467242, "uuid": "a426a39d-4eeb-4506-aa43-74e710dfea09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467242, "uuid": "0a66a8cf-435e-4dbb-a312-6173b0857e6c", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.6568.32173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8d4857-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491763, "uuid": "e90ebbb9-40e2-4a40-8649-ca03e2cb5bae", "comment": "Malware payload (Amadey)", "value": "3084e5a05ec994a172379bb42d1f4a6e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491763, "uuid": "be577dea-f471-4b08-b20c-2facc03b78fb", "comment": "Malware payload (Amadey)", "value": "b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491763, "uuid": "0f7d9805-6dbb-4c2d-88aa-58154afe4080", "comment": "Malware payload (Amadey)", "value": "d5705086a050a075520d1e19aa047f924e079ba5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491763, "uuid": "90349149-b8e7-44ed-aaea-275a7823d50e", "comment": "Malware payload (Amadey)", "value": "3ead1ac7b4456c6799b331cb78ab83a694f04080a0bba605887f3bc2a963b9e3d1206a1bc90faa93e1740bf93155f48b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491763, "uuid": "3bbbe116-7fd9-4f8b-ae96-062549dbfc12", "value": "T1D7452346E3E58573D97927700CFB07935A79BC414A61C36B2798B88B1C73E90B236B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491763, "uuid": "eba247b3-85a5-43ee-b591-1d4a006de37a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491763, "uuid": "88b49412-a9f0-4c5e-ae1f-43bd1b1eb2e9", "value": "24576:my9QoTLxsXrQ8m0Y3lsvmLEBXibYVetVVosYmmL9hK:19Qwss8ytLqqYjsJmJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491763, "uuid": "cdcd1779-0f83-4a5e-aa86-043a5d04d70c", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491763, "uuid": "54f3837d-98b1-43c5-add0-8ff786955fdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491763, "uuid": "6ad2f309-8d63-4d73-8ed9-bd55f524bcc7", "value": "3084e5a05ec994a172379bb42d1f4a6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adf24e8-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492104, "uuid": "fcb6890f-058a-4af7-a5d8-7653039de421", "comment": "Malware payload (Amadey)", "value": "5106710fc8e097f3b5043797cd77c3aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492104, "uuid": "486808bd-010c-43ec-bf89-96d19ff9e760", "comment": "Malware payload (Amadey)", "value": "b6fc49cfaa7ce2d75ee5de94420aa008d0e605a52ab36110ba2d54aaa74e32f8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492104, "uuid": "08937b3f-e40f-4529-aa45-1db7fcdc9e9a", "comment": "Malware payload (Amadey)", "value": "56758767237e4f62ba98fb851116a914bcee8cd0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492104, "uuid": "d84379e7-1ca5-46b5-a707-7dc55172164a", "comment": "Malware payload (Amadey)", "value": "eadc0e2b0d43e3f1ac237320f0a4d33324bf682b43eb35922325f0abe0c67f0cda0268a62d079bac3ae4897980e67e10", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492104, "uuid": "0bd5139a-d335-4559-a0fa-30798faaeff5", "value": "T193F4234297EA9133D4692B7068F307C30F39BC715AB9826766966C5E2C331D0B93637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492104, "uuid": "5b32d669-056a-4a2d-9e6f-8e07daba648c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492104, "uuid": "a69c899d-163c-47c2-8fba-c7e2942f2798", "value": "12288:eMrJy90+ZZq99bYnkI5gLLqYJzsBxJFZFI5R1VgkPdFVsI3:7yrZu9bY+7kt2VgkKI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492104, "uuid": "872e8f5c-a457-4cc3-b279-a869392129bc", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492104, "uuid": "5e543403-2d4d-4b4b-a50d-972ab09b2c25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492104, "uuid": "2e08b621-8364-41d3-84b9-b1bcc42cecad", "value": "5106710fc8e097f3b5043797cd77c3aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54061ba5-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1689492066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492066, "uuid": "d15a1a18-41e2-43c9-9cfe-db26ce5fe1ff", "comment": "Malware payload (LummaStealer)", "value": "63dfcc398c3e2bc3fa0ff47386f41465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492066, "uuid": "749ce7b6-0787-42c4-94c8-269c157722ce", "comment": "Malware payload (LummaStealer)", "value": "b78c9c6edd3756702be3d87df39dec7776e412bf4eb93a65c881f2e4a403afe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492066, "uuid": "88517092-b3e6-4c77-bbd4-a02c89cf6888", "comment": "Malware payload (LummaStealer)", "value": "23490cf34a4c3970c86cbbaed3dc671324e89856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492066, "uuid": "d388ff5b-d8fb-4086-a2f6-92ca891b9347", "comment": "Malware payload (LummaStealer)", "value": "564e6ad9bee17824b483117e7efb1645190a184512ddeb0f9ca7306ea0fd9c45b47c711e78a9b7c3e1fb44dd7f6bc315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492066, "uuid": "de6731d2-1376-4ac0-a791-214cf2deed8d", "value": "T1F764011179A1C832F46AB5740925D270EB3EF8706BB58E9773580B6E5D702D2EA3E343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492066, "uuid": "227abfdf-8fbc-48dc-9f78-61ae269faaf1", "value": "ba16f29121f16f7f252e653fd6dc7741", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492066, "uuid": "2d1d2b44-a583-47fb-bd26-b9b19d0f642c", "value": "6144:cL5S1NG6IPg7BsXcmGICGJD0lWGqaVTDqGUPcMRsXK3su2:c01FII7BsXbSsG5VTDqGdKsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492066, "uuid": "16065bf9-daca-4c6a-a933-3aa3dee60557", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492066, "uuid": "fbbe8806-c894-45df-9e0a-e4ffae0449ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492066, "uuid": "2933c440-b270-4244-98e0-dc7ff5c70d6d", "value": "63dfcc398c3e2bc3fa0ff47386f41465.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cc63ad-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529814, "uuid": "8e02b0cf-6e9c-41c2-9faa-550f91d631e8", "comment": "Malware payload (Mirai)", "value": "7b59506c79100e365d04e13230966b49", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529814, "uuid": "b37a037b-3e90-4d7e-baa6-e4c64b856c07", "comment": "Malware payload (Mirai)", "value": "b7c47ce3060080aefdf978bd3a431235db6ea4cab3f8cffe87e272d1b87f9b01", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529814, "uuid": "d20cf352-9ed4-4c72-bced-dcf16a8619f6", "comment": "Malware payload (Mirai)", "value": "34d8749737d140e302dad6c65b68ed2e9eb61d55", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529814, "uuid": "f5e12b43-83dc-4c54-bcce-29f3aa52b2e6", "comment": "Malware payload (Mirai)", "value": "0579c55d5af63cd1aef0d322fe4ab6f89c6d882631e03040d5f5eab26434ce12b60d2633706aab0f401a59c1a80295a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529814, "uuid": "97ccc25e-4d45-42c6-bc04-b627e1a92df8", "value": "T1B2E3F845F8518F13C6C652BBFF5E428C7B2A1768D2EE72039D256F61378B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529814, "uuid": "6df7c949-15d2-4628-b3a5-c89558f9d075", "value": "1536:vZMhJ9d2tNp38zvOfD9JPQeSsnwhRd54V/mITcWcUHcpff3t+HO2D2Q/+hy/l5SY:xMhJKIOhxQeSs84LoWz8tf98WOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529814, "uuid": "e57a6ff4-6dbe-4bf5-a2c3-7a7bbdf2e5e1", "value": 143168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529814, "uuid": "885e1b9a-c894-4f4c-a2e7-ffa8ffb03f1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529814, "uuid": "99453513-2a79-4705-8c6c-ad69c1899513", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ad2c4d-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1689493115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493115, "uuid": "087f1474-869d-46a2-8b91-476d96659270", "comment": "Malware payload (SystemBC)", "value": "16bab536f93bbf833bca053e355402ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493115, "uuid": "1cb003b9-00e8-40f3-89cc-2d74aa8f94f3", "comment": "Malware payload (SystemBC)", "value": "b8c302a27f96d81723dae52638784519772a968b84533a793e69aab74ef08ba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493115, "uuid": "703c4a4f-70dd-431b-8cff-b5bca357b989", "comment": "Malware payload (SystemBC)", "value": "8b7ccbef0fcb0edab800b6ddc0c9d302b0a03374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493115, "uuid": "c122dee9-939d-4949-a4be-6765a88788d0", "comment": "Malware payload (SystemBC)", "value": "38daf8ab50c5afcbca1ad4b3392e6b306710c37af63fe8e283e8dead589caf865753ab0856da382e3bba6100dce62bc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493115, "uuid": "1ebecc6f-e356-4299-bd9f-efda1c1e6752", "value": "T1ABF3D0213DE1C071D51789354D71D6A4AA6FB8235BA5CDAF33AC0B7E2E312E18B66313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493115, "uuid": "902e3d77-a775-4026-9a44-5e07206cc7e7", "value": "f594022c7da59b0652f413c9086c5524", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493115, "uuid": "a39ee018-ae2e-42ef-96e4-275ec5ccbdb8", "value": "1536:OwUFugbhVF1JcLNXAOdTbf6QpfcgDVUZjEvhDPNQ0mb/h2rJI87FZuQ2Tk8lU5Ag:tLLhTL6QpPkEvhjNQ0C0h7vtd5Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493115, "uuid": "590bec8e-b80d-4962-9845-f4d234a82ebb", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493115, "uuid": "d4130c05-a318-479c-bb1c-b387ae2be90a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493115, "uuid": "6fed30ce-a620-4836-a4e1-e1560fb96d93", "value": "16bab536f93bbf833bca053e355402ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d7d64c-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493322, "uuid": "1b0ef384-2533-46ba-be4e-85a6008d833a", "comment": "Malware payload (Amadey)", "value": "1db12dec32fb865aaf6c3a409d8d4e67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493322, "uuid": "dfa1e0f5-866a-406b-b5ec-f236a7ce865c", "comment": "Malware payload (Amadey)", "value": "b9d0703e159bdb826b7054e4939a012fb59eb79b02f86846a309e62921faecdd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493322, "uuid": "6a70cb98-695a-4c67-9eea-945e8b9f0d7d", "comment": "Malware payload (Amadey)", "value": "a700dd3699e1a6ccecbaff9feb0de00c8d46aff7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493322, "uuid": "e0533731-a51e-4275-b487-7015af849131", "comment": "Malware payload (Amadey)", "value": "d3a844993bf1c81ad6f4cfb373b0fa93d0415230298380fdee96d2f8be3438b32da64685aa94d28cbed84d515da055a9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493322, "uuid": "005bc911-6c68-422b-992a-28c65d56e861", "value": "T132F422136AE1A132D8B61BB058F603C30A3AFCA19D748B5B3745458D0DF35E6A9B173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493322, "uuid": "174648e5-fbff-4520-8f9f-063671e878b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493322, "uuid": "050905c0-c5c0-48f4-b442-e91e77ff6864", "value": "12288:OMrUy90X9RbFKXa8/nBs0JKnFSfq1dTjr0SS64fafBwIjUZWjt4lrPux9:eyA7zg5QAcdHrpSHuj+Wjt4N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493322, "uuid": "fbc8149c-8bd0-4713-9475-b2036707845a", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493322, "uuid": "501e3f48-936d-4b14-81a0-5d891f83d96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493322, "uuid": "8d933355-df97-4ef4-8982-356380539d3b", "value": "1db12dec32fb865aaf6c3a409d8d4e67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef0ba25-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689491896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491896, "uuid": "6d6c5fa2-8f80-4633-8c8e-5db12a22dc24", "comment": "Malware payload", "value": "b0278c000628fcd835fc718ead731471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491896, "uuid": "fd505d7c-b204-4656-8eef-c1ae816286ea", "comment": "Malware payload", "value": "ba5ad4eadec07e4a8c028d8cd829c2a1decb5d994a5704736bfc2f0c28ee8873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491896, "uuid": "5f400120-aeae-4ea9-8c28-4d8445d4a407", "comment": "Malware payload", "value": "1abd8419b75d08e510b59bd4dbe6da02103913c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491896, "uuid": "2f735322-54df-4d9a-aba4-086611c8a3c5", "comment": "Malware payload", "value": "13538dd544bfb4708093d7aaf18f05a263fd5307080f7aabfc2920b62ed6c7099d2ef1187d5839d2089e4972e277bb78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491896, "uuid": "dcfc2d15-bab3-448d-8617-06da0af7439d", "value": "T160356D36B89183E6FCB2A0BA65FCF523445C6FB017E11AC347C41AFAC5509C16636ADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491896, "uuid": "2feac07f-4fc4-4a57-b392-2f1d4a7be361", "value": "57423b5afae18340d4d20251213d0ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491896, "uuid": "59d3dad7-af89-412a-82c6-c7fc9f8a62a7", "value": "12288:USiBTTZDpCZ+6VPwEiuHcciBdu9B/uaeWLeZk5fdZV1:RMnEiHpOJh5fd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491896, "uuid": "527c0c05-4855-4a12-9228-e12e15788d4b", "value": 1069363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491896, "uuid": "d7290549-469d-42af-84ba-e2f8b19af507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491896, "uuid": "598d3a94-b3c9-481a-bcde-116f6384ad12", "value": "b0278c000628fcd835fc718ead731471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa1ab15-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467246, "uuid": "e2bb3d7c-80a3-422d-b5cd-5592073941aa", "comment": "Malware payload", "value": "375c5a431ba933a9924aee3b1693f206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467246, "uuid": "1ec95f86-daff-4d7c-8a59-5436ec3b6d9f", "comment": "Malware payload", "value": "bae8dcc5cc33855279d4ce79527bef08e22393e7736fb3c1b58d2cab04fa8cd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467246, "uuid": "b326e2cf-f6b2-4af6-873c-c1a3eb408500", "comment": "Malware payload", "value": "6db73cd5ec684d9b30c2bcc11541d437939e40ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467246, "uuid": "1edeb4d4-d5ed-4de3-95ba-42c15afd4e0f", "comment": "Malware payload", "value": "a97fd126bcb0b88a62ebc1976303b47df5e877013ca64434bec1542b62376a009de6a0ba3d7cac89264e819a0d2d4b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467246, "uuid": "384927e2-0f62-4dfe-9130-d27c65d116ac", "value": "T12F050700BD82C0E5EF0654398CAAE2BEA525BD458F11BAD37294FBEFE7352C1D436245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467246, "uuid": "081554a9-c0fd-4717-8e9b-b99dac23ef47", "value": "c1c81d558313e0a47369bd5994d98e8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467246, "uuid": "9f4bed7f-51cb-4324-8ff7-22cc6a43765b", "value": "6144:H0tEDuTtlJwd/jPN/nwaD28iiqKBsHBZPLGyzGhsF0IWntbS1IgdCEsehSCh7sTH:6rJwVPNNteFQSVCEnhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467246, "uuid": "23e9b35c-dffb-42bf-b04e-41d5a472863c", "value": 824864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467246, "uuid": "69623539-e3d1-4889-860f-744e85b2c42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467246, "uuid": "3babeeee-075b-41ea-b1e2-a402dc4c38eb", "value": "SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.VrBrothers.gen.21403.9170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7541d73e-2383-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689475800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475800, "uuid": "7386bc38-662d-4d58-938e-21a6cd5b8daa", "comment": "Malware payload", "value": "1142f1fe4870ce234afc1e44c5272354", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475800, "uuid": "5ff1f3e1-604d-4638-a9b3-dbe049b66d91", "comment": "Malware payload", "value": "bb077a37f8e2e1c042a602d15c6368bbb63572fbd55b5f9af86f2714587f9d3a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475800, "uuid": "21c4ec10-8313-48d2-b902-53b5ddbc1c9a", "comment": "Malware payload", "value": "99a22844f4af18929cb95ff3679a52539794c9c9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475800, "uuid": "fda64633-0f74-421d-aeff-05b263478bd1", "comment": "Malware payload", "value": "937516a0c13ae269d40f535f01d032fb6cc8ba1a2cd210fcf23fc6e4c1a4ccc02d35fec23bf1e7e72085a1f1b335ecd6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475800, "uuid": "658799ab-5c35-4f08-b6e3-2b3025e368aa", "value": "T1A916F147F358992FD5B7C13606B70736A1964C0A9B43D3173A18B26C2EBBAD05F85BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475800, "uuid": "b827f62c-636a-4255-9bf2-fa73bc65efc7", "value": "98304:jO267dexqnqxjFtOvSXPZhgjTQ9OGqo2iePdlPAqI:a26cxuAC6XBhgvW1o3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689475800, "uuid": "bb2250ed-85f5-4c7e-be9e-7b93c5b9a948", "value": 4209862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689475800, "uuid": "a9b88e45-deba-4d9b-ba5a-5473cda0c0f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475800, "uuid": "ef56f181-04a2-481d-9a8b-cf2bdefe1550", "value": ".apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cca6af0-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467250, "uuid": "74a14a77-a477-42f3-9545-4315878617e8", "comment": "Malware payload", "value": "2cbb2fb002b25996f8f2e98dae066827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467250, "uuid": "c024860b-f45a-4596-8ec6-64a0a65fcc08", "comment": "Malware payload", "value": "bb600f04363cae963add8ecbbce206123536e4a12c60c3e523676d6ea0aa62b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467250, "uuid": "cac85bd5-c816-45ff-8ddf-9b825cccc21a", "comment": "Malware payload", "value": "5e90b1629537ba6e50e8ada0bf110034ad216d30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467250, "uuid": "95aa7882-6292-4e72-9ba3-d7573522aa43", "comment": "Malware payload", "value": "dae6d729179b04b55d865b5cd227640bd19c79e0cdd91c44345650bfffc09f0dffbcd7396352829a702f7444747f0f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467250, "uuid": "4d30c896-6680-4400-ae56-ccfd56cd2a5a", "value": "T118747C37FAD08537C1732A7DAC5F5B58AD2ABE502D2824462BE82E4C4F397817436397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467250, "uuid": "99f3b08a-ccbd-48fe-897d-25ec31a96acf", "value": "54d5ee31fb75bf385d623a13ae63e74c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467250, "uuid": "0a66cb96-7b81-4ba0-835a-24419b76eabb", "value": "6144:M1W5Lyh9fZ36P0uN9bmhwFsCnJQeHZJaF7uYkUewR3:+W5Lyh1ZKBCuhnZaFiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467250, "uuid": "39289a55-14dc-48fc-9e36-ab346fe3fa77", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467250, "uuid": "65bf4cd8-82fb-4a6f-9814-c79cd4452e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467250, "uuid": "8cd43216-b825-4476-b9be-83010919c0c3", "value": "SecuriteInfo.com.Trojan.Downloader.JPHH.19575.30506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac455ef4-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491784, "uuid": "4200b362-f3e6-4786-a33d-8d84383d913b", "comment": "Malware payload (Amadey)", "value": "23f4a44c0cc77486d90c2b5d3db5dfd7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491784, "uuid": "29f83fcf-0909-46a7-b3d4-e34b963fd4e4", "comment": "Malware payload (Amadey)", "value": "bc2ed7f9261c39ac6c835adcdf9ff7f4b70696ce459a50a2645194f5597507f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491784, "uuid": "2f03abf4-f31e-4ba6-9984-afda7d1fd59a", "comment": "Malware payload (Amadey)", "value": "7c42f90496bc5d268c92f2c07846c32b7f7513f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491784, "uuid": "0e296540-cd35-4d1f-80bd-ed0abfdec856", "comment": "Malware payload (Amadey)", "value": "a0026ab2c1964e3c8a6fcf9937e53e78e943a5a8f54facc98cce869fd08f013f9807a3921c66f0534648f5d3d606b282", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491784, "uuid": "0c6e5c1b-bba3-4694-aad7-f7ccf7fb2091", "value": "T1EB452387A9F80032DDB5137009F62787063F7CA0DC28156E36AABA965C32BE57635367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491784, "uuid": "3dc89375-ea8a-4e67-bd5f-8dc5c025af30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491784, "uuid": "92b12610-5a9d-4e91-9703-9a3880081510", "value": "24576:My3sw5khZLecoTZ5TlNzhW4hXNcWCz4YPrwk3iRkrIoDb9nBziioUiDfy:7YhZmTTTlBMmXWt4C1kyhQ37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491784, "uuid": "fb966de9-b86b-4c23-a909-ab124ae6a7ce", "value": 1214976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491784, "uuid": "496ba86d-8c0b-420a-9827-3689f208250f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491784, "uuid": "3ce78064-adb7-4a79-8f24-4c9d1243244f", "value": "23f4a44c0cc77486d90c2b5d3db5dfd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3f8ed0-2411-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689537017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537017, "uuid": "8674c0c5-70d0-4a7b-80eb-5add6a3f56d4", "comment": "Malware payload", "value": "7965debf0eb9ec5f4cf98d5effcd8f4f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537017, "uuid": "8ef61b5f-4532-443f-916b-8ebbd64b464e", "comment": "Malware payload", "value": "bf08ccbdefdaba6a1036fc93f512f950b878a255747b21b591a1da9edfee2744", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537017, "uuid": "11075008-4155-4c67-b3de-bf8aab29bf11", "comment": "Malware payload", "value": "f5d84cc90ef484890f31d026c374c540fb36239b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689537017, "uuid": "6424e73b-d1ee-420b-9498-fac16f32153e", "comment": "Malware payload", "value": "729e9d75f684dc2858e3fcc677a67dae9c838ff2a9f6b209b5b71b16d3d4c244f524a9e6eb155368b990bf806833e678", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689537017, "uuid": "383a885b-6df3-4f02-8585-4cc507ca2d4c", "value": "T15C530682FC81D906DBD4137ABA6E51DE33253399E1DE7207DD126F103ACA91F0DAB252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689537017, "uuid": "cbabc0f8-25a2-4302-998f-7d38044ee47d", "value": "1536:cRvYcnotQXeGk+Bc26GVqRtN1NdPGbQJyI:cRwcnY+SZhZJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689537017, "uuid": "af94c51d-1b61-413b-8a10-1079cd77e1b9", "value": 64044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689537017, "uuid": "628a788f-6cc6-40b7-b433-7e15ed3dae2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689537017, "uuid": "09c5aab7-772d-4e1a-b409-f89359636db9", "value": "0xh0roxxnavebusyoo.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a6f125-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467231, "uuid": "7370f24e-4e93-4aaf-83c6-53fc70274567", "comment": "Malware payload", "value": "704e53aa276e5a387524372b67d0c9e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467231, "uuid": "3ccc107b-b53b-4819-8775-952411a60340", "comment": "Malware payload", "value": "bf1e87a278e291f8bb6fe4a417c1fe73e2a7fca9b4a38269fffb484afb17bb4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467231, "uuid": "286a88a9-1157-480f-b5b2-43338d75bc66", "comment": "Malware payload", "value": "3f30423be1fe35f8aeeb78b9ce36be8e6c0b3b6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467231, "uuid": "58fbe365-49f7-4a8c-b310-0480398c68bd", "comment": "Malware payload", "value": "3fa964fc1e99083d30eb5897e8533fb3db864aef7e59a2f848f54b87bb0bc811cffe57b113629cbee452f21304947146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467231, "uuid": "a7fb5c87-7171-4e4f-8998-2170ebd24a2f", "value": "T19D95019DD60B2307D36B58B0542B9C4CED5E0AE2D63CE57832E2038275152FEB93E69D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467231, "uuid": "86f9878e-1497-42ba-bcaf-550f3e6ceee9", "value": "55ffecbc4969ede7c8b4547067ca1b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467231, "uuid": "4d7c1c5f-85ad-4e09-95eb-19dc89530a40", "value": "49152:cIGeY75FLJPd2HKWGr+736YExN5geiT8/AN7H8:cIGF75Zv2qWI436hxNXiTKQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467231, "uuid": "a40e007a-68f0-425f-98ce-e04f8d43d96d", "value": 1990656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467231, "uuid": "d43bb1c4-ca2a-41dd-bae1-663af5de1531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467231, "uuid": "a3760b90-e6c3-4a97-b38b-c2e0549c0c40", "value": "SecuriteInfo.com.Win32.Packed.NoobyProtect.B.6251.20806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd0faa0-23d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Metasploit)", "timestamp": 1689512721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689512721, "uuid": "fb81dac7-0fa1-4d45-bfd6-93fe52fc33ac", "comment": "Malware payload (Metasploit)", "value": "f9c9ba0f3ed39485334ec6ef47a24092", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689512721, "uuid": "c7297786-ab01-44fe-935b-6d0817b78ce1", "comment": "Malware payload (Metasploit)", "value": "c01068e733eb7056b1c9c6ec8692c379c28fa775445755ee913153ca2e69fc6b", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689512721, "uuid": "eed59dc4-57e5-4632-8be1-64099c59330d", "comment": "Malware payload (Metasploit)", "value": "c815d8dbe3008c84a8a7510e50666b39b0c99443", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689512721, "uuid": "1ae202bb-0475-4bad-bc90-4611e364f8ca", "comment": "Malware payload (Metasploit)", "value": "eed03ce958fa3cdef1002d1d096bcb02a5fa7ccabc21a6c9c44b8bacd5a76c134c8b4ff3484bb47d5fee387c1a465530", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689512721, "uuid": "fa64f762-5af8-4616-93fe-f4c905019cee", "value": "T1B251B52006DFA51DD4D22413BD3EE4810D2D1FAA9AE67C40F4F85660F0C7821E2BA759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689512721, "uuid": "438f8a90-13a4-4d28-875e-6bf2cfffe933", "value": "48:5lgGXX+9Rk9lOMM3j7vMZ/+IInc3uQ313IIR6LtcjStaDWTm+yjWnlLc0lg+tfDq:LgOOMM3vvOmIecj1Ys6xoScDtRmA0lg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689512721, "uuid": "fe5627a4-b838-4593-bb7a-06321c835579", "value": 2972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689512721, "uuid": "07b89576-d173-479c-9968-2b08eacf7074", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689512721, "uuid": "8cb5425a-0297-41fa-bb92-e37c66b840fd", "value": "PriL0nM0.