{ "Event": { "published": true, "date": "2023-06-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-25", "timestamp": 1687737781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d20ec908-78c0-4c90-80d0-528e8d2d158b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d629d1-1397-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687725013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687725013, "uuid": "5be2de61-decf-4985-bfc4-668d08359012", "comment": "Malware payload (AveMariaRAT)", "value": "f78c8e53c514ce13844541e2d735c9b8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687725013, "uuid": "8b051c75-3a27-4f7f-b18f-ef968766eb28", "comment": "Malware payload (AveMariaRAT)", "value": "0036f450e9603724befe6600d57e1e070251c3064a231530855886d6a12b58ff", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687725013, "uuid": "9d867535-17cd-4a5e-b134-acff3fca8901", "comment": "Malware payload (AveMariaRAT)", "value": "689a1b2da8319cff9fc5985c290349329d2c63a7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687725013, "uuid": "d580c413-bcf6-41ba-b120-79bfc45b9aef", "comment": "Malware payload (AveMariaRAT)", "value": "a9ddd19354e52f60b24f990ac531f410a323f5c1e8c79757fdfe5b4b901f8785063997a008a730b3ba9914da8c88685c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687725013, "uuid": "130f8d34-e78d-486f-a074-2ab1e346a638", "value": "T18EE37D227BE54039F7B705701AF93E25D7ACBE310E31CA4B5BD4488B58B1589E9363A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687725013, "uuid": "390ec090-5f1c-4160-ba83-7185e80aed1a", "value": "0145d2c473bdbcd7b46a054bd6893ec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687725013, "uuid": "18f6603a-1876-4c2a-b84b-8d6855d365a7", "value": "3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687725013, "uuid": "31f9d631-832e-403f-89f9-7f8633b5488a", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687725013, "uuid": "84467bc3-53b3-4314-b2b5-74efa4554059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687725013, "uuid": "874967b2-459d-40a5-8648-60e9a38b7180", "value": "f78c8e53c514ce13844541e2d735c9b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89aa69c1-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678391, "uuid": "148333bd-f170-4785-9902-b92bfe5103f3", "comment": "Malware payload", "value": "94ef09beb2d5652fa428df62672bd10a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678391, "uuid": "92ba5543-47f6-46c7-9ce8-72a82c8da682", "comment": "Malware payload", "value": "016f0cf60cfef7ed434d9fd6b7b33b5bd2540c61fb419ba4f81dd413c2757607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678391, "uuid": "413df2be-3ff8-4922-b1d1-674048629ccf", "comment": "Malware payload", "value": "a7109e8bd05c24cfe15ce876f88f38291ddfa7fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678391, "uuid": "12a94d26-5c6c-4b14-9722-c2da30a73cf3", "comment": "Malware payload", "value": "d1d0ade11abda120fdc755bff0b8c962a59e6c5ea5947d6e1233ee05be5ad7330ec186a4808a7834caf59fb3b79f7ab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678391, "uuid": "e300a45f-f7bc-401e-a290-df43c3cbbc9c", "value": "T1441612782100D6BBD7C32471E853805F4C2A6872AADFB98A7787CDEA18675BCD074BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678391, "uuid": "1006104d-2f2f-4bd2-867e-b60b5562fef9", "value": "98304:ZMrQBmnYiKhaDG4o/oRvduHKmNZqjTrY9MQS6KB6nEH1OLVEAj5d47RgQnv87J/i:ZnUIYDG4/ENZq2S6KB6nEOL2Q5d6v8p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678391, "uuid": "02336fe9-b0e8-48a3-951d-1cfdb6b71d9f", "value": 4103168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678391, "uuid": "38e8eea1-9032-4a84-82c3-3024770416c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678391, "uuid": "b55311d3-2dd7-456c-9e58-1028c7ff7740", "value": "94ef09beb2d5652fa428df62672bd10a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a94cefd-1338-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687684298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687684298, "uuid": "0cbcd038-c281-4be4-805e-a3f501df77d5", "comment": "Malware payload (RedLineStealer)", "value": "699a1869686fb9193701d6de3c0b38d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687684298, "uuid": "d68c6db7-9211-43db-a8f1-bf7e0412e757", "comment": "Malware payload (RedLineStealer)", "value": "0201c8ff3fc3c6d8a149891d05db95d450d63e8fb22b8a991ac5a29e0f051b6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687684298, "uuid": "e89d4316-96aa-49d7-9806-f459f2b176d7", "comment": "Malware payload (RedLineStealer)", "value": "89d77980bbe4585f525a111349ac4ccf97bdb71d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687684298, "uuid": "35bc4bbf-1143-42f6-9023-c40ac68bbbf5", "comment": "Malware payload (RedLineStealer)", "value": "466132eacd2604c4a9c5917bfe47e7054e18d2fa8c4b39361e76468e14ec6174dad2020c798da118c6ef0e9e301d1344", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687684298, "uuid": "cd4e7722-5d87-4a2b-a1ee-8a123a079f86", "value": "T1770612361D29C6B9E3D3CB38CB53C86D5E282579369FB0852B898D8A756F4ACC173D10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687684298, "uuid": "006f03ca-910b-4e7d-96d4-9689324586b4", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687684298, "uuid": "ebecb79f-2ca9-4057-bbad-eb3de3d98034", "value": "98304:vbBWM22XnWIj5KMxsm5HshyOOR8+dkW+O9tPusgTc//BuhYe0PLGHOJ:TBHX5KMIcrkW+OdusucnAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687684298, "uuid": "814f1c18-0645-4af4-9c48-795e33222a64", "value": 3781632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687684298, "uuid": "667cb616-e219-4f6c-8b92-5cf8b121c1df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687684298, "uuid": "37f8ede3-db14-4db4-bf5e-6f423b77540e", "value": "699a1869686fb9193701d6de3c0b38d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed8adb6-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676279, "uuid": "ce27abe8-0bcb-4a62-8990-b7a8d94edda0", "comment": "Malware payload", "value": "116e6e082b9ad46e2e9cb2d8d322bf82", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676279, "uuid": "28d7d41c-063a-46e5-b059-6dca42d7e057", "comment": "Malware payload", "value": "023db83b16e548f44a73ed1bc0c30402764685459ba9118b3230f17022a107ec", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676279, "uuid": "14340edb-ff8a-4bae-b2cd-7fbdabcec3ee", "comment": "Malware payload", "value": "b6e0d521b30bdc6c484b46e7468f18afdc81574c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676279, "uuid": "7b2a3d7b-4a77-4a6a-b19c-0fe9fdf8887e", "comment": "Malware payload", "value": "645abdaed44fde16af277e10305da707ddc17d5f7d9cca9c2a2a29ed21660bc3ac6748e1d00f68890aa158b4ed9c9eef", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676279, "uuid": "50c8142a-a8c5-40d9-8d17-5aff076b1ea4", "value": "T14A74E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676279, "uuid": "cfa3aef5-b35a-41fe-869c-0fc7ca1f0c73", "value": "6144:Nkzpkc86ueZHV56NwBAGhQuILtCoGRmd+BUKCP5LtuEulM:686uNNwBGCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676279, "uuid": "f6896fe5-a33e-467c-8b6d-7b689ce0bd80", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676279, "uuid": "a17d96ea-fd29-4c32-a1bf-19a2481b8273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676279, "uuid": "efa556a6-5792-4651-84c9-c3140f11457d", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a84569-1328-11ee-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1687677639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677639, "uuid": "d00b7af7-e275-4ab6-8587-06f5666bbffc", "comment": "Malware payload (TeamBot)", "value": "da9f781614a5df1a7f76e2823a442d84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677639, "uuid": "ab322938-28e1-49d9-8993-5fa161836c61", "comment": "Malware payload (TeamBot)", "value": "078223b567e70ff5c536f9d2beea54309962301fbd5273cdd2be8e8fe082e99f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677639, "uuid": "37993ab2-aec7-4107-9c73-d46b45c554a5", "comment": "Malware payload (TeamBot)", "value": "603d59490e18dcb5b2b993ddec9bb4edea7fc55e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677639, "uuid": "55688e46-5efc-4959-9ff0-56f614e2f62d", "comment": "Malware payload (TeamBot)", "value": "f0bab7f5a9b1ba184a9a8d4c6697f1493a1df6c469cce8131894e66bb5648a8949296171191df3a551c903882026509c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677639, "uuid": "7e0b5260-fced-44b5-8ead-bc5f182f7e8b", "value": "T1B7F412D2F590B871D4636A317E39CAD0392FB921CF6817B72378262F0EB12E1DA75245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677639, "uuid": "8e3d869e-feee-4712-9fd4-ec7dcd978ec8", "value": "9a21fb86d7cb757e687d836e62cdc05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677639, "uuid": "dc76c45a-9cae-47df-912a-5b4547080047", "value": "12288:w/IkvaA5id7YeQc9wQCuX/QmfhDlP41YBfyHujTOh+hDM34lpOXHGipocZZNt:w/iA4dU1c9BtfhDlPkYBfyOvCwDMIlI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687677639, "uuid": "33672358-1ea0-4086-beea-5827c7ddba32", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687677639, "uuid": "5cd774af-1a44-4287-823b-e376d3c61fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677639, "uuid": "7c114e68-bb4f-4801-9366-a8131cf86b6e", "value": "da9f781614a5df1a7f76e2823a442d84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39aeba1-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687717653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717653, "uuid": "e9768c65-c78d-4b88-ac98-3d0e537bbbf9", "comment": "Malware payload (RedLineStealer)", "value": "be20224721e4f47b0b1da39e80afd36e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717653, "uuid": "48cdfbdf-10fe-463a-92c5-37c13c6cd869", "comment": "Malware payload (RedLineStealer)", "value": "07f2613b38c3968cbd1d349c75faa9dc64a838f401cc2e1c32d24197f733eb51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717653, "uuid": "2e0ef037-7d76-4f4d-ad1d-81b93d4d19c6", "comment": "Malware payload (RedLineStealer)", "value": "aa6102bbf6a02eebecaf1851f949c0a1304c5287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717653, "uuid": "fea04719-2f8e-4f06-b3f1-0c2c7944078b", "comment": "Malware payload (RedLineStealer)", "value": "40ea6daca325ff3faafd0823c81f4507707267842374581b685b3a36f25c4673dfc291c149c83cdf94ba111896750a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717653, "uuid": "5c1d7b5b-2293-4b8b-8b33-1b192894d78f", "value": "T116B402213940B736DD59B03192EFC227DCFFB8325F938093EB4861A60B912C7AA5D55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717653, "uuid": "b61313bd-2c71-4a2f-8b74-c29328bc5b91", "value": "89591827d8fa86937981d5b74d9dafb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717653, "uuid": "592de7ab-b691-401c-ad47-c6cc0c3281ae", "value": "6144:kPb+RIDt0q6Zwh24HVvsrlnIJqDjGSp34zq+vLaGi8+M41XaB3gMmaoHXhAcEBM1:hRIDt03zIJYzp36ugvxgMmV4W+oRc4Sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717653, "uuid": "8c85b83d-1986-440b-b417-6929b508bd33", "value": 508176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717653, "uuid": "0ffcbbed-e73d-40ce-8e06-78c6c7fc9327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717653, "uuid": "90a75c8c-c074-4e46-ab00-aaf616a9eb04", "value": "SecuriteInfo.com.Trojan-Spy.Agent.7887.24966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3626e7a-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676287, "uuid": "e4e010bc-857a-40e0-8858-ed1cfa9a04f3", "comment": "Malware payload", "value": "75637ffa33b5ec8db6d4d0878904e8c2", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676287, "uuid": "d09918dc-e32d-42c1-9ad0-a36467071666", "comment": "Malware payload", "value": "0a807d1982e194342e20f401710a802c268169aa100e60d85fd058a2c142330c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676287, "uuid": "3481dd54-5d97-4043-b8a6-b6e4e4ab6ee7", "comment": "Malware payload", "value": "6874433a8e5abaa6b624deaf56917457f41f7632", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676287, "uuid": "ac57a88d-7e8d-48a0-873f-5b10f6c0f45a", "comment": "Malware payload", "value": "510c0a89fae19daf07d23b14de743ac74794cc8f6db30178ea33d8162419c8133f3664a01ffa29cc486b57fd40c778db", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676287, "uuid": "f1275b3e-af0b-4605-947b-21952e1b64de", "value": "T10F74E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676287, "uuid": "1608087a-3390-4398-ac16-d2d60d6cebb8", "value": "6144:Nkzpkc86ueZHV56NwBAG+QuImtCoGRmd+BUKCP5LtuEulM:686uNNwBsCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676287, "uuid": "92bf7c18-29e1-401c-a6bb-f921986d8680", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676287, "uuid": "7b778767-3b7b-48d6-9d52-c8361358b3c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676287, "uuid": "ff656cdf-1830-4070-a046-f681c86004ec", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9429703-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676296, "uuid": "70716f97-a9b8-442f-8d72-45e1dd60ee8a", "comment": "Malware payload", "value": "edb36ae097f1114b64eb77a939e2e468", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676296, "uuid": "261871f3-87d4-437b-9498-d271e56ea943", "comment": "Malware payload", "value": "0ab1d2240cea70279c17e8813d949a2f0f5e3d9e91d63e3e474d9874ccbf40e6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676296, "uuid": "b0d8069a-9b8d-4e6e-81e9-fe89a9f19c55", "comment": "Malware payload", "value": "3b88e3e05545ef7a3133a474043ed537fa3a7d4f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676296, "uuid": "72bde947-c1a1-4319-bc04-92302630a5fe", "comment": "Malware payload", "value": "8b4150a152838f688fd2dca345f00138b4013b476ae5eae04abf37426d1e9579a01da36ba8ce4d6d26c4f3898fb87673", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676296, "uuid": "827ae694-07b3-43e1-ad55-bbf90e29e763", "value": "T1DD74E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676296, "uuid": "096df382-b636-440b-91b0-029306fdd544", "value": "6144:Nkzpkc86ueZHV56NwBAGQQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBiCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676296, "uuid": "8aa16424-0481-4e02-aa15-6962205b89d7", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676296, "uuid": "41ea1d71-4ed3-43bb-8b01-56251be1b97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676296, "uuid": "ecfda80a-6bc7-41d9-b0fc-fa5d267cf1a7", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7758096f-139f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687728611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687728611, "uuid": "8e7bb47b-351e-4402-95ef-420babadac37", "comment": "Malware payload (RedLineStealer)", "value": "7e5b9d33c345c2351e9f2295b617b617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687728611, "uuid": "d8d8f45d-3ef5-47ef-9cba-3d8c5952388d", "comment": "Malware payload (RedLineStealer)", "value": "0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687728611, "uuid": "083c30d5-9728-4090-abc7-466c50b20382", "comment": "Malware payload (RedLineStealer)", "value": "91b31d238075a8fc704999b9010272dd8e3ca8bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687728611, "uuid": "f39d9ee3-16b9-4b81-b09f-034da41af900", "comment": "Malware payload (RedLineStealer)", "value": "51a752347e90826832434c6773a56f102f662374d