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b12218-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493617, "uuid": "52c4cabe-22e4-4aa3-968c-8ee7ba7224fe", "comment": "Malware payload (Amadey)", "value": "f994359f44b20eb4f3b4ae0ba41e6914", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493617, "uuid": "98afd0c9-7a18-4112-b76c-29cf71478009", "comment": "Malware payload (Amadey)", "value": "c0f9fdfd416b4b497f73551d3ccde81ea0c5d81cc02bda8960a0332b4b9e397e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493617, "uuid": "f91fc24e-a662-4a53-838b-2b41d6b67e35", "comment": "Malware payload (Amadey)", "value": "f3bc49535f2f58b56ec455830b27e3ab1c623e2b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493617, "uuid": "47f05bc4-325c-4963-88fd-61893ebb6b1c", "comment": "Malware payload (Amadey)", "value": "5178d1de39452adbfda658219350d7938d757ab79d61602620905db8351a683a1273e02f282ad18ece9a776b04d2bf0d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493617, "uuid": "b179055e-d10e-486e-8b3b-3bd0fbab0d33", "value": "T131152316F7D89032D6F613B018BA42830A3A7DF44E36434F3349AADA2DB35849A75777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493617, "uuid": "d90e3351-a478-4c80-a36f-965f3db7d492", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493617, "uuid": "f85a1bb9-d192-40b3-86a8-833f7a3b7de2", "value": "24576:ZyHaU4VTWFdODlOVb1OjxZ0iEpmfHg92H:M6lo/qZv0Hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493617, "uuid": "3a0f03d1-1dce-44e2-9a86-8e068ff27ec1", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493617, "uuid": "7022c7ef-83ce-4bdc-841f-d1f5f3450287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493617, "uuid": "741db5f0-5708-4828-9ffd-cd842f73f80d", "value": "f994359f44b20eb4f3b4ae0ba41e6914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fccc157-23f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689525613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525613, "uuid": "c21bb3e8-1920-406d-b389-b000761a5b5b", "comment": "Malware payload (RedLineStealer)", "value": "f813f3f17cc6a471e19bd341f08392a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525613, "uuid": "1a4b4e68-a3fe-4480-ba54-f1832e3b11a5", "comment": "Malware payload (RedLineStealer)", "value": "c1420965fdb80d2925b8ba25a0ac20bb49ee08bc8bbc1537d3e23069649cb941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525613, "uuid": "d061cdce-4408-4d47-8268-3b3165849b58", "comment": "Malware payload (RedLineStealer)", "value": "64478e1a47287924bb970ab9d54cf394202806e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525613, "uuid": "ab792507-d0b8-4417-bf58-86183fee0c6b", "comment": "Malware payload (RedLineStealer)", "value": "0ec0d440137074780972afc6c0ea4ed6a646a8d7237af36082c36c88a15bb311f5a3ab258e8ab48757afe1cba333ccec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525613, "uuid": "2659950c-500e-4b9b-94fa-3f0f206e5127", "value": "T1ECA4194392A17D88EA258B769F1FC2E8B70EF6508F4E7B753218EE1F04B1076D163A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525613, "uuid": "f23775a6-465a-4f4f-ba79-e40e52ac831a", "value": "f3a1a6c560f808b7f46a078e7eba3d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525613, "uuid": "46d17e5b-9286-431d-a612-4fabcbf2e1bb", "value": "6144:uLuv+rzoFOgKVHMQExcYAp0NFWUSShtepNYKB4yYuD5ht5RInaOdLuPFGtT:uavJOhWSYAuNFp6PYuDp5RIaBFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689525613, "uuid": "791d719f-7b3b-442e-9227-b669c3e35559", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689525613, "uuid": "f234b3a6-867f-4759-a828-3e04c1f6e52a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525613, "uuid": "8557e181-2071-4883-8305-e69566fab3e1", "value": "f813f3f17cc6a471e19bd341f08392a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68ddb26-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689493627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493627, "uuid": "9fed59ee-38d3-43d8-9c51-dfa6bc2c332e", "comment": "Malware payload (Amadey)", "value": "9deafb4e1006795e7f23f944063caf96", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493627, "uuid": "d188fcb1-c74c-4dbd-b4e6-11b48d0ee878", "comment": "Malware payload (Amadey)", "value": "c14f785a7001b3ede5b9e0c337bd2675a45c63b7cf9faf801ce1675455496ad7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493627, "uuid": "1650f2f5-4603-4a94-b0c4-1ff957e282cb", "comment": "Malware payload (Amadey)", "value": "d2ce67d027581be78b59a68fb581a98f03313c73", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493627, "uuid": "c13317e3-da48-428a-b9d6-502ef3a1ae8d", "comment": "Malware payload (Amadey)", "value": "7a922ca0c8a62696aca28caed35b730350471bcad6ee1618324ca37d284091f1d3115b89c6b9d573fffd8d2b20d79fd2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493627, "uuid": "e2da11d8-4236-4d2b-8724-5dfad53ea5b1", "value": "T11BF41306D6D84576E8F617B458F703C30F35BD96BC74925B3789AC5A28B2BC4A13232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493627, "uuid": "36b4d2fe-35a1-4768-a970-1e359bcb6290", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493627, "uuid": "1323c20e-ea18-4481-b48c-dae8586685e8", "value": "12288:UMrIy90duxg2th7O233mLTdoQOdfKDTKrxQTbZsYjvoAh/jBqHz5NMbfZ6wy2UL:EyMux37Oi4ajIurImYboAh7ItN1wyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493627, "uuid": "ebf4ee1a-aabe-4584-8838-29ee055bad4f", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493627, "uuid": "3d88bebf-5f92-4dec-b04e-cd4706916e8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493627, "uuid": "a615cb14-658a-4df4-b5df-3afa49b29287", "value": "c14f785a7001b3ede5b9e0c337bd2675a45c63b7cf9fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0db660-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492378, "uuid": "1d568f5d-f735-484f-bc5c-8b5bfc2fddcb", "comment": "Malware payload (RedLineStealer)", "value": "601033ae1bcaaf94d20f7157b8dea60c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492378, "uuid": "0d599a70-23cf-4fff-a618-6f160e1b3205", "comment": "Malware payload (RedLineStealer)", "value": "c2bc49b59e5e1db1de343f8bbb545e4810d90ddbf098b3e8fc57b28aa3141b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492378, "uuid": "08769468-4bff-4a33-b6dd-5f9bd130ac2b", "comment": "Malware payload (RedLineStealer)", "value": "33a37fd9a2d05479fbadb16c595c56771f769b0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492378, "uuid": "469b1686-7c63-4634-b0ad-b26e50b6a762", "comment": "Malware payload (RedLineStealer)", "value": "d718b4d1c35f478d658565c6acc94e3aa448ae8ef2a72f11508f47914319b12a52929fb36a14d0e1ee03455a6066eac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492378, "uuid": "8f7e854b-22e4-4878-848f-57c24fcbfd70", "value": "T159452342A7D44033ECB16B708CF605A30736B9219CE583BA6758AC5D1D726DCB972B3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492378, "uuid": "c098e157-a33f-4a1a-92b8-ae9a86d8510c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492378, "uuid": "ec88fb6f-fa50-4415-ad5e-9462dc0790b6", "value": "24576:yyGpu4AOKi6PHLWff4ZdnfScZJ4ZL/GNI1LfmU97hlINtFkwqx:ZGpZdKT/L6f4ZdnRJi/iefh970Nti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492378, "uuid": "58c85ce7-bfc4-4652-b1a3-0b1ea5075de5", "value": 1210368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492378, "uuid": "9bbccb4b-4888-4790-ae29-6d32ece47279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492378, "uuid": "74528044-da03-4781-91bc-67b8fac8aef9", "value": "601033ae1bcaaf94d20f7157b8dea60c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3d243e-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491467, "uuid": "46e8da18-5666-40ff-8798-69e769f59d00", "comment": "Malware payload (RedLineStealer)", "value": "15710c203f130f4a93b60acb6f086cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491467, "uuid": "57f9f7dd-10de-4943-91e3-8404b874fe53", "comment": "Malware payload (RedLineStealer)", "value": "c3b477707f7f72c4d00ae1a27a116b67737b686c7d3cdb5f853589e7deebf75c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491467, "uuid": "ffce3402-3ca5-47d1-8128-79cec79aaab3", "comment": "Malware payload (RedLineStealer)", "value": "0f5b53544cbb5983dc7e6767d1c2685c88196983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491467, "uuid": "801060b8-10ff-428b-b1dc-b6af39464e99", "comment": "Malware payload (RedLineStealer)", "value": "8c6fd1962a1d7a126a011cc2f1fb6b4c3db4b960f8b980a96e134db9acf15bf08f317ebb27e5a44509d6c62a22ced09a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491467, "uuid": "3cc70760-0c2d-458e-b127-64a8673ab369", "value": "T162152342AAF90457D93A437119FB07570B75BCA3DC7882871B84EC9E0DF2298A5B13B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491467, "uuid": "ac3b61fb-6d8e-4c03-b0bc-1b807c57066b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491467, "uuid": "ff864141-1e55-4721-9213-d15a2fc03e46", "value": "24576:nytJ32CAhkwuPIgEVUTsbhdfJzqOqai74Hb:yr32xexnAv1Ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491467, "uuid": "e8900b5d-6ae1-433e-abd3-84b81915e91f", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491467, "uuid": "62c5bc45-24d0-481a-9650-303374cf25b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491467, "uuid": "5d393285-fe11-4d06-a0ef-3a8f3f779cad", "value": "15710c203f130f4a93b60acb6f086cad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0df8256-23f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689524058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524058, "uuid": "bf21a34e-7197-43a1-a616-8942c7dbd8ec", "comment": "Malware payload (Mirai)", "value": "81d3d9c635c63d974540349d40a02bd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524058, "uuid": "4da4364d-2a13-41dd-8460-a1a43589976b", "comment": "Malware payload (Mirai)", "value": "c4376e52a566211323fc61e10758478c84ba45bfa5fe541c119540aac2dcb1bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524058, "uuid": "83c8e100-31d3-4741-bbc6-c280935b5c65", "comment": "Malware payload (Mirai)", "value": "6e2d8ffaa2989ff786faa598a9b2aaf419232c36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524058, "uuid": "5d50d7d5-c86b-413b-b816-5c5ede1659ba", "comment": "Malware payload (Mirai)", "value": "12266bbd6bd4ca0ad22131a987c329f2c222f1ca596bed3d0bc75c66fdf15fbd5f36f787729abc31211be7160b0a6c0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524058, "uuid": "9423f759-b2a5-4974-b7f4-1acdbffdd3b3", "value": "T17182CF3021AB74A4CBE10431FAEECEC6971A0BB8D1FC36D216596B78C94650661F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524058, "uuid": "6990fdae-4762-4880-9bd9-15f13bdf89ec", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaKhymdGUop5h5l1:2dV0P6+kom0tVAoNvm+to1Ks3Uoznl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689524058, "uuid": "3801a7b4-c3ee-4971-b2c7-e604f323ca31", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689524058, "uuid": "2ec9a700-484c-45ee-bb9a-fcd559dc880e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524058, "uuid": "9074ebf6-3a61-41a5-8f87-d8f162c76378", "value": "81d3d9c635c63d974540349d40a02bd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665fa1e5-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529892, "uuid": "f371464b-4f6a-49a4-9455-3bcd918edb2e", "comment": "Malware payload (Mirai)", "value": "1a141a78ba9c481a6b082fe3685bce54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529892, "uuid": "b5938562-00b4-4a37-be95-a4626648a705", "comment": "Malware payload (Mirai)", "value": "c486506b449d3975690af67c08e19cbc889fe339e265915b9c508636505ca08e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529892, "uuid": "27400b1d-18d8-480f-b036-e07081a9b821", "comment": "Malware payload (Mirai)", "value": "64f353abb2ffb2445fc72741c9a0a981863acd09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529892, "uuid": "40546821-65da-430c-b66d-62b7a4f06300", "comment": "Malware payload (Mirai)", "value": "4fcef01fae9ab5d2646bdf31a2aafdbe2157f99f7fc52eede09644f5292dc08406bb3fb6dbcf1a6c54bf29ce89b9a9ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529892, "uuid": "a39405d4-31ec-42e2-949e-4cd79715312f", "value": "T144D2D0497AD793FA8C89DA7EB71E003630EE74A9B7B18373B305C4534676180E691D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529892, "uuid": "d529bc83-be4b-43e6-93dd-f92b28840a66", "value": "768:0lxKd29WcxEns+V6IHE4RlY990/FzrrOm:Rd29tn+9HEw0aVrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529892, "uuid": "99a8e749-a9d7-45b6-a6b5-37ea2d1ea59d", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529892, "uuid": "52990ee5-33e3-4082-b406-53935d25416d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529892, "uuid": "bd784749-e1dd-4578-9d4b-66b491f9f223", "value": "1a141a78ba9c481a6b082fe3685bce54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f51b415-23a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689490259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490259, "uuid": "92d245b4-958f-4f64-af47-24ae87997e5b", "comment": "Malware payload (RedLineStealer)", "value": "543411786a6f3f38154ef42e6682a246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490259, "uuid": "0f790b09-289a-48d2-b70c-46bb1225a68e", "comment": "Malware payload (RedLineStealer)", "value": "c4bda0c3de36aee1194e365ec5b51dd8b46374663c2dc248b11b3d055af1769f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490259, "uuid": "c5d16754-e01d-4035-a48f-ec5afbdefc52", "comment": "Malware payload (RedLineStealer)", "value": "53d31018baa9db5de2ae74d192cc6837c335c275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490259, "uuid": "0228f3c7-bd81-4cba-9e90-4673dd132053", "comment": "Malware payload (RedLineStealer)", "value": "d6b8c1e7e64a58d7d4ed9e3fb37f921036d7cc54d5d8795e916266aa96c2b0a8f199800e4c5d67b0cce76d2d00683989", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490259, "uuid": "8e8e1aa6-6188-4388-a09c-296708aae147", "value": "T18AF42287F3E98527D8B81730A9FA03931735BD711878462F27D19E9A08B3A94B0B1777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490259, "uuid": "cddaf2c8-30f3-4d92-93d9-ca5fb3cb7ace", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490259, "uuid": "fbde9c56-0298-4e32-a810-f31e650cd34d", "value": "12288:dMrzy90cQ/kAsgHGhqhrp/zZRFvDFjI/3KSHxn1HGa5vI1fu/ikuHEU:CyGwe5FFvhg6e1mp1fkukU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689490259, "uuid": "65ef38a4-454d-4148-9bc8-b465f70a2ab0", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689490259, "uuid": "b67abfeb-7afb-4330-b2ed-bc68afb21be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490259, "uuid": "013a40b3-208f-4c18-8d46-4d5cba5c902d", "value": "543411786a6f3f38154ef42e6682a246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8dbf49a-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491778, "uuid": "5e622402-444c-46f7-a267-666c0aa323b6", "comment": "Malware payload (Amadey)", "value": "1fb1ce589a990dede07bcea4104cc998", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491778, "uuid": "ba21f02b-46ad-4cbf-b72c-049fc549ca8e", "comment": "Malware payload (Amadey)", "value": "c55c7bcae3c370999da117630a39eeae8642bc789a785381c47580656a3ad0c2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491778, "uuid": "1b3ac1f5-2fbe-4a5f-bf75-4fe480893f38", "comment": "Malware payload (Amadey)", "value": "042e633357c10b3e4673b53a5be5ebf0a2a1f07c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491778, "uuid": "be302b31-0623-45e3-b4eb-1a448307f6c2", "comment": "Malware payload (Amadey)", "value": "789b6d5dfb6bdc60e0d2294c278ec2c07aa7aa57b31ebcb575e4ba350fbd02d0a1fd3a1df2a49dc3b42b0d8a301b530b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491778, "uuid": "1820c63e-7b68-406a-ab49-2e23be2e6650", "value": "T1B1F4124BE5C99022D9F41BB01CF2028717367CA15A3993AE2358DD5E8CB3395E9B533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491778, "uuid": "8f85398a-6808-46b3-8210-4563ecf53d25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491778, "uuid": "3a7f8620-03b0-4105-a954-36f0a686ad04", "value": "12288:rMriy900vHUicx6caWVYapq7wy89p9vfrViRktTCXHNfE:ty3Lcccayt9nrVw9ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491778, "uuid": "c9abf032-4c9b-45e1-9d76-c5f5b171b721", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491778, "uuid": "65c7d7f3-671b-4c9f-b32d-2651ddd3ae9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491778, "uuid": "c1362e84-c9c0-4b93-bac3-d9b4cd0b653f", "value": "1fb1ce589a990dede07bcea4104cc998.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d2cc94-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492704, "uuid": "d102693b-76b2-4b55-b158-468dd1ed53a8", "comment": "Malware payload (RedLineStealer)", "value": "8f0ae8b9143b7c2a9d3ee80fb01e12e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492704, "uuid": "d0146529-795c-4994-b34c-6c367a1a6f7c", "comment": "Malware payload (RedLineStealer)", "value": "c648954590b2b993dd0ec5a577cba1b52011aa076b30819cd9c278d54c229da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492704, "uuid": "4c34001e-2aab-4153-bc4f-81c67dbaca55", "comment": "Malware payload (RedLineStealer)", "value": "89f6a23d8506e9f9225d65cde96557e343ed2ea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492704, "uuid": "3742656d-82b7-43ec-b126-a0fbc570afcf", "comment": "Malware payload (RedLineStealer)", "value": "51c9b04ee681d8729dd2db9a676dbe53bb73117aad72898d92384d8913f5ebc4422b33ab5466301723df8369aeef783f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492704, "uuid": "98a596b3-a582-4985-934f-03f98dfee468", "value": "T13B452341A2E88133D5F597B40CF907534E363EB1ADB14BAA23CAE48F1D321C499757AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492704, "uuid": "b8d2f06c-0a70-4bd3-8272-b3b0efb64198", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492704, "uuid": "dea80fc6-b94c-4708-96ba-ee050cb078c2", "value": "24576:CyLs0yzVqprTMOkQDpNfAv6eht7Q3PcTUahfoMx7pMeW:pw0yBqV4pQDpSvdht7Q3P4N7pMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492704, "uuid": "93c303b0-3cf2-405c-8d41-50db577c0d61", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492704, "uuid": "5140c5aa-f66d-42af-a318-ed3e0f0f672e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492704, "uuid": "0ba04b15-bfe5-4912-8838-42aaea99a27b", "value": "8f0ae8b9143b7c2a9d3ee80fb01e12e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ff6af1-23cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1689506836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689506836, "uuid": "f8f96526-dad0-4a51-a890-e849a4491408", "comment": "Malware payload (GCleaner)", "value": "188332f8d229131789a0b760aec2dd91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689506836, "uuid": "26982115-1fdc-4d04-a6dc-4472cb1ef768", "comment": "Malware payload (GCleaner)", "value": "c6820216f0f3c79377dc2fbd0e82971910cccda00efa6de17fe0912076efacc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689506836, "uuid": "af89a35d-5104-45dd-9c76-ef564c64b300", "comment": "Malware payload (GCleaner)", "value": "2ca374c876946334a9f71d3b68f669791e1dc2ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689506836, "uuid": "a9245d5d-7b7d-41c3-a4f9-03a0f4ff7b65", "comment": "Malware payload (GCleaner)", "value": "07dcd1eeb03a9700c6973afd700a829eda870332a668b11c258fa586a1b4ce6cfebd2e768252e6de75cf7578c34ba976", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689506836, "uuid": "f95d1a5b-9336-4e0d-96ce-c7f14322f01c", "value": "T1F4645B4392D0FD54E9295B32CE2FC3E8764EF6508E497BA56129AE2F04B30B2D173749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689506836, "uuid": "01b6e64c-c4a9-4dfd-945c-21fb8a631d29", "value": "0af0ab32fec6d387d477684bace95bf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689506836, "uuid": "a0f1ec4b-76b0-4366-86f9-542972825c35", "value": "6144:FLFccXjKG6w81kQOqQi+dzbObhnjuZpBKZ6oW/aT:FJLj16wrXhi2u5juZbMaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689506836, "uuid": "e04f13d2-e7cd-4f5d-8467-c350e9635fed", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689506836, "uuid": "87574885-679e-4f2f-99e0-2018e219039e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689506836, "uuid": "e0c54e24-03eb-407c-aca2-37e05dd572b7", "value": "188332f8d229131789a0b760aec2dd91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1ed015-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467249, "uuid": "7dfb715e-9024-4533-bbe9-5e353892b3f1", "comment": "Malware payload", "value": "ffa1238b16923849673ee6851bf7b605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467249, "uuid": "7f575e80-b3ac-437a-8d89-3faa5c51d03e", "comment": "Malware payload", "value": "c829f9a0bf5289de546278c939960a01f109d906070b7edca642a5587ae71f23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467249, "uuid": "5158a892-af88-424d-91c5-36491cae4ffc", "comment": "Malware payload", "value": "762cb2544cb60c4bc7e3a02d658f1e45ef5836cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467249, "uuid": "cdd9804a-0f3c-4d79-8858-f70519cbd9d6", "comment": "Malware payload", "value": "f950b4e00b3f9ce25f1b6a7969aa4d4b368bdfdd395d050e1ff5e429a7f8c3ebf13fb95b73bf7d1956dc9ccedd6cdbca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467249, "uuid": "36b1eb20-0406-40ee-8a3a-011d4f1c59bf", "value": "T14AE42399A7D902EAF4784EB2341513294BF82E532BB6D747112934CEFCF6E617D0290E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467249, "uuid": "9706d8df-9789-4b7a-815f-ab39b100196e", "value": "8950f507ff62c535d40ab3cddbbdaa41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467249, "uuid": "b8de6115-0c32-43c2-92d1-8f3d72abb0a1", "value": "12288:A3reLlYPor5u88gpfhp2I7S+fGbcn2SdopSfVZkyeAbT+cgKgLWRf:ASdrg83ffHm+fG+2YdZUXLKoW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467249, "uuid": "bd87dbb8-14e6-484c-a048-15dd1c50ee96", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467249, "uuid": "a6ce2399-0df1-41ec-a591-9acc4a923be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467249, "uuid": "5b81f145-d977-4ad9-8751-e59eaf8ec24d", "value": "SecuriteInfo.com.Trojan.Vilsel.20572.13899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f51064-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492094, "uuid": "05f1ff20-b8b4-42b2-9e5d-1dbbc2957616", "comment": "Malware payload (RedLineStealer)", "value": "358ca3fa0a2d03d11242bb50788af738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492094, "uuid": "7a9d0a1e-db10-446a-8620-0d720bf18519", "comment": "Malware payload (RedLineStealer)", "value": "c884976e6c98b9615e6fb08bb6de22b50e6d970ba1a4be40024e7d43dc715939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492094, "uuid": "1ad6094c-ca52-4b6b-879d-93dc39624231", "comment": "Malware payload (RedLineStealer)", "value": "119dbb37aa07cda87eafc3feb9d1bd3beee0512a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492094, "uuid": "d038bba4-a3c4-4717-8cb4-958e058bc2d4", "comment": "Malware payload (RedLineStealer)", "value": "55ddca95284e5b48d3db6f5930fa7d7c0de9bb91e7fa48466e7a8944a39647bf117b42e7673c7096f14e63d0341a24e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492094, "uuid": "1d68f9ab-071b-43bc-8cb2-947e40a736bc", "value": "T15AF42397E7D8D226E8B6A73464F703831A32FCA1847442173742B95B5D729E4C871F2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492094, "uuid": "7bf68ce6-8beb-4cae-a2d3-f93c45a4e0a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492094, "uuid": "1c8dcf10-1946-4fdf-8e33-234535b8b118", "value": "24576:8y77dDQYhAyLjatVwLyum31nTB/Lm2Gb1GzH:r/dE4Ay/anwLHm31Vm25z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492094, "uuid": "89f200d5-2edf-4f8f-8957-da6b628fffa3", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492094, "uuid": "1dd6a041-8d10-4a1d-a495-5873f6d7d1cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492094, "uuid": "1247b672-b888-478a-97fc-20d17f6043e9", "value": "358ca3fa0a2d03d11242bb50788af738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff3d153-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492408, "uuid": "f17ff308-7132-4177-85b9-529238231115", "comment": "Malware payload (RedLineStealer)", "value": "8643cae1a220ce0cffc9e8905010aff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492408, "uuid": "45499f58-32ac-4fea-8a10-17b085610fed", "comment": "Malware payload (RedLineStealer)", "value": "c97329ee26da4b5b1c1e28705c86cad903040be28eba695d49728b25bfeb0f20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492408, "uuid": "efda1367-1b4f-43bb-8945-33bac5454926", "comment": "Malware payload (RedLineStealer)", "value": "275eed6f40b4cf7e2c1049212129b2b287d93542", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492408, "uuid": "3993b071-e09f-445b-be96-aea54522f5f5", "comment": "Malware payload (RedLineStealer)", "value": "2b511fd22bf5e1c78e586654160615c0e1523733f3ab18b0ee5dbc84b2ae62cff2bcb3a8f4032bdc93a4dd1ed623a4b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492408, "uuid": "400af7c2-51e6-43c7-b4ab-3312776745e8", "value": "T105F41316A7D45033FDF42BB048FB12871B36BC65487843BB2B499A190D72E81E9B9377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492408, "uuid": "bd89582c-b247-49ac-8e63-fd9c4ebb2d2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492408, "uuid": "fced818c-97df-49bb-885f-850c2511b93a", "value": "12288:RMr6y90Fpuw8/fvz90ji6IMNHKeRRadwjb6p8dNn2xL5+Jy6nBw8XV7Hy1:DyK4vz9kz9LuSb6p2M5+gd8XV7Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492408, "uuid": "f5d37a5a-0da0-42e5-91d5-224f77799415", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492408, "uuid": "cd308a49-ed73-4127-b418-046d9b933106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492408, "uuid": "cbd9aa8f-0712-43ba-9f34-a9a2f2cc9e87", "value": "8643cae1a220ce0cffc9e8905010aff3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8beeafb5-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493018, "uuid": "9b8789b0-bbda-4cd6-9592-b42092c7a6cd", "comment": "Malware payload (RedLineStealer)", "value": "d7524c4d988d32cbacc168793d0d3d6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493018, "uuid": "9e4a39fc-bd24-46f6-bf49-fc1288d09961", "comment": "Malware payload (RedLineStealer)", "value": "ca69693a00e3e31362494f38a72358e24be58e45ff7c48e55e1096b855116ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493018, "uuid": "ba54a5ca-9919-41a5-8502-2b36045b6a01", "comment": "Malware payload (RedLineStealer)", "value": "91f2cad180a3c56459f76332829e662851855af9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493018, "uuid": "3a453598-9dfa-4c06-85bd-5bd031664231", "comment": "Malware payload (RedLineStealer)", "value": "64f7221f86958ed08558f9063fe194b5e09c90f820f7ed7f6209e5bfbc2b9e14cb4344a8f4dfa4ff1f3c62f8aa69130a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493018, "uuid": "1b0447c9-1f6d-47e3-a2b1-55ef6da9a4f1", "value": "T190F41252A7C54432EAB91B7008F647E30B3ABD225DB9539B2786694B0CF2B80653537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493018, "uuid": "eae88598-b575-4014-8b59-45ebdb2013b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493018, "uuid": "b4208586-d336-4357-9d65-e34acfa763a7", "value": "12288:/MrWy90LEn9ECpF3NdVIR1yW4lM8F1X3FjefiMfEWnpzaUJNgIoQ4kusICX:pyVeyNzIynV1X3Ve6MfpnHJfoNG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493018, "uuid": "303ec158-c928-4a6a-aada-6593a81bbf28", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493018, "uuid": "db9ffcf4-ec9c-4a87-9935-ad2df7a3e8c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493018, "uuid": "1dc0fb0b-7c4c-44b6-b236-10db79f453fd", "value": "d7524c4d988d32cbacc168793d0d3d6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b37054-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491765, "uuid": "ea1584f4-2bf4-458f-b1c9-baaadf675ded", "comment": "Malware payload (RedLineStealer)", "value": "182c7282a0ce3f4b3167518c8a2f9d66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491765, "uuid": "10cc3c32-79d8-4d78-907e-79125f9091b7", "comment": "Malware payload (RedLineStealer)", "value": "ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491765, "uuid": "6a57a1c9-f4b3-4420-a91e-01454cd330fb", "comment": "Malware payload (RedLineStealer)", "value": "7277f55f22c18008840d4aa0c65721df2129d761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491765, "uuid": "fb46cf53-6f0d-4847-ba11-7decca958a37", "comment": "Malware payload (RedLineStealer)", "value": "97b96be7e133d5708a76869dc149058a1ec4e06ee08d461f2999224f62530f96ac54b902fe312c54383a27632b3a49d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491765, "uuid": "c2094448-7bed-4fee-bc15-7c18dc58afbc", "value": "T1791523077BD84523CDF8677008F303830B3A7DA59A7A925F2695E91E0A71AC4683777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491765, "uuid": "a61e7c63-6f35-4ad0-b1bc-b2c07bdf1906", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491765, "uuid": "f9d2e915-6291-484e-8374-d20ab5c13d3a", "value": "24576:UylKFVXmbDRGB2xA30pIMporMtfc/FgIHs8:jEVGFGB2CkpIuPtfees", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491765, "uuid": "275a92f6-8bdc-48d7-aa48-295f84abbdf0", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491765, "uuid": "ddb7ed59-a6d5-4a4c-acc3-3ec47f44879f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491765, "uuid": "a28f1b9d-72d9-4b50-8466-826acc6e5d86", "value": "182c7282a0ce3f4b3167518c8a2f9d66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa27565-23ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689494224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689494224, "uuid": "21b1556e-6a73-438c-a3fe-813316a55a93", "comment": "Malware payload (Amadey)", "value": "7ffad6f51f9598958204eca8679690b0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689494224, "uuid": "6f34ff56-bf6a-431e-87c5-f95c993c8016", "comment": "Malware payload (Amadey)", "value": "ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033aa44b45de07f87202a4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689494224, "uuid": "e3f4b407-babe-4fea-9c5f-b7ae80f8df28", "comment": "Malware payload (Amadey)", "value": "aac9ca0423c177d041dcb22832f581d8c39bc184", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689494224, "uuid": "bb55b088-4029-40d9-8463-da37ad307b16", "comment": "Malware payload (Amadey)", "value": "62a3ae42fb5940c9b0976221914d6f27733a34f9d60115baa9de3f0fc8655d0d020c44e848e32bd489fbebef0123905b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689494224, "uuid": "d50eeca5-cbed-4688-aad4-bd18ad746824", "value": "T14DF422536AE85173E8B81F7414FA03871E35BD769C29479B2312B45B4CB3298E8327B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689494224, "uuid": "52c40a04-b8f7-400b-82fb-ff56409b62b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689494224, "uuid": "cce748bb-66db-48dd-aa49-2537a7fd16cf", "value": "12288:uMrLy90EtWzfh9lViybaDJcyMYLk4hC+D+SjbIyWAcDSGb1cqSU0Rzyqj:xyfWFARJcyjJhBNmdcqL0wqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689494224, "uuid": "fe3e5997-49b0-49c2-8a49-3116f1c414f4", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689494224, "uuid": "ce4f67ad-513e-4963-a0b9-51ed03544bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689494224, "uuid": "0bf008df-2cad-4eee-871b-97b7700bc474", "value": "ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a50a67-23fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526972, "uuid": "0f1e9910-8b51-4012-ae51-aab0e2c24ae9", "comment": "Malware payload (Mirai)", "value": "c9cf2d17096abceecbdacb5653c6f48f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526972, "uuid": "adcdde36-ab8b-415f-b88a-cb966ef03288", "comment": "Malware payload (Mirai)", "value": "cb016207683e2abcebaef0b151684ab1ca0109bd2595f7dce1465ae84c962674", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526972, "uuid": "b9ec3cde-7a71-4774-a232-15803054992d", "comment": "Malware payload (Mirai)", "value": "3a3478af142c3802909fef5eff3e3fb808341300", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526972, "uuid": "b0e8f134-d524-4740-a57b-63231b062be5", "comment": "Malware payload (Mirai)", "value": "5aff9fa025fdd98b11235d518a61c0d501fdb89adaddf407b1b5ce7b6715dd1e643d5457cc5977b9b66f364abb7cfc37", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526972, "uuid": "340fbb70-ee9a-44e1-97fe-369975829866", "value": "T138D2E15FD4B7E130E0B7ACB130760744DCB620139719671A08EA8EFA1D879EA6F70D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526972, "uuid": "79c6e75b-189e-4ab8-accd-41f29e348d72", "value": "768:sYSoXdJZZ2PuVkao7Fo8kNHsN+soB+jOSx0sf:sYJdJZjUkNMN+vB+jxtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526972, "uuid": "8c724c02-91f1-4602-959f-9113f7e6c5fd", "value": 29424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526972, "uuid": "2ca3f82d-63f7-40da-a88b-170589af0394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526972, "uuid": "c52c3d29-7f59-44e5-95af-095695fc66cc", "value": "c9cf2d17096abceecbdacb5653c6f48f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae881703-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491788, "uuid": "3a718658-3a2d-45d8-af03-e9b5fef4adc2", "comment": "Malware payload (Amadey)", "value": "31f42982d966285ac113aab5dd479a89", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491788, "uuid": "5dc38246-c7f3-4a98-bcb4-bb8eefe8cdb9", "comment": "Malware payload (Amadey)", "value": "cb26699444e5c655f743a03d8e7788dcda98878159cf78d72e21e60504463214", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491788, "uuid": "85cb886f-2bb3-47ec-aa76-9692c9eee114", "comment": "Malware payload (Amadey)", "value": "1db238db18993ef9e06a4da6576affb9b794647f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491788, "uuid": "1a587097-b643-4e4c-9f3d-246bcbcd27ed", "comment": "Malware payload (Amadey)", "value": "a72860619ff9ae78bc910ea0c2801218d34a93570bc869ba906bda8bde7c8d4d78d45a12e4c55d54b8cf4c6012b89a5b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491788, "uuid": "0782a162-25dc-4557-b657-04900604f81f", "value": "T199152303FBC9E163E4B12BB428F946830732BC9268B4936B5B4A481F19B37C69571777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491788, "uuid": "d2e72c98-5daa-4247-aa0d-460c3cd9a270", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491788, "uuid": "b76ca554-15fb-4f1a-a9b4-6bfe492d4089", "value": "12288:XMr1y90/qLp9kQhf5tMwZXN5I9oTe09JzynkS4OL6x7FvHNN8+r4gjL1BuK+:eyBLIF+9m6q09JmnmOL6x7FPcu4gjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491788, "uuid": "efa72cca-efc8-4be9-a098-d20722686102", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491788, "uuid": "a7932ed5-4a15-466a-8954-19967efbb1d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491788, "uuid": "6b4c9b02-eca7-40df-a5bd-059548385e85", "value": "31f42982d966285ac113aab5dd479a89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a2e8e0-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689493137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493137, "uuid": "5a44445d-4c97-4dfe-9e8f-68c12f536a11", "comment": "Malware payload (SnakeKeylogger)", "value": "a4f37839caefd1a14b4b1d20a9691195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493137, "uuid": "767fddde-8ed4-4cbc-aef7-31d13e2ec55f", "comment": "Malware payload (SnakeKeylogger)", "value": "cb36a9a864f65b7618d6c24999a3096f343a460b65a4f1472bc9b08d0b922c78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493137, "uuid": "e76e4166-87a2-45c4-be93-8e84ec85ecbe", "comment": "Malware payload (SnakeKeylogger)", "value": "8442a5e7428cb3ba89d11beb8c427969da6610c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493137, "uuid": "d0340b3f-b3a7-42c5-a3bd-bfe26f6503d1", "comment": "Malware payload (SnakeKeylogger)", "value": "3a50d37047e9c722407824889e6455dc1f24ad314aec1b469bdd7bdff2df26eb734adcd3a774a74e75c9f1c41d32a8dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493137, "uuid": "3d5e860e-27df-4534-8d17-bd3e06b24da0", "value": "T151D3271D27F89810E5FF8D7305B15112C776BC42192BCE0D4AC2F55A2A7DAA08E1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493137, "uuid": "ac974743-407c-41b4-9c58-7d68879247b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493137, "uuid": "ae72fd57-8fb6-4501-bb1d-b6b16fffa214", "value": "3072:nOOYz25B+Lq9UZVE+oPU1Ob7PtI8wBjbegbY:Ezeu2RPU1ObhAb/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493137, "uuid": "4c018ed3-2595-4548-9cf1-e3febbbfc478", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493137, "uuid": "126529e2-3203-462d-a280-2dbc6c8659ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493137, "uuid": "8465cdac-95aa-4051-91c7-65471065e27e", "value": "a4f37839caefd1a14b4b1d20a9691195.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb578cf-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492374, "uuid": "776c77a9-66e0-45af-90d2-aa755da018e5", "comment": "Malware payload (RedLineStealer)", "value": "6029b53a99c95c89f05348134130ef59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492374, "uuid": "72c89881-0926-48b9-82c2-a9cfb59e9496", "comment": "Malware payload (RedLineStealer)", "value": "cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492374, "uuid": "e8405ea8-e31a-4e7b-88d0-9bdc7591616d", "comment": "Malware payload (RedLineStealer)", "value": "8bed0b5da45422d839446df8f87dec514b88b848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492374, "uuid": "ec6b2b86-3d42-4556-aa9e-4b4cb9202437", "comment": "Malware payload (RedLineStealer)", "value": "6a12adee3283e31b49737f16e4ae008caf64f1175c2eab252ac0fbd9ef8c171493beb81ba6ef2f3db385aa15097b0552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492374, "uuid": "44e6a6ed-a459-4c94-a9a9-92e716e82f32", "value": "T134F42287B7D90075E8B66B3048FB01A32735BDE05D78822B36D1E99F1CF2289A571367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492374, "uuid": "120b5a19-0905-428e-84cc-8bd4f952621f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492374, "uuid": "2029d96a-2c99-4541-9b9a-2dd42a3b43c5", "value": "12288:1MrOy90ds4JKIlZCuYpzqJ8x0KfiaI/e1lDsyCPLVD+trmFGEkh4aWF:LyAkgC0pKVIIDUPhCtrmFk4RF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492374, "uuid": "383a752f-9d98-4c47-9299-7338a9c7e5ad", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492374, "uuid": "53d072f8-499f-410d-a4d4-9e79deee7c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492374, "uuid": "4b661e06-78b9-47f5-95dc-ee49f5d49eae", "value": "6029b53a99c95c89f05348134130ef59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68c87ac-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491775, "uuid": "bb00bc30-0d2e-4f3c-8109-ded8c096a537", "comment": "Malware payload (Amadey)", "value": "2199db274300ab58c77311c6b9e0be23", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491775, "uuid": "6e50ce87-f603-46bd-b799-6e9a7a5c2e6c", "comment": "Malware payload (Amadey)", "value": "cdb5eed6579773d8fbdb13deb766664ba1c8cc01794790855e61e1564daf62f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491775, "uuid": "efb17d4f-0b19-47f4-bb02-b7d697bc146f", "comment": "Malware payload (Amadey)", "value": "5c0c1820653a4f6488d93a0c144d94b424b79161", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491775, "uuid": "c98dce83-f0e7-49bd-981c-2aa9d0dceb9b", "comment": "Malware payload (Amadey)", "value": "d0d7c01871b13f5c100e1c0c727632d62f4b4bed17e94af7c002e89043a92ca10c7e28329d4ce1556127ee4429ec144f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491775, "uuid": "1066408d-c6a5-4954-9344-78d327dc6e8f", "value": "T1A2F41226B3E49432DC75673048FB13930E367D72987492AF2689A58E5CB26C4F17236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491775, "uuid": "0a6c7d96-ffd1-40ce-a701-0595bd40c67d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491775, "uuid": "402857c4-dc9c-4eb3-866a-3c0db38e1e89", "value": "24576:fy0+A4OJKRWnblTAF1XmuKklajcxqgc/HTA/VV4NR:q0+AdJK3rCk84IL/TA/7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491775, "uuid": "57f327df-8ecf-41b0-b012-90a831162c3f", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491775, "uuid": "e176dc57-7705-4c45-9dee-c4f5c8585c50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491775, "uuid": "a0b765e6-0aea-4345-945d-f0bde5b07d58", "value": "2199db274300ab58c77311c6b9e0be23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6fc346-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491164, "uuid": "376f3b24-5212-4aa4-b892-17fe075526f1", "comment": "Malware payload (RedLineStealer)", "value": "c8a194d77a0007437b9e9ea4807f04ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491164, "uuid": "12227361-85fb-4bf4-a1e1-44932fe061ee", "comment": "Malware payload (RedLineStealer)", "value": "ce914abd03809cdd2c718b97e5173424143ce6ef5280cfcf62b5ffecdbf820b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491164, "uuid": "47a01b79-0a49-4568-a972-92b85d778d77", "comment": "Malware payload (RedLineStealer)", "value": "ef7235f35a97b8b40a649ab76f4866a53fed0eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491164, "uuid": "f0f035c2-ff20-481f-ab2b-55947a8e79f3", "comment": "Malware payload (RedLineStealer)", "value": "92e0eb0fdbfb357baabac58dea31bf4947cc9c072909aed9dd75b986254a3b8a257f0d21f8183cdc762703c917b7a0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491164, "uuid": "975c2e06-6ca5-4b03-8738-b729d1a3d3b0", "value": "T19AA56DA93451B12ED8B330B907DCB1602D5D94B207582AD342880BFEDE9C1FDA7F6D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491164, "uuid": "f29f78a8-d740-4783-94fe-42d4362223aa", "value": "1e70033cc54b7a5a94a0a6c6c717bb10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491164, "uuid": "a631efaf-1658-4db7-91d9-63df45e76030", "value": "12288:rMfEzKjdPldQib6fi2u4qYXu6OsijF/Wyt0rkizFBVn:P2sfi2fcB0zLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491164, "uuid": "ed725092-61e6-4140-8437-48e638a57191", "value": 2109024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491164, "uuid": "a0d70a7c-3476-4edd-844c-e24d257357cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491164, "uuid": "47e580c3-97e9-449e-acf8-eaaf21aa80d4", "value": "c8a194d77a0007437b9e9ea4807f04ba.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652682ee-2408-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689532897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532897, "uuid": "6bf28d99-d24e-4653-9a83-de98593d338b", "comment": "Malware payload (Mirai)", "value": "06fa1da8cbfb28430fbf581c679cd515", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532897, "uuid": "dd4b5784-349b-41fd-932f-41a23032f5c1", "comment": "Malware payload (Mirai)", "value": "d160e03a3cd2dca17913ad9066a077c489bbe82b83fcf8c696c22523042da0fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532897, "uuid": "c0cf15ba-e798-4c5c-8402-84d444ddabcd", "comment": "Malware payload (Mirai)", "value": "f299f0204c45eb1f684def060c579184f51ba670", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532897, "uuid": "2ea32e29-3aa2-4a14-9a8c-f48ddc03a89b", "comment": "Malware payload (Mirai)", "value": "99f9891b2a349570e007dd56c53e8fd63a4de4464466797ca0590fe4b30a3ef0ab71e78ca1c4bcc6c1631327ce7ad355", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532897, "uuid": "4530a587-5dda-4b93-96b9-5159848590f9", "value": "T105D34C46FA418A13C4D517BAFAAF4149333297A4D3DB730699186FB43FC676E0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532897, "uuid": "ba33ae46-a82e-4d34-b7d8-1b9a4bd35d66", "value": "3072:igauByoyut3lfprYiMKJFz7rktQrSXDHUAMM/9zIYj:5auB3yut3lfNYKJFz7rMQsHULM/9kYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532897, "uuid": "cca1daa6-db39-4b35-b43f-2c63cffbd23f", "value": 136322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532897, "uuid": "70085b5d-5898-43a3-9795-07f976514882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532897, "uuid": "d59b0b6f-955f-4e26-858c-51a1330d1d39", "value": "06fa1da8cbfb28430fbf581c679cd515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fdc8e5-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492717, "uuid": "ed0b0f25-2337-4830-91a0-cbfb8047dc1a", "comment": "Malware payload (Amadey)", "value": "a319c1c63399f3f2676d119fca061a4d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492717, "uuid": "55c6c981-7c91-4d86-899a-b6e4d59a51bb", "comment": "Malware payload (Amadey)", "value": "d1a7f2a72465f627dc1cc4d390be4b3ed4306928c671f00694f56abdf45e4a1b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492717, "uuid": "d5b749da-5454-4807-bce6-6522453cf454", "comment": "Malware payload (Amadey)", "value": "01f8bc2cd8353cb15c6a2c6b8481001b42d1454f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492717, "uuid": "d9b3d557-f22f-4877-bb9d-2aabade8d7d9", "comment": "Malware payload (Amadey)", "value": "34b935664b83b84fd21c729559abd7ab6d503cd841d154d3c7738acf3438ac146cfbbbb06032ea36b63339575104dcf5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492717, "uuid": "95fe39bb-d065-44b9-a5e8-4964fa4eb750", "value": "T115F41253B7E88033E9B91F7444F607931A3A7CA19A34975B2395649F1CB33E89839327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492717, "uuid": "813580ff-2351-444e-b52d-f0e5dd89769a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492717, "uuid": "a2a8aa36-b222-47cc-9666-9f58f2c8ffde", "value": "24576:0y5sTzDFl8VzrS/TbfNszsJPaHEZYKML9H:DWTzZIG/nfNs4JPaEZlML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492717, "uuid": "47bf9a54-2232-4720-b2c5-63aa68775014", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492717, "uuid": "ba3bf34c-d316-46b4-b3c8-9d583449ac77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492717, "uuid": "a01fa0f8-d312-45bc-8355-0fe691ad92c7", "value": "a319c1c63399f3f2676d119fca061a4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6ec927-2385-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PureCrypter)", "timestamp": 1689476838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689476838, "uuid": "3e818f5c-f405-4963-ba89-9b67a5bb6bb0", "comment": "Malware payload (PureCrypter)", "value": "31d72b02e22ea85c14519a8baacc46e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689476838, "uuid": "eee3ccd3-8d34-4bef-899c-5181e50a9428", "comment": "Malware payload (PureCrypter)", "value": "d32972bc7baaa30c367bc7c01a0e01078b4754dd5ccd448b1a23ab544e8421fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689476838, "uuid": "9cf44a6d-f87c-4994-ae6e-07e02b3f328c", "comment": "Malware payload (PureCrypter)", "value": "48cdcdbcd3edc99fd45452f7119a93e5848aae85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689476838, "uuid": "5abf62f1-c595-4694-866a-cd40f5d51ee7", "comment": "Malware payload (PureCrypter)", "value": "ace67b38a69fceb387894f3294822283bd90985688a247286f97d11b71edb4050d47de51a0caa670a37c0d2be01e0773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689476838, "uuid": "e39071dc-b5f5-4853-806d-f517b9391536", "value": "T1F873B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689476838, "uuid": "4a6374d3-48a6-420b-892a-260dff0d3fb1", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+IPIC:5Zv5PDwbjNrmAE+MIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689476838, "uuid": "2d71be65-159f-4499-bd29-043c0076cc5e", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689476838, "uuid": "af2d8007-e431-4d1e-8d32-ac3a0afdc1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689476838, "uuid": "3fa5f64c-3bf8-4095-bf9f-a79f03039c42", "value": "BTC Wallet Finder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8987a78-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492691, "uuid": "ffc8c08d-321b-44cd-9569-b65ddd63e267", "comment": "Malware payload (RedLineStealer)", "value": "9615d67bee7cde20a85d84ee37852a10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492691, "uuid": "9afbd50f-1fc5-4a8c-a700-ce85095cc604", "comment": "Malware payload (RedLineStealer)", "value": "d461d330536d29393561c34329138bd832927bbd41ecf604f4cac3ffaccd1ad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492691, "uuid": "637c6ca9-f2a1-429a-b6e5-caad04a8815f", "comment": "Malware payload (RedLineStealer)", "value": "51f30d114399b1459b8700c08e2803b7ade8b62b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492691, "uuid": "4ee26b98-fc39-40b2-aa7b-67b7abfe580f", "comment": "Malware payload (RedLineStealer)", "value": "403460d3bc3f933e61485f31acf358999637261f057f3e89217c92d879ee8900829401bd655b59fa8b63a88cdfd8f399", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492691, "uuid": "174c0ff9-d842-401c-8f1a-6a6c8c9fa6c9", "value": "T173152312B6EE8076DDB91B7008FE0A531E37FC92D5B0862763D9BE9F1462644693073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492691, "uuid": "de32d41d-beb8-4d7c-84b8-f33e3107c37b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492691, "uuid": "219947a2-eaed-4a6b-af3b-4cc69f800c5b", "value": "12288:yMrry90r/rtw6eKxOvVrfLoJe2KYJ5A94zoKu9+7WIwS6pGR9q6XP2k6OXzVdB:5ycrtuKxEjR2g3KXnGYRtPrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492691, "uuid": "b8edbb0a-9970-4f99-955a-0cb64ebaaa75", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492691, "uuid": "950c3eb9-5b69-40b3-bb69-1a4a6e74d55a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492691, "uuid": "e42ce30b-81fe-4906-8ae5-b3acb6b2c878", "value": "9615d67bee7cde20a85d84ee37852a10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a78e7f-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492102, "uuid": "8070b7c8-5cd1-470d-9ef2-d90b2d4982f6", "comment": "Malware payload (Amadey)", "value": "61189875b681ed024e83f2d2420d8c68", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492102, "uuid": "5d015683-8580-4622-92af-c448043537ce", "comment": "Malware payload (Amadey)", "value": "d5a456cd04a5d98ee8f53a2b1f5a21e125581663b750d182ab6f6fb1c12c9e7e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492102, "uuid": "b4941c85-09f2-459b-b1c8-bd2e9872decd", "comment": "Malware payload (Amadey)", "value": "9fea4b5097d883f551c9947b824e8e5ad9ef7999", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492102, "uuid": "1900b311-158c-4956-b182-c614ed7a7f9f", "comment": "Malware payload (Amadey)", "value": "1bac07f6b1431ed4f90922966c8ea770b98ce51c1cc2205ca0e880bf67139deafddc3bf34b87a1c9e50c63f84d905f66", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492102, "uuid": "a7a6ec12-0482-4614-b1f6-074f7f1b7450", "value": "T1D0F42342ABD584A3CEB53F7018FA02D70736BCA14DB582B76784589B4CB27C0B972767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492102, "uuid": "68294cac-39da-4743-ae35-0fa79a4561e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492102, "uuid": "3868c393-927d-4ee5-9880-1b478b4bb350", "value": "12288:IMr2y90pjr5Xfg76Rc9/vETtEXsUjFSEC386NZ7/N4gql+W/eTOn2w:+yQXfguRc9stEXsAMM6H6dEMeCn2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492102, "uuid": "a24a8378-7eb0-47cf-82cc-05227a0c973a", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492102, "uuid": "714d1468-acf5-446c-887c-ae7af5129195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492102, "uuid": "f11eaee9-9987-4eb8-b998-3ea14561771d", "value": "61189875b681ed024e83f2d2420d8c68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b046e70-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689493661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493661, "uuid": "557d3fc6-52a5-4c09-9eb3-c447aa4740e0", "comment": "Malware payload", "value": "d4a1d62a2bb5f790d034ace3de7ecf02", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493661, "uuid": "74470eac-2c0f-46b7-a260-afd9bb239e5f", "comment": "Malware payload", "value": "d5b40e6eda374b6667cad1c0102d2c96988725ec8e0fbc7c04af15c1cbab84d6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493661, "uuid": "23e6d835-0f39-4f35-a3a8-113e570a8dfc", "comment": "Malware payload", "value": "db68fa323d781287245c6071e7af42551d676bf3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493661, "uuid": "373072cb-2c37-4dad-99de-29f923cf991d", "comment": "Malware payload", "value": "d9695321bb48b359f87efb013c9bc0d74fd1e791efc603c97fd3f3a6a7c5adb1a4886065687495f67382e8ca4896702f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493661, "uuid": "22bf9bae-bbba-4e28-b2d9-fde502ee9f8b", "value": "T1F0417B189FD65719E6B35E39A8FAA311D5767806EE16CBCC014092C86477100F4B5F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493661, "uuid": "4d0b0773-f70f-4999-b9fd-e4ffa7b29c69", "value": "24:8i/BHYVKVWV+/CWMlCSvWCxK6DOauSK/+/E4I0a5LA6yR:8O5aDDvWq1OauSK/AI3A5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493661, "uuid": "098cc104-3288-4640-aedb-488ca04ce838", "value": 2264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493661, "uuid": "a832bb28-b000-424d-9894-6dd6a6c87eb9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493661, "uuid": "3a46f802-4678-4e24-a0db-1aea170ccb42", "value": "Shipping documents.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c401cb-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491471, "uuid": "81e81f94-a560-405a-b9a8-aef56058ff3f", "comment": "Malware payload (Amadey)", "value": "08f975e11dc1ad55229d41a5b9a68467", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491471, "uuid": "4a16813d-e151-4353-9732-d0ba4512a5ba", "comment": "Malware payload (Amadey)", "value": "d62f03a5584e3ca2265a79bdd4e0fb0add3d0412b01568178f46f8dcecf881b6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491471, "uuid": "5a612206-a23f-450e-b1cb-e970da997206", "comment": "Malware payload (Amadey)", "value": "d28d15bf11c8ebe5b8a7fea62e6ff7cb7f246a48", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491471, "uuid": "192a01f9-bc58-4a8f-85f0-b847d763b35a", "comment": "Malware payload (Amadey)", "value": "aaa2545cbb274b50df79a79f4c3c0b8b79f08de9c00de125062b19f55e0f81ce2fbf934f559370e1c6544d8613277cc4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491471, "uuid": "a640fc5a-69de-4bc9-92a3-b1378f02a870", "value": "T1D9452367F7CA5433D9B427B059F31B830E397C628D60421F1352F45B2CB3698A5B27AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491471, "uuid": "1eddd7b6-d4a4-454e-bdfc-2e6489d490a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491471, "uuid": "ccf557af-02d3-4195-9e00-d41f2513abd9", "value": "24576:Uyf7nDQrfR/VhGMSS0wAxPDL5aN6Gq9LBgLuKGwzkHzWn1eLCGEp:j3Qrf5GMShpnfGkLBgLuKNzln1eGGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491471, "uuid": "b6f6c9f1-2024-4feb-a619-94e719601fb8", "value": 1217024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491471, "uuid": "e528d298-c6b2-4164-9b06-4f29e7045c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491471, "uuid": "96b02733-48e4-4e49-a036-d1019183c217", "value": "08f975e11dc1ad55229d41a5b9a68467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec176c9-23a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689490554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490554, "uuid": "bbe9e590-d795-44e9-b8d3-754658d99a12", "comment": "Malware payload (Amadey)", "value": "39ebcf56ab4b2fb98a2e2590c5a5a588", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490554, "uuid": "15c7ac97-f58c-4503-bf60-b483118a612d", "comment": "Malware payload (Amadey)", "value": "d77888ac75d20228b7b7d9e6605425cfb9f51ecf0f39863b19981b1598b3a57b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490554, "uuid": "006341a7-9a8d-4a80-90e5-38c810ea830b", "comment": "Malware payload (Amadey)", "value": "90ef0140fb2cd50c8f3f507ec061532252882acb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490554, "uuid": "04af872c-4d53-446f-aa93-0d1ad5016563", "comment": "Malware payload (Amadey)", "value": "b864acd34797122837cb9e52b89608e09c64fa4ba88a5983528b7fc6faf1664ca62a83c8b6fd94b7998733e063545a87", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490554, "uuid": "3b335208-7ff0-4613-ac48-2ca3da0b455a", "value": "T112152302BBE85072D8B5877029FB02C30F3A7CA06E78936F57965D974D726C4A622377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490554, "uuid": "33a0fade-c110-46b8-9753-dc982239c9c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490554, "uuid": "199144ca-83f4-49ef-b83b-7bb0d5f10c2e", "value": "24576:OylPVB7/z8r9NKS/rdlEGOapBK/Aoa2ZLZP:dlHopNKSjkapoFa4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689490554, "uuid": "1514164d-164c-4b42-b7e1-55018e2ae771", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689490554, "uuid": "167ad05f-82cb-4359-a2eb-c07db425173a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490554, "uuid": "68dc8e94-af06-4eeb-a894-3be8c8e74190", "value": "39ebcf56ab4b2fb98a2e2590c5a5a588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1df08e8-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493619, "uuid": "82a14817-9422-4994-873d-7834456ea3e5", "comment": "Malware payload (RedLineStealer)", "value": "b1ecc7d35ef563d6bf0ffc98f4518bfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493619, "uuid": "06e07005-99e7-4de8-8b25-47ecf80fb190", "comment": "Malware payload (RedLineStealer)", "value": "d896e29a6293e0cfefe324fc6c4264f401b96852def907868d94c43048b167b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493619, "uuid": "a08d39a0-a8d4-47cb-bdde-a3720bec707e", "comment": "Malware payload (RedLineStealer)", "value": "f5b64c5ac40aa4313fc541790adde70d2d7058f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493619, "uuid": "3f583536-3a51-46e6-a72f-ae140257ce52", "comment": "Malware payload (RedLineStealer)", "value": "d520ea219e7cd50e6c794b92f5dc9b572617f41d41bc264995dfe658b9752020b9e5f2963f12c9b23de490fe7deef951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493619, "uuid": "5266c7c9-4620-4e36-a2a9-31991aac7c42", "value": "T182F42261E7F544B2EDF61B7409F713C30637BD908E38876B2A4268861CB72D4A53936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493619, "uuid": "c1609eac-bd76-4c63-9b4f-7bf7bdbbb4d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493619, "uuid": "36435569-5bc3-4eee-9123-91565b70554e", "value": "12288:aMray90iMJaQLWjhoF52djs6miCLYrIUevXjqwhr3Qr31uLw97DJa:sy+JaF6Cdw6cEr5ePjqwd3QIwB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493619, "uuid": "ee0402bc-3783-4b6b-93d9-c20eec21455a", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493619, "uuid": "f4e35605-078d-48f4-b9b0-02f0b1ad973f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493619, "uuid": "d22a5729-61f2-4fc0-bc5e-58dd6aaf3af0", "value": "d896e29a6293e0cfefe324fc6c4264f401b96852def90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482e66e8-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495911, "uuid": "4852b6ec-d7ec-427a-9550-0c030c527898", "comment": "Malware payload (Mirai)", "value": "58b1405a5a74a19076280cc403fffe64", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495911, "uuid": "ecce0ac4-a9ea-4128-9ee5-8dbb24cbff6b", "comment": "Malware payload (Mirai)", "value": "d8e90dbf2fe6b69f51c55dab84f1dd625adaf5b5b1ddf5ef72577a4fb39f7365", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495911, "uuid": "6821f85a-caf1-4a9d-af6f-980b2913b390", "comment": "Malware payload (Mirai)", "value": "1803107c7dedf2ffb8bc5b850f8689a04a2d78f2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495911, "uuid": "52ec6d31-d148-450e-879b-2f5834838967", "comment": "Malware payload (Mirai)", "value": "dd10d6b223870526445759e5d2c0e893f1ddf96ff396c22980231f04d3ae4f9f8daa3f18710d7b535cd05dfab2b95c2d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495911, "uuid": "945415d7-6275-463e-a790-df98557298c7", "value": "T13FB33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495911, "uuid": "7bc906ad-df18-4ddb-b769-c6ba3f2147fd", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAl+TRCm7FnVqfJXFWbNb:T9a2aLqkrMIsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495911, "uuid": "2a0c332a-cc51-42a5-9ae0-be0494b8b37c", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495911, "uuid": "a6d4a2a4-910a-4c39-a64d-bf19717a343c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495911, "uuid": "4870803f-f1f1-4995-bee2-7c25fd881503", "value": "58b1405a5a74a19076280cc403fffe64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01572904-2404-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689531011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531011, "uuid": "d8371adf-9514-4300-82c9-d33da6ee33bf", "comment": "Malware payload (RedLineStealer)", "value": "a8dcd1088cd200430129217d92db5f37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531011, "uuid": "97fc80e1-8213-4c37-b35e-c64138a2197e", "comment": "Malware payload (RedLineStealer)", "value": "d994d7e082f3b37dbac42d66f5090a53c52b286a8a29b50c27aa29c8290d9316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531011, "uuid": "951f9ab6-7cfe-495a-bae5-528d3b335da4", "comment": "Malware payload (RedLineStealer)", "value": "8a0270ef4f68ec9eacafcfaa06cb9386647bc824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531011, "uuid": "600da604-d6a6-4139-8e87-32307edadd61", "comment": "Malware payload (RedLineStealer)", "value": "f920c0e15d9897c0267ed3db23f0bcd2121817ee22d4eda07ebe5331d6866d54cbb20e28010144a85f4be54e14e277bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531011, "uuid": "03a4408e-651a-4405-9b4f-40ab84b3f26a", "value": "T198A42A8393D17D48EA258B769E1FC2F8B70DF6508E4D7B653218DEAF10B1076D2A3A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531011, "uuid": "8795ca5e-e0aa-4a46-9f85-85fc143e8469", "value": "510dd539bc8b58414f44caf85838ae97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531011, "uuid": "d6e39a68-0cc3-420e-bdbf-b9116d7189ce", "value": "6144:YLyW78gBpwMUdPki1c3PQz9hv0yW6EHIzS6+l8z3bqXGFGtT:YOEPfX6x1l93J6l8zrq2FO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689531011, "uuid": "aefd2ef1-fd44-4c80-80b7-02d4a0ec7b5b", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689531011, "uuid": "83c91980-d55f-4f99-a10b-0f3601df54b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531011, "uuid": "612e45c6-c8b8-4173-8806-9f9801e5ba64", "value": "a8dcd1088cd200430129217d92db5f37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37978f93-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495883, "uuid": "c730d3e8-b034-45c7-b7b3-854dd8743b89", "comment": "Malware payload (Mirai)", "value": "c8669bbdff42898e109550d469db34fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495883, "uuid": "870a564a-d0c4-45bf-8722-e8e885fad3b4", "comment": "Malware payload (Mirai)", "value": "da5ad601e16b929473a602b4daa1934127c693b64122b64cb5a02f111adc3b70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495883, "uuid": "e1e4acbc-9abd-470f-ab30-bf006d7a74b0", "comment": "Malware payload (Mirai)", "value": "56b2b87a188e2a5777002e8a06279de2a8bdbf7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495883, "uuid": "89d5247f-a8d2-4e41-9312-ba6a9abd3cb8", "comment": "Malware payload (Mirai)", "value": "36b6d6b2e828fc863e711c00b3e7555d30ffe734f0a7a09c25f3caeae67a3367e19d912d43beb47e5d097c3278e7511d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495883, "uuid": "4852203c-cd01-499f-a472-214db434a678", "value": "T1CAC3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495883, "uuid": "8be3e6f8-f95e-4ddf-a623-160d45494d2b", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPQL7ymm/QMurB1nKGNb:SMQplVQamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495883, "uuid": "f3980363-0133-472d-9358-3f983b2d3b74", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495883, "uuid": "73a1e132-5420-4bb8-aa91-e7fc0f2decc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495883, "uuid": "d808a094-0da6-45d7-a4de-f7119e0dbb9f", "value": "c8669bbdff42898e109550d469db34fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d02a20-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491456, "uuid": "2614e037-056e-418a-862e-bc19a99c763b", "comment": "Malware payload (Amadey)", "value": "02c2ae81255a2efea4d6acd6f7940e1a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491456, "uuid": "aebf3726-263e-422b-8ab6-e3725d5c4053", "comment": "Malware payload (Amadey)", "value": "dafe81b3d07f219b61683926c23d67fcf0b1753ff9fe64451acb5d5f4bbba09e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491456, "uuid": "5b825b3e-feef-444a-a48b-db4c47798b71", "comment": "Malware payload (Amadey)", "value": "081dc6355e8ec84d47b7cb3b9d2d296cad206058", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491456, "uuid": "9f5ce90a-ccef-4d98-b2f9-c557d8595d53", "comment": "Malware payload (Amadey)", "value": "6e067e90d0a904578b3ac4417c5abc8c3ffa0f62182d58098cf93a891ecf2da7425d61e6361adada41a94e291652ac9d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491456, "uuid": "e000c627-16e5-46d7-b545-503038357068", "value": "T174F41212A3ED6535D5F42F7029F707C30B3A7CA18DAC82AB2785199B1CB26D45A32773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491456, "uuid": "c9e0f9dd-f082-469b-9a63-eb8e717087de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491456, "uuid": "e5c0b5d0-a32d-4233-b9e5-3d5dd531d453", "value": "24576:iyunvpZH3jQ7FN/5T9M+5oxDr28rv4HvS:JunvpZH3jWT9McotJL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491456, "uuid": "6a1f1525-7ed6-4a61-a91a-0b1d45445cf2", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491456, "uuid": "d21a14b8-9073-47c5-8ae8-ecaec8eb3955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491456, "uuid": "5dd9804d-c480-44eb-bcdd-4a8aa3afcb78", "value": "02c2ae81255a2efea4d6acd6f7940e1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8388d871-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493004, "uuid": "fbd167a5-93c5-4271-b4d9-481d858c4bfb", "comment": "Malware payload (RedLineStealer)", "value": "b4279fa1a8abab99f422a93f4d79f2f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493004, "uuid": "d3657e25-b8c9-4e67-bb57-232c03086b9f", "comment": "Malware payload (RedLineStealer)", "value": "db2419395b2091b54fbda644944d811a11fcb035dba5ab2e6d4b5ee327abbdf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493004, "uuid": "a52dc8f5-ae1f-43e4-945e-3d80c558ead8", "comment": "Malware payload (RedLineStealer)", "value": "ccb6ae065ebbb6744b787bf780123a5c22a72042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493004, "uuid": "ec14bb3c-bfa1-4955-a3d5-19e96893f0c6", "comment": "Malware payload (RedLineStealer)", "value": "d8e98c59de0deed062d1b6e8a95f776e8a8e80921e8fcd7cdaf0afa2ef08f575ed30cbc7adebee3d5520b372648e7971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493004, "uuid": "35e6b7bc-d653-41e7-beab-0b24f15e6f04", "value": "T15E152397EBE404F2CC7123725CF602E32674BC52A8B843576799899E4AF3589E971333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493004, "uuid": "7c9e6d29-364e-4527-be57-a115c3f39568", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493004, "uuid": "54481416-ded7-4799-ad50-d188d0ce36eb", "value": "12288:XMrPy90RZnSp8CTLsV3LprI9+sTyIEhbWNAdsJwNywGEsUJRKEtj4L3S3MMm:Yy8SiCTLkrI9+bIEANAu9lUJRKElP3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493004, "uuid": "1ccaf745-05c2-4c13-a841-742ceeecdece", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493004, "uuid": "d67ac66c-e9d3-460d-8833-422985c06417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493004, "uuid": "ea5dca8e-747c-42fc-9f2a-8a8d55e6061d", "value": "b4279fa1a8abab99f422a93f4d79f2f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6b64fe-23be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1689501156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501156, "uuid": "59ed43ca-58d9-4edd-a293-f37ac9bde3ac", "comment": "Malware payload (Cobalt Strike)", "value": "3323caab86076c122532d5485106ead9", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501156, "uuid": "2ba73389-561a-44be-a2cd-6392ddaade8d", "comment": "Malware payload (Cobalt Strike)", "value": "dbb595e6f3053adb3b49f0e29a045a20682142086277bde01b9d498a809767c3", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501156, "uuid": "c3eeddf7-82a1-4ca7-a985-350150c333fb", "comment": "Malware payload (Cobalt Strike)", "value": "d6e331bc2a1c3cd753e60add2eb0518f0b81aebc", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689501156, "uuid": "39fa2003-2cac-4801-a9a6-73581fa8d9d3", "comment": "Malware payload (Cobalt Strike)", "value": "bc742bddf52b3e4b2b1f70208f96f0a0c140fac1340ca73553bc78229877b758afea6df0eda6f4a5bdd7c1f82e5aa91e", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501156, "uuid": "75eb7bab-5801-4e5d-8675-53f6128c750c", "value": "T1DF648FC67A1C69B7FDD161304083AD0C7A6CBF93BA2C369F358EF2546833E548996E05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501156, "uuid": "d3ed22af-2fad-4f26-92c7-a73560082cdd", "value": "3dc6f4eb746aeda0bc22bdb257ef909d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501156, "uuid": "e1bf88a7-2718-495f-9041-34fcf5c413e1", "value": "3072:cEfDJBzT4mUfzMb6SbIZZn3O9JanIdxtkpitddbT0hsVKGOKsuWoZ:cE4mUfzMGSbgZ3O9Jalp6XHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689501156, "uuid": "e7edd441-8752-4489-86bd-b15a88693698", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689501156, "uuid": "cd9c555f-08e0-41c1-8fea-c76f80e1f5a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689501156, "uuid": "4576732c-800c-4a1c-84ac-0e8f1e628447", "value": "dbb595e6f3053adb3b49f0e29a045a20682142086277bde01b9d498a809767c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a46edff-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529872, "uuid": "ebe28307-4227-47a3-b2a3-3da23b1a032a", "comment": "Malware payload (Mirai)", "value": "d64a3883713eaf321eeb8e079db1629e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529872, "uuid": "f23c911f-a2ca-49ba-bd11-9c8a171aaee7", "comment": "Malware payload (Mirai)", "value": "dc1939a10802f8f90bf808066d149905fc2762f78e148b6b49f7b2dc4f80a2ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529872, "uuid": "556532a5-352a-418f-b9ff-04861ca1b841", "comment": "Malware payload (Mirai)", "value": "149cd9b41a6f511f409ae5d0a8649f4e83f5997c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529872, "uuid": "8f7f4086-8017-4287-b4e5-3bafd627da5c", "comment": "Malware payload (Mirai)", "value": "33e35a90888e52f07d40ca3df7c57d22fbf165f056604e819642c6c4cca7ef37c57659cc2b18bb4a44c4a72f4678ced8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529872, "uuid": "81f2ac68-e676-4382-9fea-a507128aaeca", "value": "T178539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529872, "uuid": "5c674e36-cb88-4f64-a6f4-271b47b4b5c5", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529872, "uuid": "4a0f238c-c56a-4072-bd3c-284ecce8cd35", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529872, "uuid": "1a445560-d021-44e8-abcf-e64c594218f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529872, "uuid": "e0df4618-4e64-41a0-a17d-adaca87b738f", "value": "d64a3883713eaf321eeb8e079db1629e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5f9941-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492721, "uuid": "1e1ec3b4-0615-4888-b990-f0ecc1f3070f", "comment": "Malware payload (Amadey)", "value": "a677ee95a7e4d4a71c374565c3ade125", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492721, "uuid": "50080dc7-6c2e-4374-8d50-b510299f4250", "comment": "Malware payload (Amadey)", "value": "dcd412b0f08ce1f65f9dfec504f95307c46bffac7dedc26b2a444cf77a63aa88", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492721, "uuid": "ca44acb1-4aef-42ab-8a91-6a9f578cec04", "comment": "Malware payload (Amadey)", "value": "d6a984d14ee35778637744c0aa31f8997ba625f3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492721, "uuid": "8119b8ad-2256-4f39-af4b-e75f0737f87a", "comment": "Malware payload (Amadey)", "value": "3a400c3e83c9f06de2481e477a2f690cd1154736453a2ba5a2d72e254e3ce68ff5207daff6131f2cebedf31760b77968", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492721, "uuid": "5fcacab0-88f0-409f-adab-2d20111aedb0", "value": "T157F412A3A7D08572EDB4277028F202C30B76BD919D3CD26F1759AC1A0CB2AD4A475B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492721, "uuid": "24470d7c-d110-4576-83cb-c8147e1f3b82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492721, "uuid": "f156323a-3b97-4694-ba2d-9b6236047a57", "value": "12288:/MrHy90YCYlSpR3SVqgS8ao6BaavvJ58+FWM2LV7pmvY3pTYAtXtUIG0t:YyAYIR3SVF+R5pFyR7pmvapT95ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492721, "uuid": "d781ca8b-9db9-47ce-a2ca-112f7485f6bd", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492721, "uuid": "b1bb8f70-2886-4206-88a7-be8335781275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492721, "uuid": "b934e75c-74bd-4d42-b71a-054225833af1", "value": "a677ee95a7e4d4a71c374565c3ade125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0584ee-23a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689490252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490252, "uuid": "46ad1da4-d093-4ce2-8712-c87017a43f01", "comment": "Malware payload (RedLineStealer)", "value": "17146aa828a0a34cf2f9c94443e776c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490252, "uuid": "0fc83168-6a55-42b0-a51f-a995f2df26f4", "comment": "Malware payload (RedLineStealer)", "value": "dcddf2523a87c54d712f2771df6e3dcf1324864da5f0b98d9c98666e382b55c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490252, "uuid": "c41dd586-fa17-48e5-b270-147697d4da4e", "comment": "Malware payload (RedLineStealer)", "value": "3655648b72663d34bebf05d18850853d89321672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490252, "uuid": "0c792e5b-97ae-4d2b-b557-ac0395468237", "comment": "Malware payload (RedLineStealer)", "value": "059d34712285980f0d070c6ef0853c541ddcbccea62106c9f8f589051f75e772adcaf0978e5028787b23ba60764a095e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490252, "uuid": "ec6495d6-0e7a-4d94-ae13-90bafdc254f6", "value": "T17FF42263B7C89472CEFA9B305DF606832A36BC758D2483AFA75559191DB22C46031B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490252, "uuid": "7a343e10-089f-44e2-8a94-d0948559164e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490252, "uuid": "b0748bda-012c-4fcb-a31d-c97b06759dc9", "value": "24576:VyRXUsg/9jqpBYZULXfR8zs/7SxVlOG1:wm9KYZU7ZOxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689490252, "uuid": "244b3234-c0d1-4b33-9b96-0615ed1ee831", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689490252, "uuid": "2031bc36-04cd-46ef-8460-e23dd3b327c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490252, "uuid": "f295f385-040c-44df-8e0a-0aa4d1d0b68b", "value": "17146aa828a0a34cf2f9c94443e776c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd492688-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689491920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491920, "uuid": "f6302ef4-b906-418f-a795-a58a6befc245", "comment": "Malware payload", "value": "a445868f62630fed63ae86ce5ab27631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491920, "uuid": "5e84493b-bed5-429f-ac7c-775da50276bf", "comment": "Malware payload", "value": "dd8242ce1165f865f6f12966aa5a64d71943a80f9016e3130b77dc9062cb241c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491920, "uuid": "06b594ed-8824-4807-a774-495fe5344012", "comment": "Malware payload", "value": "1a274c207d6ff3eab20a5cac31bc508814ac9359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491920, "uuid": "9999d78a-be19-4c72-9673-3a607fbaf6ac", "comment": "Malware payload", "value": "afde467994381828907357fe66704d75d1d83f53be2d572f70516d04ce8d2e53a45f29b00a20b4af7872d1a4ecc722fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491920, "uuid": "70c849ea-4b3e-4a16-a7c9-dc30aa157694", "value": "T1CB256D36B89583E6FCB2A0BA65FCF523445C6FB017E11AC307C41AFAC5509C16636ADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491920, "uuid": "1416ed1d-6e0d-43f6-ad76-191668407f32", "value": "57423b5afae18340d4d20251213d0ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491920, "uuid": "8bcd4a9f-c8f7-409e-982b-86259c856408", "value": "12288:USiBTTZDpCZ+6VPwEiuHcciBdu9B/uaeWLeZk5fdZV1S:RMnEiHpOJh5fd1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491920, "uuid": "cacb3d91-9d71-4951-b0e3-aa7669937892", "value": 979569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491920, "uuid": "f2071d1c-70d9-4258-b022-3572bf9396ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491920, "uuid": "4d63b9ea-e47a-4310-9ffb-e12c6ab7cf76", "value": "a445868f62630fed63ae86ce5ab27631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e4e799-23d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689509410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509410, "uuid": "89558ff9-17fa-4d37-a7c2-7fba6873e3c8", "comment": "Malware payload", "value": "9f6c2ab67ba17d3e92d95b2ecda7aeb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509410, "uuid": "ed1e8338-4f8c-468a-a858-d56439fb50be", "comment": "Malware payload", "value": "dffca632e4ef9880cbfd078c90ba28a26c062c26bc93b8be1a9467443d92e61a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509410, "uuid": "36989a76-d1e9-4636-a472-7abd2ac1d245", "comment": "Malware payload", "value": "fe106d3af99e8fb96eac43eb7c4abf27af9e1782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689509410, "uuid": "6ffc1a88-fa56-4ea5-9e6a-b766cd196e9a", "comment": "Malware payload", "value": "441722faddbebc961aec232dd6ad7dbdd26b54f458bf4ab636920eaf92894597cbcda28d76c25ac41d43a49b44e4461b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689509410, "uuid": "0a28919c-3904-4e70-82a1-936bfb9b55f4", "value": "T1C3355B17F5EBDEA1CB5A0B3AC09B58001B6896513653FB0F7E4523766D033BB8986783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689509410, "uuid": "7bcdbe38-c3e7-4a8d-88de-444f184c03c7", "value": "12288:UMZH8M4zZei257Q51yWjAg6PqilnZarOX3Fsn+JrkNUMg2yKPk/NKi:ZWzZhCvqilZarPuM3vPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689509410, "uuid": "972688d5-8fd7-461a-91d4-c22935e4ae72", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689509410, "uuid": "bb8d23a3-9cdf-4e08-994b-08b9a5dfe2cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689509410, "uuid": "28b5cc7f-82ab-4c1a-b758-9c939c80c6ad", "value": "dffca632e4ef9880cbfd078c90ba28a26c062c26bc93b8be1a9467443d92e61a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47853a0-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492711, "uuid": "07045469-8ce1-40f7-9811-4aebaf825c6e", "comment": "Malware payload (Amadey)", "value": "9b6fc2ceb98c5c17ad267bb4a040681b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492711, "uuid": "f9b0c853-cca4-4abd-94ab-8922fda2a68e", "comment": "Malware payload (Amadey)", "value": "e07282edfcb694b451084b12ce7c55b59cb92494826ada5fb7bb85b44deb4a48", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492711, "uuid": "82490fd9-b81b-4d85-88ae-55c172e5d355", "comment": "Malware payload (Amadey)", "value": "4e0cecda97dc6a7d0bde6b8e852e8d3a6a9b7128", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492711, "uuid": "938032e1-ca9a-4e27-976e-c03a8bfa38b8", "comment": "Malware payload (Amadey)", "value": "cf43ca4624bc4338318efd598cb5c49c5f178c66b7b47f42da0590e619facb3a20a9dbc4960d56cec1362d2524cd2598", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492711, "uuid": "7e668efc-be86-4e18-935d-1a47175bd036", "value": "T179F41256EAEA5073E93027B04DF713831732BCE29564C2AB274AAC4E5CB37D89474367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492711, "uuid": "135ce9cc-6279-4cf6-a5c9-62a0075b229b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492711, "uuid": "2c9bfe25-4309-44a0-82a2-916774e4f3d2", "value": "24576:GypUGCCqZc/gbYzNnivdT49xHaSWzPCqKb:VsCqbbkNnivdT4rePC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492711, "uuid": "7d438c54-f49a-4478-b3b3-e996b479a25f", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492711, "uuid": "eb508021-a122-4579-a432-0bd3069fe869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492711, "uuid": "e70cc6d0-bfa8-492c-a550-170643b936df", "value": "9b6fc2ceb98c5c17ad267bb4a040681b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d99d22-2374-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689469253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469253, "uuid": "40a9e3f7-882f-4588-b143-820d8a001757", "comment": "Malware payload (RedLineStealer)", "value": "d3860d9c8e4727b97958ea1de21358d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469253, "uuid": "c80e8cf4-ba18-4557-a475-8e013972e648", "comment": "Malware payload (RedLineStealer)", "value": "e083c06f929e43d9cd59a21e5cb751f2c8c951de8b797979234acde6424a94df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469253, "uuid": "bc8f761b-21c0-4c8b-9875-7b0c305ed506", "comment": "Malware payload (RedLineStealer)", "value": "da08b390fb391bea010879582494047ee1679d60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689469253, "uuid": "dbfe5a71-fcf7-422c-a339-441726bda120", "comment": "Malware payload (RedLineStealer)", "value": "714af48161d0a968fa978743b1ab17352c29c3f40240ed43eeb6e460be8bb244f91ef5961e233d35064b6aa63d313aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469253, "uuid": "9397d18e-3267-4296-b0e6-7d4236585c64", "value": "T137752313FAE049F1D4F677B068F551C316343D665820CBBE2B6A459D0C72E98B8723AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469253, "uuid": "fe8462a0-37a7-4db5-9291-f826fc703d09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469253, "uuid": "19a55769-43b5-45b5-8af3-f43dd4942ac3", "value": "24576:8yV/JsFutjl/t3WXjzYhgMnBLyYyDdNa0DW77fSdWmF5gkg0te03ziK/cd:rNJsFutFt3WXEr0ja0DW77eBXX53v/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689469253, "uuid": "92343ce6-5827-47f2-b211-59a1f75a1bba", "value": 1629184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689469253, "uuid": "9380ac81-aa12-4916-b9d8-441f15684e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689469253, "uuid": "c40afcd8-1483-4695-bc37-640065417f39", "value": "e083c06f929e43d9cd59a21e5cb751f2c8c951de8b797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a40388a-23ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689493687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493687, "uuid": "33c8e1a3-32a9-40ed-a420-06af200f9524", "comment": "Malware payload (AgentTesla)", "value": "619e9e60f7286af24b60f2aca7ca2fbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493687, "uuid": "352d1dfa-232f-45c3-ba7e-f4eaef251aab", "comment": "Malware payload (AgentTesla)", "value": "e22fe18d23483ac999a3e2e4eefb58401d36e05ed8d8acc36f77e8fd14212aa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493687, "uuid": "b80aeb2c-8b25-4e67-b9ef-4e12c619f267", "comment": "Malware payload (AgentTesla)", "value": "43790bb46436713e3ea52fd0ec4f1acf86854d5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493687, "uuid": "6b15c2f9-e15e-4b7b-abe2-61007bd0f299", "comment": "Malware payload (AgentTesla)", "value": "d34c066057f5dfdeb82a1861cc50ed4707af34b217dc974c239f1df21b2c6f96e1163d67803dae0bcbdb5bcf0320d8b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493687, "uuid": "24de772f-f5b3-48d7-af7a-24a6f13b29f7", "value": "T158D4CE8573705E22E8ADD2B8241864CDDF78B03E64A6E1265F2A39D15E60F7B731F243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493687, "uuid": "11722cac-b57f-4237-86be-6c4f2dcf7fce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493687, "uuid": "f38b5b1c-9f66-457e-8ad7-6cd642197789", "value": "12288:i21mMUz58iH/9S9OcTAENCj9d1XJrJoA1A+ep:bmDZHlSJTAEgj9vZte+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493687, "uuid": "9fd9a4af-e9c3-48fc-96f6-55ea15a5ee83", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493687, "uuid": "38fdc463-bb40-41db-8682-07005832752c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493687, "uuid": "b3116f1d-0969-44e1-a572-4bd8aa167696", "value": "DHL_Express #xNQkICG50wdm9YE#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb3d667-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492723, "uuid": "88b3153d-c0b4-4a46-bb0a-b19b304afeb7", "comment": "Malware payload (RedLineStealer)", "value": "b3af20e19703a32232b099adf05249b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492723, "uuid": "1e2454cd-2a49-497a-ab61-fbf3dc0323ff", "comment": "Malware payload (RedLineStealer)", "value": "e39c3b21f68bbef5252adada2ea9fea2eeb64cf50e9bb9fe01e6757c0beca196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492723, "uuid": "70f9d5ac-fb4d-4ba5-9bc6-4c5b31b0866b", "comment": "Malware payload (RedLineStealer)", "value": "eaa318717c92501e78acd3f3ae1d23b0b3fc73c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492723, "uuid": "5343d22b-104c-4f67-81a5-de035a5962af", "comment": "Malware payload (RedLineStealer)", "value": "33e406ddac204639df97e7d6b1f8e0b9fc946ad12cf311d6d8cff650479455d8f0375b5cf4334a40994baf8ca1034a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492723, "uuid": "4e5b5a33-184c-48e1-8399-5b553e179a3b", "value": "T171F41243BBD40436D5B527B258FA22930F30BDA15CB8D71A378A6E1E0D770C5AA3176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492723, "uuid": "42ead3f8-e8b8-4735-8df0-8d94f87d25b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492723, "uuid": "a4642a9f-a538-448b-84ac-0e02e3f6b377", "value": "12288:1Mr+y90klG1Z4Btxo8V01WVgFpYSBdy9MiGs+mJ9CWXzOb2P8uqDYj1zAhVQ:TyKMV0EWsSrLu7JJw2PE8Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492723, "uuid": "f3e745e4-0aa3-4729-bda0-9fd8ce422cb0", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492723, "uuid": "9cf3a60d-23e1-441c-9e3e-9dc0cc26af77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492723, "uuid": "a747dd06-a30a-4fb9-9631-09c5ec83f6da", "value": "b3af20e19703a32232b099adf05249b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33bd7cb-2404-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1689531310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531310, "uuid": "b4eae3bf-522a-428a-9e8c-dccdcf915f50", "comment": "Malware payload (Smoke Loader)", "value": "2b88c1e82a11dc98879cb0f8feb67ff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531310, "uuid": "99b5c775-4c69-4e48-bf02-01d284860d9f", "comment": "Malware payload (Smoke Loader)", "value": "e58ebdf4702cc16c7b5626d7e5a169fda32ecb3df251c9f087c8ad7ad6897672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531310, "uuid": "68612758-c79e-47da-8b8a-89d2b1460f07", "comment": "Malware payload (Smoke Loader)", "value": "7aa80a13dfee9b55ceda263cdaa190217b3d99ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689531310, "uuid": "7782bbfa-7f7a-408f-b4e0-82a7464e0d48", "comment": "Malware payload (Smoke Loader)", "value": "8331c74966d876cd5ff49c95ca896b40412f774fb0c80a304f280ad3a0134a52d7305f72e0519615543fc5b5ada11b24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531310, "uuid": "6856b133-8268-431d-9d22-210a74c0ddf6", "value": "T1EC6494439AE17D48EA268B769E1FC2F8B74DF650CF4D7B653218EE1B00B1076D263A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531310, "uuid": "f872223a-3b18-431c-88a5-cf3f8ab96527", "value": "f3a1a6c560f808b7f46a078e7eba3d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531310, "uuid": "e1c10f9d-ada2-4083-b9bd-ec4d24878127", "value": "3072:g/Lh86/F13zzAnoNqkA5Ot6Gr7aTe9R5SnwlgZDGWeT7:YLh5X+dkqOtZnhGnFGtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689531310, "uuid": "2ec045fc-1c95-46f6-b0bf-e17ef3b7c165", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689531310, "uuid": "81b157b6-83a0-4ec7-a5d7-949aca0fbd03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689531310, "uuid": "8f445723-e027-49cc-b71c-e73427ff2e7c", "value": "e58ebdf4702cc16c7b5626d7e5a169fda32ecb3df251c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8cd2af-237b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689472212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472212, "uuid": "deaa3f6c-f732-42f6-bbdf-6c54dc42ae4b", "comment": "Malware payload", "value": "c9494c360801468f9606179870026dc3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472212, "uuid": "9c5bf432-9013-4cda-80a6-79f6c7644081", "comment": "Malware payload", "value": "e5b6ab5dcfc955185a4594140efb530a7627dd11f1dfa588709c9cbafdcd3fc6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472212, "uuid": "a7e38251-8a28-455a-8519-ec8b14f5503c", "comment": "Malware payload", "value": "ba73d308dd3f3db0afc9515c502bf310a44f3212", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472212, "uuid": "0fcab5ff-caef-43c8-9289-465dd15eaadc", "comment": "Malware payload", "value": "d37cb986f4e3045a6065ad8e318f999c0c033f17ce7552f97967546e909efa953d3990158dc7154262e0a194daed9907", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472212, "uuid": "a9e92e31-25b0-470a-9664-6e23665ef9ce", "value": "T154E2E122DB0758F3F6F10CB62B5AC20463A575BCFD0376B6AC1D4339E4D30465A7688A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472212, "uuid": "265823fc-e4d5-4c99-9586-579b89774487", "value": "768:8QCEJ3Eda5gR/GVbBxkIsWdR9tZ8q1IvmRewPygBV3Uw:8QCGEE5EsbD9LfInoZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689472212, "uuid": "699cdea7-7078-4360-be78-54c6790c4ba7", "value": 31760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689472212, "uuid": "db7a4373-78a1-4d00-8beb-b42c23ff3ca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472212, "uuid": "3fdcfeb8-0c00-4d4f-8e6e-551ca4fff997", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64119d0e-2401-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689529888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529888, "uuid": "6a88f161-9b7f-45b5-9fd5-7b7680f472d6", "comment": "Malware payload (Mirai)", "value": "76b320cdbf012bb699cfda812806c06d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529888, "uuid": "66078c61-cbb6-4e59-b244-f4cd717c3eab", "comment": "Malware payload (Mirai)", "value": "e60a8e88df3575ae03b6af893a6770514536f53e0e91d93c8edd35325c346cf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529888, "uuid": "91fc3cef-2ead-46d9-a475-089cf7602e68", "comment": "Malware payload (Mirai)", "value": "8ef4d3425750192b7140d1e30ea016feb4241e44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689529888, "uuid": "2a5fd77a-2000-4e00-995a-97e52e6fd0a6", "comment": "Malware payload (Mirai)", "value": "6b626903f28f8ed972ade07ed04c03c57b05c5b2b1eedf2eb2bb88bb65535d2aef77ea58c46839724bb60d3ff2ebe7ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529888, "uuid": "80d24aa9-c791-4bd7-84ef-6a61dfdf116a", "value": "T1D214B61AAB520EBBDC6FDD3706E90B0135CC945722A83B763274D528F54B64B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529888, "uuid": "1a5b153a-8762-4753-b06d-d1560d6f0f4c", "value": "3072:eaBHf0ps/3zZ0WfvlbsGVZFzQZ4BzaS0XZabQl4KpeI:eCsS31fNbsGVZ+czL6Zacl4KE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689529888, "uuid": "538a5152-e75d-44ee-99aa-e8ac879f0665", "value": 194772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689529888, "uuid": "96bec6e8-0d4d-46d2-a866-1d14c9c722da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689529888, "uuid": "c8fb87bf-9444-4c97-a8f5-6bb700899d51", "value": "76b320cdbf012bb699cfda812806c06d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eae5d88-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492406, "uuid": "1e93ae64-716b-4ce3-9488-d90f78ef6a1f", "comment": "Malware payload (Amadey)", "value": "7bcd85428d4e0d9e625f3bf06b3a57cd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492406, "uuid": "40d57f84-f350-49dd-91c7-8c30121b4f60", "comment": "Malware payload (Amadey)", "value": "e66ee8e6d567f3df0b5fe30b605a605c41919fa8312bc18489632c4d30955fbb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492406, "uuid": "23f654ea-000a-409a-b1d7-353ea884c50e", "comment": "Malware payload (Amadey)", "value": "d1d7237befb9f68cc549a26bfbc733f6807f0fc5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492406, "uuid": "762e372f-775b-4bde-8ada-f4ebd8838514", "comment": "Malware payload (Amadey)", "value": "441d3cc955db310a39c57f833718e53e5220780a420762c410dd941d014621363928963ee08fdf0598ffebae9385dade", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492406, "uuid": "88b90ae1-dea3-4fab-8bc2-572e0af7e1ea", "value": "T1E6152216EBCA5176E8F9573018F652930F34BDA04978472F778484AE8C72685B832B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492406, "uuid": "a96dcd42-2b1d-4c17-8b89-0e3454e6bf20", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492406, "uuid": "22512ed4-f42c-4789-9747-ee3fbec1ff04", "value": "24576:ryWncdnRSY1Z0CPJYnhqkn4b4hGojwi5GfAn:eWnonRSEZPhYhqkn4Etjhso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492406, "uuid": "8b47b9a6-7b5f-4cae-9bdb-fd77e6917588", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492406, "uuid": "94195f35-3442-4fa7-ac0a-11c0d45879fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492406, "uuid": "5081a0c1-86ec-4a08-9b47-324c158c541b", "value": "7bcd85428d4e0d9e625f3bf06b3a57cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca6452a-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492080, "uuid": "3e284f29-c354-420f-ba38-dba7e62feaca", "comment": "Malware payload (RedLineStealer)", "value": "47014cdf7e14e1b0ecbc8031aef15b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492080, "uuid": "18c4c0bd-9823-4483-ac45-ed3cf834b993", "comment": "Malware payload (RedLineStealer)", "value": "e6ba7fbcfe09ac5a8d1d600b7f83327b34c922b1a614e320fc79a9eb2954eb63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492080, "uuid": "416549a3-6d98-42f6-bfa2-cb7b2843e218", "comment": "Malware payload (RedLineStealer)", "value": "4ef392a54de883ecfae9774058e79c4558b3ae2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492080, "uuid": "f85cbea3-fad2-47bf-82c3-a263fba7cf7d", "comment": "Malware payload (RedLineStealer)", "value": "6d1250ca73561380e6f9d070817bbe52e2b78df32c5b6fb762af3f317582cc8b39aca530e9b5ddd602fb2775b1553623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492080, "uuid": "3b1ea30c-67a2-4222-8d3a-b83ab4d55140", "value": "T192152202ABE97432C9A61B706CFB0B935B757C916E78836727D19C4E1CB3644A872337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492080, "uuid": "edf8b1d5-d4a0-4bf4-8c10-b6290400bc5d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492080, "uuid": "459e8cd3-63b9-4b57-a6de-97f97ce57a66", "value": "24576:hyUfvXEGqeINiwLZi/X7ek9aeNr+MD/XLzW:UUfMviUZsX7F9aeAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492080, "uuid": "6fcaa4cc-2075-40d9-9f54-333915f901a7", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492080, "uuid": "fa8b3caf-4c85-4377-bdd5-1317ee6ad3db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492080, "uuid": "5b388c22-86cc-4c3e-8cd3-52bbc36eed78", "value": "47014cdf7e14e1b0ecbc8031aef15b64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aeec776-23b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689496775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689496775, "uuid": "d72ea07e-0254-4a04-9b92-7b6009b2e780", "comment": "Malware payload", "value": "b89473076349af763459a45509950f92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689496775, "uuid": "4bb8fc40-187d-4b91-beff-def08e637cf0", "comment": "Malware payload", "value": "e6e28e6d20bbed485946ca604f99a8eb2f8fcca68c1c7eb0081cdc7370d1edbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689496775, "uuid": "004b2564-6847-4fcd-88b3-ec5878973dc8", "comment": "Malware payload", "value": "6e06dd1c0c01c9bddabd8dc79d00a3c63dd155bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689496775, "uuid": "a8211c39-e20e-4aea-8d49-d567ef7813d5", "comment": "Malware payload", "value": "172faa4cda6fc55419e1cb1108e0f11dda710cd1a5dff558419277620dbc4a08d9e802f45945a88c375f7e0887e78eb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689496775, "uuid": "107f0808-995d-4f79-bde3-b9afc844a0d0", "value": "T18373F706A9919617D5C10B7AFA0F134A73334728D3DF63521E286E74AF87B6F0E3A911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689496775, "uuid": "aaef68c2-3db1-41ad-afb0-135954cffa46", "value": "1536:Jtn5e5N9vEpUb9yapSr3TPIyimlRt8I2UO075PYKPjpZxz:VejlEpssa6/t8I2UO07hJPjzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689496775, "uuid": "57922b09-a729-469b-b0a7-8be9fcc7b9c6", "value": 77681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689496775, "uuid": "7f3fc3ae-ffeb-4e9c-a268-d829f189d94f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689496775, "uuid": "b12a2e69-3053-4213-8f4a-d9603fa23e6a", "value": "SecuriteInfo.com.Heur.20230716082732940275160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830c8b92-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467234, "uuid": "2276a623-e06a-4eb3-b7cb-b9972cf8a3b2", "comment": "Malware payload", "value": "f1cf9cebd7c355b0bf228480a886a1b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467234, "uuid": "b10f4e9a-500e-489a-94de-ff9994e78c04", "comment": "Malware payload", "value": "e75127d9f6534ba849a47104741911c25a5e09a28f24b46e68590c8fa2319ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467234, "uuid": "cbf641cf-2afc-4062-b71d-ac078d858145", "comment": "Malware payload", "value": "d285bb11c06d62c2b47cd5c8a36553fc12ec7690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467234, "uuid": "ac5ab802-0817-463d-9df4-7a335c12d261", "comment": "Malware payload", "value": "812800fa29cf4e4a3a41ca16980929918a94b2f45ea0f07cd4266a493b613f9106041c38bc715770d1bdb6bea60dcf19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467234, "uuid": "d4026cff-8357-4874-8a81-ac8724d1b2dc", "value": "T1D3756C22B19B583FC463467579AB8270EC36B620277988577EF0DD0C1FBA581283F766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467234, "uuid": "49259e3c-afd9-43da-a581-675a51c7594c", "value": "8a068ffe251febf2585f97072d2a9e42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467234, "uuid": "7ad0169f-936f-431f-a439-b8758cab0970", "value": "24576:RZAwsA9iz52rodn1B6STz70BsdN7da+9MnKfqW1HG/IT:+Z1cSfYBsbFMncw/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467234, "uuid": "e75c374c-77a9-4fa4-891a-3a500448f9eb", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467234, "uuid": "e69caeff-f791-4ea2-8123-d6b28178de30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467234, "uuid": "b36b93cc-7daf-45a0-9262-8185fe77a46e", "value": "SecuriteInfo.com.Trojan.Heur.EP0@rm3gFjcO.24635.10900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126fa517-237c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1689472628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472628, "uuid": "8c1ee449-5376-4163-8aa8-112916b5e3d1", "comment": "Malware payload (Gafgyt)", "value": "837940846c5bcef3712fde9b64d4ea09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472628, "uuid": "2b6bff34-dc0a-487a-9418-09912d416956", "comment": "Malware payload (Gafgyt)", "value": "e7bc00589b87876baf449bbaae952266dfaa0f5563cf3ff2e41fc24e87562f15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472628, "uuid": "35ab1e16-e23b-4d7b-9002-322672728427", "comment": "Malware payload (Gafgyt)", "value": "56356f1e5569441a553534a331dce564de8db447", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689472628, "uuid": "995b94fc-8c06-4a9d-8ffd-c2d190ebfbd7", "comment": "Malware payload (Gafgyt)", "value": "734d6f12516a019b089729b0d12ff57a113a42546a9ed62d1e140cd4e2a748d29c9c871d59be943287dc489f292608c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472628, "uuid": "749ffd66-259e-4c21-8542-3e047f6ba9f9", "value": "T1C5D32A16EB418B53C4D22776BADB424233239B54E7E723055928AFF43F877AE4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472628, "uuid": "32e3dc23-cee6-46ff-8a51-17b291402e26", "value": "3072:H+DnysopD0njase9LgqbZA+84kbfzK0I6fhQM/9PtFOtmXv:H+LyswAjase9Lgqbd84mlI6fGM/9kSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689472628, "uuid": "6dcce655-82cf-40fd-9761-f25e8d1f70e1", "value": 132632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689472628, "uuid": "0ab72724-7049-4406-b9c3-c9f3344da4f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689472628, "uuid": "2ed982ea-18f9-421c-a47c-c0b3a746e7c5", "value": "837940846c5bcef3712fde9b64d4ea09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b166771-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495862, "uuid": "3b2deac4-5a52-41d1-8629-615e0657f7bf", "comment": "Malware payload (Mirai)", "value": "861bd2696fe971e87a35c651721c9dcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495862, "uuid": "49c660c6-7bdb-47f4-ab00-65cd95afcdff", "comment": "Malware payload (Mirai)", "value": "e811bf16ed714f91180161ad0a93619adbe08ed1034a1737b7c4825eba04bb40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495862, "uuid": "aff4c450-c8be-437a-ba1d-cadc2e3dacd5", "comment": "Malware payload (Mirai)", "value": "36c069d37eb0fef1088759304b09a431bfe6d157", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495862, "uuid": "1193d181-ec92-4157-b198-7cc53aa2d98a", "comment": "Malware payload (Mirai)", "value": "e4579e89597325d21c662d57052e67a0d02b0d3f948e6d1476e5a011c7d4409d24bf5899af8f844d2b7c9f88c5ff0acc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495862, "uuid": "8cf0ac1d-284d-4644-b954-a3f82e59d00f", "value": "T1D0C3F831E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495862, "uuid": "b3dba318-d06b-40ce-8c01-aed9d23ce953", "value": "3072:6jVlyaL5JCrIpv04sRbttiEiTmP46aQyfPlfKsNb:yoCJCN4sRbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495862, "uuid": "5a996b95-b2e8-4e06-b678-3c2fa2589f9b", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495862, "uuid": "de6a633a-687c-4316-bf4d-271d0dbd34fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495862, "uuid": "772d1f45-48ba-4c0a-9022-a6e49a94b91d", "value": "861bd2696fe971e87a35c651721c9dcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0e8545-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493316, "uuid": "0c27113a-7e28-4cac-b289-262d6589f5f4", "comment": "Malware payload (RedLineStealer)", "value": "bdbfa2dbf9c879b6989cc0a3bc87e6dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493316, "uuid": "0efe56f1-99db-4bfa-8293-b7d3a4873a32", "comment": "Malware payload (RedLineStealer)", "value": "e8a8c72510d02dd20d892cd37b3735ba77d079b0e069faf4e6f2eb21d0a45cce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493316, "uuid": "b95035d6-8dd2-49c7-a1ac-6ef8cd2f734e", "comment": "Malware payload (RedLineStealer)", "value": "fd8bc93405c3951c6db8164f30a83c4d3e5e74d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493316, "uuid": "5918f1b5-252f-499b-aa32-6b57f795c583", "comment": "Malware payload (RedLineStealer)", "value": "b39bcd8e1463f847c598b226265942397a42c4f442e7e59e25f4dc81bcbd7d7d56a35bf97060e4460213fc453adda365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493316, "uuid": "68fdc949-8595-46f5-84de-f9ff525b468a", "value": "T158452342BBD8CE62F5771B706CFB12C3093ABD711DB997021A49E94A9CB2584E47630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493316, "uuid": "fc49df76-0aec-4bfe-adc8-e04de368ea63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493316, "uuid": "f3d58c95-025c-4259-afd8-8a9356f2c7c3", "value": "24576:AyRe4gFFGbxvRT067rE8fyCzcuDtwC2YkAsxjpIkJ9dq0l+qC:HRDgFFGbHThM8fySzwjKkJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493316, "uuid": "ddcbd90c-add9-4cdd-be74-32ca1ddf8b1e", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493316, "uuid": "2f29477e-8af0-4a24-82a2-984fde14a333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493316, "uuid": "44f04489-422e-45f0-96a1-b2749e8d5cb0", "value": "bdbfa2dbf9c879b6989cc0a3bc87e6dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a5d605-2407-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689532575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532575, "uuid": "7fa77f1e-09c2-4aa1-8025-5e4828f0a52e", "comment": "Malware payload (Mirai)", "value": "42159ea85b9b677328e1ca705c375c66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532575, "uuid": "e1ecdcd7-3749-4fe0-9140-d9f0c410f84d", "comment": "Malware payload (Mirai)", "value": "e8cc0c50c136c32960a3360fa62f72aac43d852c75ca6688bae5dd26f90f08cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532575, "uuid": "ac2871b5-2b2c-4633-a531-f40ec53f40c7", "comment": "Malware payload (Mirai)", "value": "8928e8704dc68f042e5a191937155ec0997fc614", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689532575, "uuid": "0fae7e90-709a-42cf-b1db-343e379a6dc5", "comment": "Malware payload (Mirai)", "value": "e64a35d702b7306248810b0f57250ecf750b78f5a442412e9b5801388ceeaad224f8c9e808fccc0d8584ab148a72b036", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532575, "uuid": "135a5f42-cd6f-4570-afa4-f779e80cc75f", "value": "T1D8434C0333280E07D9961EB0353F0AE093BFF95126F5B68A194F9B758639E761182F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532575, "uuid": "a5b0b387-b642-4422-9bbf-64e4910faecc", "value": "1536:q01NDkjhWBPe1ZDaDy0wYrVdk/Grtd42+P:qEgoBo3YrVcG7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689532575, "uuid": "b17deaaf-dd7a-4be1-9259-12fea053f988", "value": 59960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689532575, "uuid": "106bf153-a0ae-4124-84d4-3918342f8d5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689532575, "uuid": "2824a327-1875-4476-9cdc-8927c57c6a05", "value": "42159ea85b9b677328e1ca705c375c66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877c8c93-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467241, "uuid": "3c89d30f-8959-4801-9626-61ab5aa2c192", "comment": "Malware payload", "value": "1ae132983a7915a338516f2a66dbd2d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467241, "uuid": "6b3e036f-5657-4a0e-8275-b2181a766061", "comment": "Malware payload", "value": "e9261c5c112efb14b459ef7edb913437270fd50d8569c2f29c4ede2dffb15756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467241, "uuid": "01fdc760-e6d3-4bc2-a3e4-49afcaef225c", "comment": "Malware payload", "value": "399faf40f3306e70af697ae649cf01735d96e06a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467241, "uuid": "95e20e14-d9fa-45c4-ab24-8d79f97ebb3a", "comment": "Malware payload", "value": "09400e669cd7a092f1d64f039e9a3c057894f892f92fcae275dbeeff4a4f20a681bc0318d66b58a79ac755520ac15782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467241, "uuid": "87f07031-167b-4d2c-a741-9f64c2a329d7", "value": "T1B5A3AE4FC80AEDA2D623813024E51FD52B5EAD30149D27737F667D7FEA382484A88B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467241, "uuid": "85ce822c-2e68-454b-a656-9669726b7729", "value": "1536:cjqI124lPB4fZ3guPTKsjyq+mRxVCER/YiGdbhkLvPyv:cjmIBoZQJIFzHbRAik143yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467241, "uuid": "cd314fcf-ebfe-42d2-8d64-94c84bcca550", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467241, "uuid": "648fe726-852e-4da9-9b35-5d37a91eb910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467241, "uuid": "b873b915-178e-45c0-82de-b06c2f8f2a1c", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.2031.25859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cb3f3e-23fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526958, "uuid": "3f5d27b9-a73d-4424-a7e0-efe1fd10cd24", "comment": "Malware payload (Mirai)", "value": "6bec605502e7d68596f56ff4f472be54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526958, "uuid": "38182830-edc8-4685-b97e-0ced247a3382", "comment": "Malware payload (Mirai)", "value": "e9540413e05d1afac997e254c2d5216ec2e7815f3ae4a975b8d85e77ba014456", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526958, "uuid": "4405ac88-0cf8-4a57-b7b6-f4c376e2d456", "comment": "Malware payload (Mirai)", "value": "fa1520199a97230742731d70d78d3d5839a18699", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526958, "uuid": "efbf6067-22e8-441f-a372-4745333983c8", "comment": "Malware payload (Mirai)", "value": "4e7db5ce1d30eee60f7b38e59485a78a531e395fae70113cef2d09337e761431f98a38f4195cd871b1e845784088137a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526958, "uuid": "6e3e0553-29fd-4481-ae75-2971ea22cff9", "value": "T18B539EA5C5ACAE58C61441B8B954CD388723F408A5E72EFBD646C796900BEFCF1187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526958, "uuid": "420a571b-1a76-4980-b9c6-4d98d4dd7396", "value": "1536:PXaA1Nnzd/mUUV7tiYmG6OZSjs7Iofs3wXxrlzN0Z783Cz:PXv1NzdeUUPw9wGMxf+whr5N0Z7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526958, "uuid": "ee9e6e61-3e5d-4763-adba-550378f03394", "value": 63764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526958, "uuid": "18493c14-dd0c-4925-a8d1-acd60fca5311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526958, "uuid": "d9765b9e-cd68-42a0-bc8b-fa7c7d09d817", "value": "6bec605502e7d68596f56ff4f472be54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8d5e08-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493024, "uuid": "397c0d13-aa85-48fd-aeef-e10bc2908eb4", "comment": "Malware payload (RedLineStealer)", "value": "b020b727f7bc43d87049e2877876bbea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493024, "uuid": "27dba735-d965-4b68-9732-68c6c090a78f", "comment": "Malware payload (RedLineStealer)", "value": "e9940bcba465487f21b493f5b605224d684037718f68302eef803e18a54a548e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493024, "uuid": "e7c6f077-dfb6-4fe5-848d-4bcdc17f19a3", "comment": "Malware payload (RedLineStealer)", "value": "74dd153912dccc4f6faa80de86203b3b0bb04c13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493024, "uuid": "c748a5df-6d00-4524-94d0-c4450f16e2ad", "comment": "Malware payload (RedLineStealer)", "value": "c28ce8feb36d1e4d1a545661f0a8bd2733fa6f0e0d2e823f75048b728d6828a7b7aca12716bd321363f3d3be4ef60fba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493024, "uuid": "33ff1718-8369-4bb3-9417-5f4c4e9a1f66", "value": "T1FE45235BB7DD1132C8B50B7594FA23830A357C710D75C6BB2B87A51E8DA3A74D0323AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493024, "uuid": "a01f037e-5776-4d4a-a458-f9f7b39818b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493024, "uuid": "74404a31-a094-4a11-89d3-5d5e4540c471", "value": "24576:jyHTFj7MwktMI+mmMatumPOULbZtJZFrbogC61YYDzSu6P0:2hj7MTqI+mmMFPUpAgCCYYfSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493024, "uuid": "e0299115-28f8-41fa-878c-a978f43de2b1", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493024, "uuid": "463420c8-6f70-4dc4-b1fc-af803cfb3a98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493024, "uuid": "1c9087b8-4919-4e77-af5d-9f145b790576", "value": "b020b727f7bc43d87049e2877876bbea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea26aca-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492110, "uuid": "a11552a9-4984-4d84-b6f5-99be4182194d", "comment": "Malware payload (Amadey)", "value": "582d2409573001d0f0f1c36f9e793a48", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492110, "uuid": "7ff767c2-745c-4c38-93e4-87eaf36c6911", "comment": "Malware payload (Amadey)", "value": "e9cc1f109d1c82bf364eebe1acc2fe748fa28ad7dc091abdd79e36b594a14bf9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492110, "uuid": "814cef36-8ad8-4960-a95a-4752dd7740f1", "comment": "Malware payload (Amadey)", "value": "89347d97a591890443d521e3fcaa365212e39cdb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492110, "uuid": "953443ce-bc39-4013-8e86-efc56a48eb2e", "comment": "Malware payload (Amadey)", "value": "47c2979288d00fde4c7a812458eaee9aaadc5039cd3e73862b7021e18083ce1d0a35603e9eb7cd73de36577cb3652534", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492110, "uuid": "80959a8b-79ff-4d24-8885-4f225aa8b767", "value": "T1D2452387A7E88072D8762B3069F311C7093378919E6887BB5780A9CF3871755B93277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492110, "uuid": "340e8210-82e0-453c-afad-3bac3157347c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492110, "uuid": "95de78f0-782e-4a5e-9941-ed770c3e150c", "value": "24576:By2AUJwmeuL+xVngAAsGV6yhqA/OE83bxiXgAo:02dMu+xJvzU6AqA/Ol3bQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492110, "uuid": "5a4fe29d-c643-40f9-a09f-816e8424275e", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492110, "uuid": "c943e556-bf95-47b1-8fd1-cf37da8eb14a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492110, "uuid": "555ca6c6-2b2b-4763-bbd0-6ccfef510716", "value": "582d2409573001d0f0f1c36f9e793a48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d5cfea-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467240, "uuid": "245a57a0-cdb9-4919-9fe6-65cb040a888d", "comment": "Malware payload", "value": "2834a872a0a8da5b1be5db65dfdef388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467240, "uuid": "f8effcc0-9df9-4232-9760-327c53ad0dd7", "comment": "Malware payload", "value": "ea224f394a75f5e2ac8fe461e5e8ec02a67bcc6cb99ea8dc5f39792f5392ece8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467240, "uuid": "a03db3f1-c56d-4a6c-9746-6beab2af06ce", "comment": "Malware payload", "value": "65850250e4604e6355f43f75eed97d63f924df5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467240, "uuid": "8918529b-2ff5-4e81-a814-7442ec3b5e7a", "comment": "Malware payload", "value": "48c2ed47839a075c2c0a4b81e2ab5ae7bff4d3204df65a5fcc233a71d6960ea7ac1fb05bafcba8d0eac46703d9f820ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467240, "uuid": "6bb39520-1f82-4fa0-ac59-3745f002a418", "value": "T17943D717D928A42AE96186B20937597E182F3D3155509E0B3BC9EE5C1936BC3BCE831F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467240, "uuid": "00acd9ae-a68f-440f-8ca8-352f5427047c", "value": "a59157466ee57de2289b20e0e083397b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467240, "uuid": "4f46d609-fefe-4d2b-a25c-7b5d8fc660b2", "value": "768:4vvevKfkPXXFS7wkx6hAmt33ALnIx9DXkyKohgH0:4e4kfXFS73Bmt33l9YhF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467240, "uuid": "7c111433-bd3e-4e1d-9c11-c105da1103fc", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467240, "uuid": "380171c9-8c1f-414a-a15a-be83c2729d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467240, "uuid": "46f41507-9553-4904-8f81-c51273bf13bb", "value": "SecuriteInfo.com.Trojan.MulDrop4.15370.17779.18679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396d08cb-2383-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689475700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475700, "uuid": "53ecb0a0-634d-46f0-bf9b-984e8dbcdde4", "comment": "Malware payload", "value": "df4113b264ce2871d881666c5279fb90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475700, "uuid": "384c5a8c-2707-4e39-a4cf-0f747c0a1476", "comment": "Malware payload", "value": "ea9306dfa5ae6a2b9998e11494e51acbe6ca6ad34f6c499c2ff1222309dd1b7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475700, "uuid": "71f9f62f-1d59-4dac-a66c-3d389afb3011", "comment": "Malware payload", "value": "651d25a7e91d84b9190c3468bb4d91a5b8627054", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475700, "uuid": "744416e8-8b93-4a4b-846b-54a8a7140ef2", "comment": "Malware payload", "value": "af495081d0d4e8024ac123b7b603483f947123d4d7ee3fc6ee792a76a65b6af5d9abf447e74916fe36307a36b8d3e40d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475700, "uuid": "24fb800b-3b7a-46f7-9d3f-e1ee24594d18", "value": "T157E2F160F0249ED0D9B977F1DDD5E2412BF32E4AAD8109D283A27D051C72B6E2645BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475700, "uuid": "07038369-fb90-4305-a67c-8874f1258631", "value": "768:aRRzRH1CSD6jK4RrdrDjrhrEuc5ngNMS9GSFIixB4uVcqgw02NWX/:a3DMVNVE5c5GmIQ4u+qgw06WX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689475700, "uuid": "32ad0030-8025-40a4-874e-77aeaeecc750", "value": 31216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689475700, "uuid": "a99055d5-ee18-49d5-acca-a30915c8b24e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475700, "uuid": "29494c34-0682-4724-81b4-32e79714436c", "value": "df4113b264ce2871d881666c5279fb90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abd3316-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493016, "uuid": "4b6b65e7-66d5-49fd-8cd8-5a01c8c830a4", "comment": "Malware payload (RedLineStealer)", "value": "d6f0b5f1bb6db2ac09d16f88ad40f249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493016, "uuid": "10d1e73d-a2e9-4a26-8406-cf774d781782", "comment": "Malware payload (RedLineStealer)", "value": "eae2ebbd7384f13f7ddae701193b9c408f5b7b831268f0029bf72e137ba2d0d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493016, "uuid": "55f19e6e-a5b6-4032-a648-6d972af1fd04", "comment": "Malware payload (RedLineStealer)", "value": "2e6960beb908b90e988588fcfab5cfa44bb07cec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493016, "uuid": "8e68f3e8-ed6a-4884-ad0f-c274bc206f81", "comment": "Malware payload (RedLineStealer)", "value": "0f919cc50911a7f044e394bef541b0565060ec6bd0be9c42b65a55c605fe7d55c8863721b06977363d58fea590d470bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493016, "uuid": "89bce3a4-d2ac-4c06-9463-524b46eab092", "value": "T196F42366E7D86133D8F4277004F623C71F35BCE69D78826B3246589A08736A0B97236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493016, "uuid": "2e083853-691b-4689-ac78-00993424968b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493016, "uuid": "8ddee805-301d-4360-9536-16024e3c116b", "value": "12288:vMrKy907an+LseVnTDWZkI1CqPSJiUzRGhkQADBpMjW8Nkyx3Zj6u+yzxFH:ly+a+L7VnGZkmTSAUUJA1wW8bx3h1+yX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493016, "uuid": "f1c67418-7edd-464a-9b61-9e1b0801fb75", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493016, "uuid": "861fde53-fed5-43bf-9a5b-347edb53b963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493016, "uuid": "43c4ba50-fe82-4587-99a8-999173dd4926", "value": "d6f0b5f1bb6db2ac09d16f88ad40f249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f78792-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495877, "uuid": "a8c40dfe-217f-4430-b9c5-8a7b3c408667", "comment": "Malware payload (Mirai)", "value": "1eabacc07f818cdae08fd412534714d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495877, "uuid": "d742dec1-c9e6-4270-a480-983ec73d7708", "comment": "Malware payload (Mirai)", "value": "eb0ca9618b47f5aa7d3998c47966d055c6d20bd9bdc2b9431ff9b6615e3c24b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495877, "uuid": "1ebd4ba1-289e-4683-816b-4db2c0c8a2a3", "comment": "Malware payload (Mirai)", "value": "c53c29c7486059bda1d68c34e4b43d2d01328d8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495877, "uuid": "a4e48f2f-9832-414d-a2dd-61b3d3401d45", "comment": "Malware payload (Mirai)", "value": "752981cb66b95b670fa1c7020c4af41d445dd02b528fbb3f908c73dac9076a2373d613b90ad3411201cd7642f81ec405", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495877, "uuid": "14ce48a1-254f-4d09-97a8-f2b91f814213", "value": "T1B6E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495877, "uuid": "24760368-dcd7-4b1c-a6f9-598c1645fe02", "value": "3072:dgZc9h1jlnLA2PiXYeyCcjVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZjVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495877, "uuid": "81b36a44-3d97-46f3-8654-57e477407baa", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495877, "uuid": "07e1acfb-df55-4427-9d6e-c2a5d4c2a95a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495877, "uuid": "7c0a5479-e709-49cb-9751-6c88cc3eb439", "value": "1eabacc07f818cdae08fd412534714d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f2fff4-23af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689494537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689494537, "uuid": "f78a13ac-368c-4723-8ee8-c9b30cb80046", "comment": "Malware payload (RedLineStealer)", "value": "3a198f4e6c134d431892ec47df4c7257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689494537, "uuid": "1c03e528-b6bd-4ed3-a1d6-bd463b5576b4", "comment": "Malware payload (RedLineStealer)", "value": "eb37bd8deae1adb623df83ff0018dc9c4184dcfd19e6ccc268f8bcd78c73ffc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689494537, "uuid": "7f28dae5-7ea9-48c9-bf5d-8c382b3fcc67", "comment": "Malware payload (RedLineStealer)", "value": "b7d96a7c11012f433d3fccd8da85a2a14cc185e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689494537, "uuid": "09e942d7-11f5-451c-9889-a77d3d6481c6", "comment": "Malware payload (RedLineStealer)", "value": "ed583c4ce86d1e1dc3ca70955a788ac9a4473c201f1a392469ce483ee3e4c3343678e6296b01d8beafc7640f0bb07061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689494537, "uuid": "4951b40f-1777-41d8-ab3d-f38d6c381460", "value": "T1A4F412575AC95027D8A02F345CFB43930B39BDA5A97982FB33125C2E0DB2184A571BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689494537, "uuid": "424010aa-5019-4c4b-b14d-bbd06c3cf902", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689494537, "uuid": "82b1f2d6-3933-4930-853a-0552ec130515", "value": "24576:SytKfHgmNLS03IA1/jv9zZnglIRST2IM:50fAM99gll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689494537, "uuid": "660916a6-7350-4ecc-bb4a-d88cf291661e", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689494537, "uuid": "228810aa-142a-4aa5-9182-2ff4427649bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689494537, "uuid": "70317c15-9ac4-41d4-be1e-5e267ac2c7dd", "value": "eb37bd8deae1adb623df83ff0018dc9c4184dcfd19e6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c60ffb-2423-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1689544521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689544521, "uuid": "b3d87ef1-ab94-4865-8abe-b14d5e84f98c", "comment": "Malware payload (njrat)", "value": "3ac5f312a49f85b800bd5811dc62101e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689544521, "uuid": "e1177e11-4310-41c5-bbd8-f70b989f6bdb", "comment": "Malware payload (njrat)", "value": "ebc7da9fa883ccafa96feed9042c2bb806df59a30ba8067e89a79fd1e00418f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689544521, "uuid": "78df237a-a876-43fc-9d66-428d80196570", "comment": "Malware payload (njrat)", "value": "ccc7cf8150c846782d25c41052399bfbaaa657ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689544521, "uuid": "9d18ae60-65eb-4282-8506-a76b814804e6", "comment": "Malware payload (njrat)", "value": "6ad97b2d5aea1d953f52638b75fbb876384892ffee80f86804721d541418bd77260548847360af73d6803be62626062b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689544521, "uuid": "cd5e5fec-dfb2-435b-888b-198542c9a83c", "value": "T1A5133B4D7BE08168C4FE467705B2D032077AE84B5E23DA0D8EF56C9B37636D18B54AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689544521, "uuid": "bea3a84e-2c87-4aa0-9339-c509dba98199", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689544521, "uuid": "41af7d17-7f12-43e4-ba28-6e952bfdce82", "value": "384:52veoixJhl7OHg1WykrppPl48uiX60rAF+rMRTyN/0L+EcoinblneHQM3epzXGNT:Mv+R1NkrppqFidrM+rMRa8Nug5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689544521, "uuid": "a21fa5c1-13f6-446d-9b5c-3bf8609a67a2", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689544521, "uuid": "32eee8e1-fcec-4cfc-ba5c-a72614aabad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689544521, "uuid": "cc96954a-7bfb-40d7-98a1-f1dc05ee94ba", "value": "3ac5f312a49f85b800bd5811dc62101e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f060fe-23a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689490250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490250, "uuid": "70c46769-7593-4164-b0b1-2ce8bd1d12da", "comment": "Malware payload (Amadey)", "value": "2878a4563fafb44d7f7e2ba8f54d8d70", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490250, "uuid": "2b39cbc8-846f-46e3-8c6e-76ef24863660", "comment": "Malware payload (Amadey)", "value": "ed31bae24807908be7919f0db4b714a85ba48477923dafbe9752d2a4958cc248", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490250, "uuid": "1878ee02-9aba-4dae-aebc-ccddd8183007", "comment": "Malware payload (Amadey)", "value": "bcce2bb11892b6ece31bd60ed38bb5131daa3a71", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490250, "uuid": "31eef276-9ab8-4d9a-8dd1-ced5453e744d", "comment": "Malware payload (Amadey)", "value": "da489935ce6c9d7caf9b133d132caa2e534b7b8537e744d6893a3e7f093a806ed81ea52c09fc26c05536dc38ecc39904", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490250, "uuid": "21785171-5c96-4a88-ab5d-c08d07b03392", "value": "T161152302E6DC5473DCF55B7028F603E71B39BCB1AA78621B3685A8560C739D4EA3136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490250, "uuid": "9d570e7a-5aed-4b47-81ea-0d598a447ff2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490250, "uuid": "fa9bef5a-3be0-49b3-9231-30837d149f3e", "value": "24576:xydMUrg04rDcFeK/pl4WMIuut5gA8Tlg8VYtyPTq:kiUZ4/oh/pSPIuutug8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689490250, "uuid": "cfe48143-3597-486c-9391-4e58c8be6ccb", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689490250, "uuid": "35b10121-c5f4-46aa-9ba1-d2aa246d34c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490250, "uuid": "2a21225a-421b-4b15-84e9-5d9166ad7487", "value": "2878a4563fafb44d7f7e2ba8f54d8d70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159534d8-2402-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689530186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689530186, "uuid": "1bd85c12-78f7-4237-b517-0998a2c75b08", "comment": "Malware payload (Mirai)", "value": "1cc8cd0b92049ae7fa00ca524660cbdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689530186, "uuid": "83aefaeb-75ee-4681-b2f1-ada56a94db9f", "comment": "Malware payload (Mirai)", "value": "eda758626ef4032c265da86fde48ed22f7f4cecc6e5d0d6fee3631e09b2794e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689530186, "uuid": "88cda5b8-c466-4c24-98a5-237c116bbee4", "comment": "Malware payload (Mirai)", "value": "72f84f2fbb98992753e91f4c693c48a8c76f520f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689530186, "uuid": "726f7c91-2270-42f4-95f7-a7380025f085", "comment": "Malware payload (Mirai)", "value": "13ebaae5286cf7a0aaae7068f5507b1287594f2978774d9ef0b062275f4c200e507343816a1394dd34eb52665e2fc4ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689530186, "uuid": "2016c61f-2e6a-454c-bf89-12215ea6e324", "value": "T1DD14751E2E228F7DF668C73147F74A24A76D23D617E1D684E2ACC1145E2038E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689530186, "uuid": "425f9633-15d6-46ad-93ec-11680f9b99a3", "value": "3072:Yf7vZ+k4Tie96N4jMsCpvShj13BgZX70buQL:Yf7cvl6YdMahBBW70xL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689530186, "uuid": "b58ba2c1-c947-4898-a630-91c025543eaa", "value": 190676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689530186, "uuid": "11a2745b-6040-493c-833b-b62d281f65f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689530186, "uuid": "3a58f6dd-486c-45a1-bb41-96e7a0376371", "value": "1cc8cd0b92049ae7fa00ca524660cbdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154a395f-23db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1689513435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513435, "uuid": "3950e1b1-9752-4378-ad56-a66ae9a3d7d5", "comment": "Malware payload (Smoke Loader)", "value": "16c9fd8d675b5498e0ceff5bc4fec24e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513435, "uuid": "8abb8087-0fb0-4d53-a07c-b6545e315155", "comment": "Malware payload (Smoke Loader)", "value": "ef04fe325737cad04ca603cf3a72a71b86bc51786b696972e243cbd0612538b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513435, "uuid": "fb20498b-0467-4f79-992c-d3815c6d6293", "comment": "Malware payload (Smoke Loader)", "value": "dc0bf40b9dd65c7d25829c9912591dd5118d3ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513435, "uuid": "2491cdd2-39d1-4cba-a72a-b6807ab8248c", "comment": "Malware payload (Smoke Loader)", "value": "314c1d3b19b75331f4e5bb7e1a549be416945b08185539939794f7172306de489f0d4086821ea47cb0eada4872ee0110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513435, "uuid": "7854c56c-bfad-48fa-a26b-f462c2b338f7", "value": "T1F5648443DAE17D48EA268B769E1FC6E8B70DF6908F4D7B653218DE1B00B1076D163A70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513435, "uuid": "79802c56-c8de-4a3b-a10f-eed99bb96929", "value": "326441378ca815656cabd6c06990bf3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513435, "uuid": "d4e0a1d9-0969-4acd-9bdd-283e83b14c4b", "value": "3072:+yLxBCoraSJWXrPesHgcLfOiy3XaBdDqRmm2y1d2Z5CcwlgZDGW:TLxIAaSMXjBXbOi6wJmf1sOcFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689513435, "uuid": "3f2515b3-eb19-42b0-a70b-75f1229bd538", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689513435, "uuid": "89763cc9-eb37-476c-9ac6-0301c864fe28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513435, "uuid": "1071d696-a53a-432c-a57d-0bcc000f928a", "value": "16c9fd8d675b5498e0ceff5bc4fec24e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0872b3ec-23db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Upatre)", "timestamp": 1689513414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513414, "uuid": "18258059-360b-42f3-a285-58ac3a1a2f4a", "comment": "Malware payload (Upatre)", "value": "6a819429a393631f284800743db57806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513414, "uuid": "9b1e315a-3b3a-41c4-8c89-c4ebf7fcdb81", "comment": "Malware payload (Upatre)", "value": "efb621959cf78ebda987c42334d70311e95e3359a6c149a3a134493d988e3324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513414, "uuid": "2a4c8a37-6642-4e46-b68f-d189e5b933f3", "comment": "Malware payload (Upatre)", "value": "c21a3ab9a1c9043a4fb4174e0a9b8693228fecee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689513414, "uuid": "526b31f2-076b-4477-8e7b-3a8757652820", "comment": "Malware payload (Upatre)", "value": "d80392b1d36297190b032b581ff35a7cc0282ee5e355ce73605968680b0b931d53847c238c105bc86ca37f852b3b1a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upatre", "colour": "#0078D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513414, "uuid": "bca455c4-58ea-4733-8350-4542c189dc9e", "value": "T1E753DC395ED51A72D3B7DAB6C5F696C3B921B82239229C0E50CB13450C23F53EDA1E1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513414, "uuid": "fdce4971-aecb-4f5f-a4e9-14d98a8759b5", "value": "5c55d83b58dbc1f7154223c32a893074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513414, "uuid": "0790a644-a88e-4c76-9349-eb4750fbf9d3", "value": "1536:vj+jsMQMOtEvwDpj5HyCyh7vtRJ4BqKb1cKtqPol:vCjsIOtEvwDpj5Hv0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689513414, "uuid": "256c0121-d09c-4f41-b061-78cf069155f7", "value": 62748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689513414, "uuid": "da969096-cb9b-4e0b-bd46-093f615871f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689513414, "uuid": "714227fd-6790-49c8-8a77-9deb901d7e6b", "value": "6a819429a393631f284800743db57806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d204b9cc-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492707, "uuid": "bed7dc5f-e530-42cc-8eaf-3ac450c26ac2", "comment": "Malware payload (RedLineStealer)", "value": "980d62c8cb36e58e27aec6085a6a229d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492707, "uuid": "7215cb34-ff40-4402-9943-953a9b38e428", "comment": "Malware payload (RedLineStealer)", "value": "efc2a9f9296e562969d86274057f3f6e6e0056a89451daf00f23f4f6a3c05182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492707, "uuid": "5ffdbdca-9171-4bae-b73a-ba1b6d4778b9", "comment": "Malware payload (RedLineStealer)", "value": "413c32a7158f264daea29317ff79283bb9bea2cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492707, "uuid": "6aec9903-37d1-421a-adcd-5c9a31f781a3", "comment": "Malware payload (RedLineStealer)", "value": "86b703cf5ba1d2da015d31f06658c25df3e222d8a1be23dd4533fa8deb714221cabcd24351472fce7c6144bb23a5677c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492707, "uuid": "3ffa2911-fe38-4b6a-9cdb-62e580ce4850", "value": "T1311523436BE89472E8F55B7015FB16830D72BCB44FB8435B3B82292B0D7269864357BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492707, "uuid": "d65cdab1-8531-41f5-8949-f72754953583", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492707, "uuid": "28ef2c11-4adf-402d-9ac4-ef4b63cfecc0", "value": "24576:4yAEkbVCK4y22X1aXrsdQnS7mN2Bghmw7RGzr1U29Vz:/Azz4y9aodUEmN2KMw7RIplV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492707, "uuid": "45bb12ef-9606-44c0-b9d3-dc3ff35c8ed0", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492707, "uuid": "0e045f0c-e6d8-423e-bea1-b5f7616bb024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492707, "uuid": "a2635d33-0006-4bbe-85e9-cb39bca90c9e", "value": "980d62c8cb36e58e27aec6085a6a229d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba368f93-23f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689525308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525308, "uuid": "2af2cf54-f7c0-4044-9f5f-275e40b69f12", "comment": "Malware payload (RedLineStealer)", "value": "5b543ae828b3e6ba193e8bf442eb0712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525308, "uuid": "57abb9b3-5b73-49f0-91e6-44850c3f196d", "comment": "Malware payload (RedLineStealer)", "value": "efcbec2dffb87294d08fd13883f4f1671ec41b0782bde9732d730209c02f6124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525308, "uuid": "fae146e4-6c7a-4237-b5d8-0ed824005a87", "comment": "Malware payload (RedLineStealer)", "value": "a1756defc9253325cd83ae41b9a05815afbd62fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689525308, "uuid": "cc12f026-0fd7-436f-8bdd-b89fabfbc893", "comment": "Malware payload (RedLineStealer)", "value": "fade867211898e8a924af14a68fe5f5e73425ecf3c5bde71eed1eb8b2de7ac4aae773960cd1cbcc69ceec41056ac8794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525308, "uuid": "c671a08f-fce9-4fa7-a560-9abbff019e43", "value": "T1E0A4294392E13DC4FA258B769E1FCAE8B78DF250CE4D7B653299DE1B00B1176C263A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525308, "uuid": "1f6c2cb0-81ee-4a15-9f1c-7e52c7f09bc3", "value": "171ca87c7d79f90a7375ae3063387bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525308, "uuid": "8b28fa27-a6a4-44f2-9f21-41db5de66cd6", "value": "6144:JLmVtP3REIgDoh9StFmYyzZtjMjLYU/nBQKI2GxhTb80ZPEFG:JSVtP/R9SWrtmMU/ByrLbiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689525308, "uuid": "72f4b7e7-451e-45a5-be93-ce031e6aa534", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689525308, "uuid": "508e0cd3-33a1-4f9c-a18c-b1eee2c39850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689525308, "uuid": "a46f41b9-1b19-43a0-afa7-31fdd84c6f37", "value": "5b543ae828b3e6ba193e8bf442eb0712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c56e413-2383-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689475705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475705, "uuid": "d8c7c39e-2338-431f-9dff-3f8fa1c4fc98", "comment": "Malware payload (Mirai)", "value": "c0a9dec6bcac9be98db44d560c86dd74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475705, "uuid": "704a2f42-d58c-4874-9e23-dea0d473a84e", "comment": "Malware payload (Mirai)", "value": "f06b802a5366426611e5f0f6aa2ffbc59fcb71f786e9f27acd9fc38095143122", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475705, "uuid": "6272a1c3-0620-46ea-9a7a-b2c9830e5d92", "comment": "Malware payload (Mirai)", "value": "13da13774424f816a09377fe52f18b94d831e04a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689475705, "uuid": "85cf1640-c000-473f-b021-afdabc27fb23", "comment": "Malware payload (Mirai)", "value": "0d938008e1691b9edb536a93b772180aa169b9a9ed143aecb3fb7c58903b3004c19c34a5346b0bf7e8812fa3bef71c95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475705, "uuid": "6e6809a8-9e44-4225-a912-f6fcbb9b7023", "value": "T1DD439E23C9215F18D2999AB0B075CE784B53AA5093A71F7B6065C23C9443DDCF52B3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475705, "uuid": "a11a64e6-7b84-4d41-8a89-eb24c089076e", "value": "768:4m/m8J+WWjegNiQruQSelZznKH8JIazola2x/fCfn010fx4bzOtvN/hYLOR3II:tmCWjeOldlRKH8JTElF3CfB4yN/x3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689475705, "uuid": "83db0987-ab4e-472f-a770-9f8d93fdde3e", "value": 55232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689475705, "uuid": "45a454b0-ffd9-46ce-bbd3-6e501f96906c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689475705, "uuid": "428ffb93-ed12-49ef-adb5-9b0930730dfa", "value": "c0a9dec6bcac9be98db44d560c86dd74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ed2f32-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492065, "uuid": "491fbd74-8572-43fd-ae5e-4599162cbfab", "comment": "Malware payload (RedLineStealer)", "value": "393d6bd3d722abd31114cf500a6d31f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492065, "uuid": "bfc2cd2c-2cf1-45eb-b7e9-6f20877fbd4c", "comment": "Malware payload (RedLineStealer)", "value": "f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492065, "uuid": "59adfd7f-ae53-497e-8f13-a921af072497", "comment": "Malware payload (RedLineStealer)", "value": "027ab7af8553f0a73e95d6c9c8ddeb0e12af8965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492065, "uuid": "27c21fcd-efad-48fb-a1c1-f2f224b89244", "comment": "Malware payload (RedLineStealer)", "value": "da53693752da53239db7ef68bfed52a386a5e64ed98066fe7e2ff9a023ec3a574e7bf2b3e5ef5be42ca673b960098100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492065, "uuid": "524ed5a4-fb6d-41e5-a089-a1fc40be7975", "value": "T185152213FBE88172DCB507B0A8F107D30B757C565D31422B17A9AA1E5CF3A846972B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492065, "uuid": "807b2125-5545-41c2-9ac5-fe8f14028ccf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492065, "uuid": "e33b3760-6976-4d42-8368-517fa2fad04a", "value": "24576:fyp+BYZ6J6nTHME00k7UjgA69JsKL0AI6bnscKUph5E:qpZsJAH87UjOHaonsrUP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492065, "uuid": "e39d6463-2876-49fb-9364-f5b1c7303364", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492065, "uuid": "e6c02d7c-568c-48a3-9d78-39ac8fc248bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492065, "uuid": "1bb26452-7843-4311-83cd-ab78ef2e99dd", "value": "393d6bd3d722abd31114cf500a6d31f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1afb98-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491458, "uuid": "4af83148-5543-4983-a070-4be7752ff5c6", "comment": "Malware payload (Amadey)", "value": "0bba6c5a8b9979a2241f1450ba08acac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491458, "uuid": "cadbfc13-ad04-49a0-92d0-6bbd337b925e", "comment": "Malware payload (Amadey)", "value": "f16db96028a7afeb1141a5506032310d36b0354cd63f796d585fdd9cd3b2c8f1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491458, "uuid": "5975e966-0449-4053-bae6-14917e9e6ad2", "comment": "Malware payload (Amadey)", "value": "823b3a858ce440a6b30ca707db2a28ef5596fdff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491458, "uuid": "4b4efd29-cdce-4db0-b692-856663119a1c", "comment": "Malware payload (Amadey)", "value": "5f6899d74a8db9cfe83dce6d23d740248b2accb591d04a3df513060fe8822fd118e5ae5fafbad6a3179ec54026cc2f10", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491458, "uuid": "2ae8a6d5-3d4d-4c2d-8134-958fb76b34db", "value": "T184152313EFDDD176D4B02B7128FA03831AB5BC908D70966E2795D49E0CA39927A3133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491458, "uuid": "e8482d17-a3a7-4c94-af45-fbdbd7d30665", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491458, "uuid": "dd58b152-71f1-4bc2-a914-f425389ddbf9", "value": "12288:+Mr9y90+HbQau2ZVqMaLa1SZpRgJf+X+dPWgI8Fitq2UudtD79LEN6nt1S:7ydcoVY8SZp6JfRPHvFujZwN6na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491458, "uuid": "736503e7-bc17-4bf8-b6e2-a0ee3d116446", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491458, "uuid": "eb0c93f3-de5f-47af-96bf-840210818669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491458, "uuid": "adf6f9a5-69f7-40d0-8266-1933acbbc912", "value": "0bba6c5a8b9979a2241f1450ba08acac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d816b3-23f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526209, "uuid": "6b6e1461-2bb5-4e29-98b6-a4f3a1c8232e", "comment": "Malware payload (Mirai)", "value": "0d911a4588b68f16066146c9ddd9d8ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526209, "uuid": "dc4847f2-d800-42c2-ae0d-addbcf63667d", "comment": "Malware payload (Mirai)", "value": "f1ceafa1b97165ce22fa0c2729fb03f3bd3492fac1e903cfcf51c5edb7015bf6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526209, "uuid": "2e56c295-115d-4a31-a2c4-d568d24f1878", "comment": "Malware payload (Mirai)", "value": "dc9afa902955ba0bd7e032c0fd439bf23e86ba63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526209, "uuid": "1cb4f928-aa36-437f-9a83-5e1158837383", "comment": "Malware payload (Mirai)", "value": "d113264a1893e19de40f7798a0f13ff6bb25bedeff6dd256b352585ffd718b547cf0084cfb750676d1771bd06c970b49", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526209, "uuid": "dc8bde44-6c53-4f8e-8485-4c09a3d69779", "value": "T126C2E116A2A1AB61E3FD0C3DCEF8C64A052D337991FFB0725500A5947ED13649FEB18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526209, "uuid": "dfcc3e22-2e35-41df-ae15-5c0f37ad4ed1", "value": "384:Q7Hw2q7vkDNytOwCbdZL7AxMtGzefjXT8vxUS8hWOT7RvdhkFhymdGUop5hc:awnLkDK4h7AxMGIjDJD9/kFs3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526209, "uuid": "da26fa42-68ed-47ec-8c4d-d3c2510a6107", "value": 28168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526209, "uuid": "6e61fee0-5a85-4d15-9213-e279d8caa761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526209, "uuid": "115630c9-8561-42ee-b7d6-a1a1167b64f2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80014d04-23ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492998, "uuid": "6cba4716-cb46-4129-ba30-f3c74faa60d6", "comment": "Malware payload (Amadey)", "value": "b004420bc96f6900d3e0a1c5062f3275", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492998, "uuid": "9b86b7f3-f998-4319-9300-7a8359015afa", "comment": "Malware payload (Amadey)", "value": "f28db52af740b06cd9c9e797c87283763b828d1f588857677cae55a7eef171f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492998, "uuid": "2f826633-c51d-4a9e-befb-8d2fe15f58df", "comment": "Malware payload (Amadey)", "value": "8d64dde45dea33eca883890c0c0dfe01df57588d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492998, "uuid": "f2f6a334-a51e-4da0-9df6-9229b5cb7089", "comment": "Malware payload (Amadey)", "value": "20b820fbc15f7b97b6c1b7cc7c0461ee2a2e8b88138c452b0040a5278172c191a8d70cb559a7aead9ca1a9667455acf8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492998, "uuid": "57096a01-9082-43f3-a0d0-ca640d85f9b3", "value": "T120152392BBDDC033D8B427B099F502E31E35FDA20979879F268D585819B2A80613777F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492998, "uuid": "77ccfb83-e3a2-449b-8505-9232b5cb958b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492998, "uuid": "10df67f9-7a6b-4445-a22d-62d14bef4d01", "value": "12288:dMr9y90METpO8PvtNgdbZZdrfc8EldaImWvll4X1qRPw+:oymp9PcbZHrE6ImWvl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492998, "uuid": "45d98d51-cea6-4a52-b5e8-1e5e31c6f4ef", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492998, "uuid": "cbba75dd-9947-4946-87d2-3a3c5002a8d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492998, "uuid": "9f9a1f61-2e08-49b6-b6a6-dadf00b3d0e8", "value": "b004420bc96f6900d3e0a1c5062f3275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c00617a-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491757, "uuid": "7eeb50b6-bbc5-41f5-9870-7e723ea047d8", "comment": "Malware payload (Amadey)", "value": "10376b50740a48942aa6222307327e42", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491757, "uuid": "f155ba47-7345-47a3-b2d3-56c2d34da311", "comment": "Malware payload (Amadey)", "value": "f31965e93bc37ceaa8c218262ab79addecd9fd3a4e9810757de77c51f4a68f02", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491757, "uuid": "4b07f0f7-0f51-4dc8-935b-e7b886074f24", "comment": "Malware payload (Amadey)", "value": "8eacfa4e8c98c7fc3aef00309f25d569a79bf6d1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491757, "uuid": "b6f0c19f-700e-45ac-aa34-9cd3af737132", "comment": "Malware payload (Amadey)", "value": "d90ed56a122f3503c7b79c89f75a50d5a4a3a79f0565fbf0e952891ed3a83a29626226db9e936e8e640f89ec1b6e9bad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491757, "uuid": "d3b02d96-9858-491f-a246-b054a1712832", "value": "T19FF42213EBD84472D8A43BB05CF703875B31BCA1AC74537B2756998F1CB2684A93637A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491757, "uuid": "700b925c-61fc-4367-a39a-ab32c00a2979", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491757, "uuid": "51781224-75b8-47b6-9d8b-895b51971093", "value": "12288:hMroy90WqUTkenDlApAjNbiZzX3Yd/9NnZe1ylv+m1u0BXM2VWhkONo8Pnz:Rynqg5DeiQzXod/9NZDhM2VWh1Nom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491757, "uuid": "96bf20ee-5afe-4662-9f7a-4a8929487171", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491757, "uuid": "c8853fc5-f862-4e41-b567-f638ced682d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491757, "uuid": "66b6cd26-cae6-4488-ad43-bf08aeee9b6f", "value": "10376b50740a48942aa6222307327e42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8475949-23f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689524043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524043, "uuid": "f8b618d4-bffa-4c98-a072-6814588c2a4f", "comment": "Malware payload (Mirai)", "value": "1c80e52aea784a3f792e8287b836e537", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524043, "uuid": "827048e1-de6a-434e-ae23-2c085819dcb3", "comment": "Malware payload (Mirai)", "value": "f33f5091acf0acb45cc9dffc2d43455f032984d8c1fa67a1f56f57098c42b5cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524043, "uuid": "1116545f-f7b2-4246-95eb-e99fce4a5d02", "comment": "Malware payload (Mirai)", "value": "a6629844f84e9cbc9bee6a6fcccb71aa0da9a971", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689524043, "uuid": "08dd9b90-d59c-49c7-93ce-bc3f0d2c997f", "comment": "Malware payload (Mirai)", "value": "f9006b2e5cde8dd018274271c2b3b302659111e037cd84af6dd02c9b0cc49e9e637b0c5aed0f1500666b4b6021bb41e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524043, "uuid": "cb612d30-0ac8-4778-8fcf-db3e044d4e7f", "value": "T15BB2C0CC61943084C98D7C7C278D4A664F6CA1D0BAED9B26E350CDD9B3BEA4B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524043, "uuid": "8764a529-3f86-439b-ae59-c963865cb812", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBpaPZq8Wvl:BQlS07FUXqIYSXQKqu+qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689524043, "uuid": "e1518c8a-b976-490c-ae5b-c52eb2ba82e0", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689524043, "uuid": "7be83310-8f9a-4893-9709-fa6ce9c66f26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689524043, "uuid": "072b2fe8-c3a9-43f1-bc9c-a04da3f62b01", "value": "1c80e52aea784a3f792e8287b836e537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73799c88-23a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492118, "uuid": "a24704bc-a4d1-46d1-ae4b-ef4aeb011bf8", "comment": "Malware payload (Amadey)", "value": "4df77494c18ffd3c9189891f14dedf6a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492118, "uuid": "ff1f6176-546c-41aa-9226-b89a679d657b", "comment": "Malware payload (Amadey)", "value": "f4b9da5e164af42ab38f095a23decf8883550ff0ca21c0e91d15402d44cbabac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492118, "uuid": "336c47cd-2236-40ba-acde-8fe75ed467cf", "comment": "Malware payload (Amadey)", "value": "766053a6bc07a2ce7d8d091df44fb552a1ca66e1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492118, "uuid": "db315505-9cc4-459f-8ef0-7b59e5a19dc5", "comment": "Malware payload (Amadey)", "value": "0528d5e5f820fc47ec7b3cc073283d6a006a76759a3b076906f6e229b450eb0de41bcdc6f3a61f755623a8b688f8537c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492118, "uuid": "549e5f1d-16bc-4c0d-9499-3096ac98476a", "value": "T187F41307E7F85167D9F05BB008F607C71A3ABCB2996707B61785E81A08B39C8C97177A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492118, "uuid": "58b32e41-2bb2-4ddc-b112-26e140739811", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492118, "uuid": "7bd5819c-94a5-4619-9f90-b70425e6895b", "value": "12288:8Mr0y90gRwk7ZSN04JYLnXht3ObvYEfeCRpWDvsCkJzi9tT8NxNFGVX:Iy751mgLnXhI7DfeCRpwhkJzwF8NxKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492118, "uuid": "9b546a23-939e-4bba-958c-26ed76e6a1c9", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492118, "uuid": "9ec9b64f-260b-4578-8626-8e79b19962f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492118, "uuid": "eb85504b-c7e7-483c-a26d-0ab9d3a855b9", "value": "4df77494c18ffd3c9189891f14dedf6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c78407-23b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689495937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495937, "uuid": "edba93c2-2162-4886-9572-72d96e7a43db", "comment": "Malware payload (Mirai)", "value": "dfddb4b2b7a956d70a83689f5107f41f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495937, "uuid": "6df3c434-1644-48a9-baea-3178b29916bd", "comment": "Malware payload (Mirai)", "value": "f5bdae58c983bc44303d6df06c8a9fe4cb52efe3d1033a4c1160fc1a1638e641", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495937, "uuid": "bb39cf22-7661-42d0-9583-27dcdd27af83", "comment": "Malware payload (Mirai)", "value": "61df50d64f59a19438f19a93ab6b2041a347373f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689495937, "uuid": "ab181c2d-17b4-4060-b86a-ea6457ac48e7", "comment": "Malware payload (Mirai)", "value": "643bdf072c7c4aecdd63f7820d86a4f7ad23af46ae00c7df538aaf527cfead75c382ddd9446d2f19dad7bcdefa1b3723", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495937, "uuid": "59818d29-adea-4310-b1e6-7c75868c88c9", "value": "T173B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495937, "uuid": "2d1bd08a-506c-407b-9c68-fc515fd7c86b", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZGoamm/QcuLB1niDNb:YuFX0GIk1MHyphDamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689495937, "uuid": "32ec7faa-eed8-4b1a-9fc2-8cdc072e0743", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689495937, "uuid": "21788ffb-3743-4b66-b67a-e7530ffc1854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689495937, "uuid": "dd40b718-5e29-4475-b622-6815fc915e52", "value": "dfddb4b2b7a956d70a83689f5107f41f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e84006d-23fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689526980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526980, "uuid": "f5725e8c-898e-4df1-a1bf-1dbd4e49c603", "comment": "Malware payload (Mirai)", "value": "31ffe5c1af0edaea0b25a3399bf952fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526980, "uuid": "639af3c4-e55d-4b26-8ce1-3e2ba96d7f7c", "comment": "Malware payload (Mirai)", "value": "f5e56a5301267bb848345ee838efba85e9c95214c27f71e6ce037baec8ea734f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526980, "uuid": "3133316e-0417-4831-af8b-b188991966dd", "comment": "Malware payload (Mirai)", "value": "70df2078c12ef5a27a790d555e6c8007d3b705e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689526980, "uuid": "c59698b7-e465-4643-905e-12bf57379dc9", "comment": "Malware payload (Mirai)", "value": "f18d3e62bca1dcc87d020d199986f5bbb2203a1222f4a7b105ff59b26583c897a45c11bea5f78835c2278f0123e17938", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526980, "uuid": "a87a02b8-8fa1-4777-af4f-4b05d2ce7c43", "value": "T148B2E0C1A5046AF25F78793CDD7ECE9733550A39D4FB71B93124850489C982A1EFCA8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526980, "uuid": "edbfcf40-d5ea-4e01-9f26-2d453b8e025c", "value": "384:vpkHc9VD3CvlzIt7t6cJahFjz/AbPKlUIO/LxD37VCzhXzTJIpCTtYhymdGUop5/:vp9P7UkH6rv2nV3AZzTJ2CTtYs3UozLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689526980, "uuid": "be2a75d4-ebf0-4ffc-81b3-17fd268ba9f7", "value": 24508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689526980, "uuid": "ae670d18-0987-40cc-9a66-e63dac8c8e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689526980, "uuid": "22bdb98d-d199-40e7-9ad7-a731dcb51c16", "value": "31ffe5c1af0edaea0b25a3399bf952fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad660d46-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491786, "uuid": "d8561c73-1ea6-476e-b202-df5aeaabd9ff", "comment": "Malware payload (Amadey)", "value": "24504b933914525257ffd81b28d5d925", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491786, "uuid": "c6b3cf34-e94d-4563-8117-a58256c402d1", "comment": "Malware payload (Amadey)", "value": "f6c03c0da3cf5bd1f6ec919975d1089630fb296d90fa2564523b522ce75c3630", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491786, "uuid": "2fad4954-3ff0-4667-bc6b-5ca0ab0fffd7", "comment": "Malware payload (Amadey)", "value": "880b70cf3241de0fa1450bcacdeea07766cf427e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491786, "uuid": "eb6413c6-efcb-415b-80f6-6bb936af8a00", "comment": "Malware payload (Amadey)", "value": "2da14826889129a172c0512435cfaf6c24dd1a3edf43af210563d45989b36fbc38699db340d7d4fcf3461f21c40c1baf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491786, "uuid": "9f9d8964-ab4c-46b9-b0f7-965e45e53e03", "value": "T195F41353DBE08472C8B117B048F653C30B3679668934929B27856C5E18B3FD5F8B6B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491786, "uuid": "c4c55e16-e7b4-4529-95cd-eb7166319205", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491786, "uuid": "57a9ae22-76d0-43a4-b9dc-039835256fc2", "value": "12288:MMrAy90YheRFqI1jKkTd95L3+5zGq0RREajL3DsHH5iAqiOdSef1HvetUAdOfxry:0yJeRmk+TqREajLTsn5iCKAwfBSht/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491786, "uuid": "db1db7a3-3d66-413e-ab79-a37099e86f2f", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491786, "uuid": "12f485c0-68ea-4ba4-86c0-9051ed27dc99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491786, "uuid": "83a23f88-0645-4223-8353-30b23c011cc9", "value": "24504b933914525257ffd81b28d5d925.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18956c02-2402-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689530191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689530191, "uuid": "fb799af2-77a4-4c1f-8b8a-c62e8384f5b2", "comment": "Malware payload (Mirai)", "value": "76a29dd4dc7db3ad23a7bee02d0c6d6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689530191, "uuid": "1484b3d3-5bb1-47e7-b171-52f84b72a606", "comment": "Malware payload (Mirai)", "value": "f92e6a49c8758c41e3f0d19c4b68fb87f8a8434cae45e4c25148f5aaa86c815a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689530191, "uuid": "e6c35c72-5dc0-4f34-b566-94eb927d30d5", "comment": "Malware payload (Mirai)", "value": "875edbedca5d51dcbaceb61cf99b45f9aecd2c04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689530191, "uuid": "4856b46c-24ef-4885-9d6e-d6a3f3a6bdf2", "comment": "Malware payload (Mirai)", "value": "1832fd8f418536146b77aa5d9fd0994b9b709827911df73ec39ecd357ec34207b45f923ae52b55024bb392d8999edd55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689530191, "uuid": "ddc7189f-6d9f-4cf0-a580-270a481ebf1f", "value": "T133535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689530191, "uuid": "31be9ae7-1f7d-4da2-a33c-50bb03d53cd8", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8D:N1GjR8EVGOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689530191, "uuid": "c5650abd-1b50-4676-a48b-e9a6e0ee1d88", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689530191, "uuid": "379ac567-48f3-4fc1-8263-617ee15b0ad4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689530191, "uuid": "77d76226-c6bb-49e6-84b8-e7fdacd524f6", "value": "76a29dd4dc7db3ad23a7bee02d0c6d6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f07247-236f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689467245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467245, "uuid": "b51ba79a-290d-4290-9be8-781398043481", "comment": "Malware payload", "value": "cb4d29763885bb35396764ea146ef932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467245, "uuid": "310ffefd-ab78-4022-b15b-413d6c21ee1a", "comment": "Malware payload", "value": "fa1cb2d2f92ad9e1ef943b92268f510eb8d6d83f4cc8676e39a91a4b4cf6a0c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467245, "uuid": "b80a4060-f002-4e5b-9975-cd8d95e6b81a", "comment": "Malware payload", "value": "3e0692b81a418f6ffacf5612ce3c84d3d5b7f9ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689467245, "uuid": "a9f77f0a-d590-4789-833c-28ff03dcf7ff", "comment": "Malware payload", "value": "2c81784ebb13f0e2ebf692e483080da6b6afa3ebba66f70d81be56bd7fb58e65e05fd8c782534b876e92e4bf27e63a29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467245, "uuid": "9f0cf4ba-817b-406d-95dd-8c90e0a5d3a1", "value": "T17D659F5AF272BB33C52326749D0B46A8A9E57E102E2559873FF86C4CDF3A7C238161D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467245, "uuid": "e586758b-cb91-4c9c-ba4f-c6adb70f4af8", "value": "12288:x6sbbfaIZljYe0GxGUapcpiUPm67yag1ucmGvw+:x9vzljYgGp0xv7UUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689467245, "uuid": "0308f7bf-960e-49de-bb71-a77d465c51db", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689467245, "uuid": "b3a3e96a-94aa-499e-825f-0f896724b13f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689467245, "uuid": "fa67dd7e-5765-4538-b3ba-845342479743", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.10314.23228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc791d1d-23ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689493637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493637, "uuid": "5a4196b8-6112-461a-817b-ca87d0f6e2eb", "comment": "Malware payload (RedLineStealer)", "value": "5f91ad746c38d0c49e1446f09856b173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493637, "uuid": "d0639593-4af0-4b9e-8200-4d9561aad595", "comment": "Malware payload (RedLineStealer)", "value": "fc9f7583e360dc95e7f18587ed3af2dd6075c48165f776834bee2eba329ef3ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493637, "uuid": "ae2b1492-08ee-412f-9cfe-073d93892992", "comment": "Malware payload (RedLineStealer)", "value": "24c9a08e84d12a194f9a562a57a2d95ec2f6c9f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689493637, "uuid": "06324081-ce39-413f-87a7-48ffbadac3b4", "comment": "Malware payload (RedLineStealer)", "value": "c3728da87bb0ae97437cd634300e094a1a96fa5cf0dfe8ba863bb1b320243742145f449a0b85e5bc0a1e78ef526bfa80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493637, "uuid": "e76b32d7-8d5e-4ecb-a1d0-89eec4032fb2", "value": "T13F452313BBE450A3EDB56B705CF313431732BD81897493BA3659A4AE1CF2BE0553132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493637, "uuid": "b693a24a-9b11-419e-91e0-3c5caba32225", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493637, "uuid": "a071a9c4-a664-40fb-a50c-8779a9fd6590", "value": "24576:jy8vi8wvN4IaG7rs2VrG9qp2GnqZjEwLv1+VRxOnf6heTVfq/GW3:2SiLFvaGn3VuVLNt+VRxm6sTNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689493637, "uuid": "bf5dfbeb-9ce9-46a2-ba00-31c381e52a9e", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689493637, "uuid": "7c658915-2dfc-4aec-9419-289b8cdc2edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689493637, "uuid": "e798df76-699f-4bb3-b147-792dbfa34e13", "value": "5f91ad746c38d0c49e1446f09856b173.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e55c162-23a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689491761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491761, "uuid": "e639cef9-edaa-4d87-b661-c8529a0eafce", "comment": "Malware payload (Amadey)", "value": "14826c2b7764c3ae77eb12b79dd1aaf8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491761, "uuid": "1e148740-edf7-425f-8b46-cf15395cc487", "comment": "Malware payload (Amadey)", "value": "fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491761, "uuid": "463461a0-a2d5-4055-ba87-58b2f07fe27e", "comment": "Malware payload (Amadey)", "value": "c46b126efed7e3f415170c28c72fe5728f9d3736", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491761, "uuid": "e5a63176-69dd-4fab-816d-c7a8e61abc6c", "comment": "Malware payload (Amadey)", "value": "128caaa2ae218fc2b4ebc151728f451d64f31c8ddfdbab05cdd36b5f7e945c57066c54b69709821467ba4dda53398171", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491761, "uuid": "ec5d2fdb-f38b-4d75-bca4-034a2e2a6b0d", "value": "T1FE152313BBD50532DD721BB029FF3BD32E367D821978572A2B82590A49B29C4E871377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491761, "uuid": "eb818d2f-186a-4cea-91f8-8ceacfa1fbf8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491761, "uuid": "5ab64341-9fc6-4040-881a-dc4d3fa89842", "value": "12288:FMrty90DTg0LJebSzCkCFAsbuJE0AR6N+nNuSXFdjlocBpRDPUYz+tEAF15+pqE7:QyshkYdCFduoNjrl5XBPUW+78qE/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491761, "uuid": "bf02d865-ebbc-4632-9375-74ef59f8ee8b", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491761, "uuid": "0e1ed0a5-4114-4ca9-aaea-7382172ad70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491761, "uuid": "32afb937-6f2f-4388-a8d8-17d1d84c1a5f", "value": "14826c2b7764c3ae77eb12b79dd1aaf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d935a897-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689492719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492719, "uuid": "c4c06f28-bc81-4219-a740-3f12ccbb7b3e", "comment": "Malware payload (RedLineStealer)", "value": "a4d7c8e105aa5210e466c2947bf0b0b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492719, "uuid": "cced5126-e651-44f8-ad6b-f662f3191204", "comment": "Malware payload (RedLineStealer)", "value": "fd96f623d221f8ba31a5f02df91d780a3bc08e885a51767bed032ab03149e2d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492719, "uuid": "f35df542-37ef-44cc-85b5-8a283f17594f", "comment": "Malware payload (RedLineStealer)", "value": "253b2c7985b7accf5d8a87533055b8ba003bcd9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492719, "uuid": "474d3abe-284f-43f5-b181-b73f3e268cc4", "comment": "Malware payload (RedLineStealer)", "value": "237e3981d80c5f836f10ab6a79f7fdefe520198b4ff7330cb46df78815fc16488a1687fb3dbdef514bc610831773982c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492719, "uuid": "a3172746-1e08-42c7-b7bd-f332734f4da5", "value": "T115F41316F6EC8473DCB527F028F122830F367CA15D7D876B2214999A6D73688A1B172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492719, "uuid": "3297fb65-8a3b-48eb-9105-c13f31529a49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492719, "uuid": "e56afad5-7604-48ce-8aae-446dbda3695d", "value": "12288:7MrXy909FC77xhvZBXu32BECfRAcXT9zXDXtpGbDvbLdjcAyRl+yS:ky8UXxhhS272cDZxMvTLdjcrRlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492719, "uuid": "7e6517f5-4921-4894-9f1e-09a1caf8e3eb", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492719, "uuid": "78eaf8a3-b11c-44e7-8e27-1c29c6fe2a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492719, "uuid": "32f5856c-41b0-4191-89a0-6962a61f139a", "value": "a4d7c8e105aa5210e466c2947bf0b0b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2069705d-23a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689490261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490261, "uuid": "a0a4ae37-6cd4-4644-8d31-a17ebfc84911", "comment": "Malware payload (RedLineStealer)", "value": "9dd6a8bab85e93203ba044c67319645c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490261, "uuid": "6448df52-e0f6-4cf8-836b-215d9702366b", "comment": "Malware payload (RedLineStealer)", "value": "fdeafb00538f76acf07934b01259f5d2773160bc5239fcc3803743f9cbffc6bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490261, "uuid": "e1bd6948-0998-4a1a-8394-57e9a61898b7", "comment": "Malware payload (RedLineStealer)", "value": "c744763135a82be6b7beb6b2ee2351a111de7ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689490261, "uuid": "e723685c-abfe-41ca-ba1a-6e3e86a66cd4", "comment": "Malware payload (RedLineStealer)", "value": "0d07f9c18f5cc5255fb097308bc22424459d1c9c00f0da590b0b2250e432846247b95edb75c1f5f395537bd37b2e977d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490261, "uuid": "fca082b4-1c8d-4939-9f75-926fcbe0a62b", "value": "T1D4452392A7E48071C87917306CFB53831B76BA92AD65936B23059D4F0EF3680AC35B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490261, "uuid": "84a3f434-b1cf-41a9-8cc6-b56d3345775d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490261, "uuid": "1a511edc-c147-4a5d-8767-263d3fc44332", "value": "24576:7yUjHL8cf1SNuSdmKBPD2v3yfr33kHgO97WofuuEk5CuW/cc:uQrjSNuS0KA3yOgO9iUuuVl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689490261, "uuid": "9fdd9494-4b7f-4315-9640-bb750c7fd39e", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689490261, "uuid": "9cd5d8fa-af2d-4a54-8ef5-ac42dc0069da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689490261, "uuid": "77b499af-0940-4358-9385-6d87a59843c3", "value": "9dd6a8bab85e93203ba044c67319645c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393c665f-23a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689491162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491162, "uuid": "7d4f9c2d-cb85-4c48-8245-465e3812e0c6", "comment": "Malware payload (RedLineStealer)", "value": "71ef5fd46955ea0abd7800e7c99cc8b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491162, "uuid": "f2160bb9-1e2d-4e17-8bb4-a384afa6adb3", "comment": "Malware payload (RedLineStealer)", "value": "fe20091e32e612a1b5b7043895ddf7d0131a544a6f86d177218645241070f32d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491162, "uuid": "7b12d556-10a2-48ca-81eb-6de1f39872e0", "comment": "Malware payload (RedLineStealer)", "value": "a9efdd480409e6b0a626ea6fd9efaf280b20bb75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689491162, "uuid": "6b106aca-14c4-4ade-b7ce-43a039fd4701", "comment": "Malware payload (RedLineStealer)", "value": "2133b0af6fa3209484e78c2bbe22791e39158bc313a6c23d4aa7be96681d9960956e47e058cf4fcd16a9666cb4b5c77e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491162, "uuid": "7ae3640e-e038-4809-8e3a-5e6f75672b09", "value": "T163A549917CE08572DCBE30B907FCB521092DFAB00B145DD352881BFAE6572F2A636997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491162, "uuid": "3ed0eefb-4a12-4bc0-ab86-7bd84da87d35", "value": "1e70033cc54b7a5a94a0a6c6c717bb10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491162, "uuid": "2f6a5364-672f-41ea-8b4f-5cfc4c7ccc0e", "value": "12288:+M3EzKjdPldQib6fi2u4qYXu6Osee332r3i86QVeoVvYTt3lO:+2sfi2fz3Gr3iaMoVQN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689491162, "uuid": "555e387f-6dfa-436c-b19f-bd1cfbae873a", "value": 2099200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689491162, "uuid": "e4845771-b2ea-4ae2-9a95-cb81fe8fa038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689491162, "uuid": "e0ac257a-6d45-4649-8b6b-381aea91172e", "value": "71ef5fd46955ea0abd7800e7c99cc8b3.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426c5f19-2418-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689539710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689539710, "uuid": "5fd7359c-2c13-457f-aa24-1bd7fc7f0d6b", "comment": "Malware payload (RedLineStealer)", "value": "04a1a6bb7d8a6b9b5e95e09188e169f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689539710, "uuid": "d37e0547-0472-47d5-8354-846281666e4e", "comment": "Malware payload (RedLineStealer)", "value": "fe44c22ff51a8a81dc13d05ec1ef24c21e2b5c32c6ca9cdd434fc43fbe8b7181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689539710, "uuid": "c1a03ad3-161a-4459-b36e-18b83ab43b90", "comment": "Malware payload (RedLineStealer)", "value": "8817c1850f85238f983612542508a11d720290b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689539710, "uuid": "ba66b580-e444-4cea-ad31-a2889693aef4", "comment": "Malware payload (RedLineStealer)", "value": "ccd9a53c73dcc7daaa2d043a1094608d4ddec3299ba3c2c8d00837b34fe8a0ae54230c3daf31e8dce0cba4f195bb184c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689539710, "uuid": "592e979a-836f-4c37-9303-50687a918973", "value": "T147A44C6382E57D44EA254F73EE1FC6E8BE0DF5928E5D7B652118AE2F00B1272D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689539710, "uuid": "b10541a0-09f7-4b5e-9a31-697c9f7ffdb1", "value": "510dd539bc8b58414f44caf85838ae97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689539710, "uuid": "896fb821-fbc1-4a3d-bc1c-8b148fd2d8b0", "value": "6144:RLi+dHTFH+RyRWPucQIqW6gB9YV3LGJtf0QiWMU/RF7O2AT:Rm+dHBHIysLAW6gBKV3ItaW1T71Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689539710, "uuid": "7401d53e-6222-4f82-ad74-7a0a9ffeb6ef", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689539710, "uuid": "ed550d21-e57a-4134-83c0-e2b5ae4e0a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689539710, "uuid": "2fac1edd-a8dc-4728-b9c9-cbc414fcd2a1", "value": "04a1a6bb7d8a6b9b5e95e09188e169f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c15926e-23ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689507890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507890, "uuid": "0d54efcb-a77c-4a65-8f4d-b4736d3c04d9", "comment": "Malware payload (RedLineStealer)", "value": "d24fe764b9678e28562a7cf69c1049b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507890, "uuid": "c5f04367-e4d3-4853-b13a-68c48b6abe1e", "comment": "Malware payload (RedLineStealer)", "value": "fe6fe64afb9a16c6ed919933916fd39c31ad8628fb2e826e43764b235d511ab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507890, "uuid": "3c735119-8dfa-4c99-9377-a8cf5c4c7420", "comment": "Malware payload (RedLineStealer)", "value": "bffc013ca0e08dc45ae21eadaba221148215aa5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689507890, "uuid": "7878aa15-bd93-42aa-bc50-9ca4879f971f", "comment": "Malware payload (RedLineStealer)", "value": "ec1ec3e86291c914b24969a3bd6842d2a58d4b36aae5e8ff26576487f68d30703456d4a94e709f1daa25695b17a530a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507890, "uuid": "ec66d541-d2e7-4bd4-88ab-da240d563311", "value": "T107A4294383E17D48EA25AB769F1FC2E8B70DF690CE4D7B653258EA1B04B10F6D163A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507890, "uuid": "a34a7225-0e5b-45c6-8e51-79620db5b8b7", "value": "326441378ca815656cabd6c06990bf3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507890, "uuid": "08d7607b-1678-4d82-98c1-d7d488f738cf", "value": "6144:BLVPaUPKsFU7tzzsfee6TBILOCkSuPJoWYxMuqYeCwoy5FIUFG:BJPaUZFU5z4f/YILuBbvi65ZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689507890, "uuid": "f85948ec-b269-45fd-b449-7cc454cf271a", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689507890, "uuid": "4bf5ecec-d4d0-4a28-9c5d-1f36fd101e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689507890, "uuid": "67805f02-74cf-4017-ad3c-f6013b59abe8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c779c64e-23aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689492689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492689, "uuid": "4db2f34b-9675-4487-bace-9a380a12aeb5", "comment": "Malware payload (Amadey)", "value": "93c1cf125b85fb3d837c268f1a522d43", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492689, "uuid": "af5fbb4c-195e-4cd1-8296-2f2a32d4c88b", "comment": "Malware payload (Amadey)", "value": "ffca01eab57ad303c53af864d96d53e1fe5339d089ece9c9288d685395588b09", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492689, "uuid": "b0a6d1ed-7480-414f-bc21-9a81d00dfa3e", "comment": "Malware payload (Amadey)", "value": "021b4c910e6c9af13c94f77b6f5e88a1480c82a9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689492689, "uuid": "540b09e5-70aa-4f58-b1c4-5e930a4de4b5", "comment": "Malware payload (Amadey)", "value": "dcabd6fd2223448088d8bef4246e8db4f6bd3ef6857a499abf57fdd6c1033fde251cb1736299d9014feecfec7a02b520", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492689, "uuid": "71c20726-4021-4485-b56a-c66feb2f2dfe", "value": "T1DEF41256A3E85832EDB52B704CFA03A31B36BCD5C8388BAE2346595D4EB16D4D43173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492689, "uuid": "0980ceee-57e6-4b79-9d10-be4d984d182d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492689, "uuid": "0a2f5156-53b9-4f32-a33b-1824c036f5a6", "value": "12288:PMrAy90FvlyVN8Ha8xmcAGaIevzTUZczWOQO7vw0wRgPoS3bHvit1j:by6wN7gmcOFzlWOJ7YVRioS3bPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689492689, "uuid": "6cdd6ed6-f1d0-422d-8f53-3eccb57a41f8", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689492689, "uuid": "400e55bc-6277-44db-b9cc-43731782eac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689492689, "uuid": "128ac5f8-3d77-49b6-b6df-94ed65baffa6", "value": "93c1cf125b85fb3d837c268f1a522d43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }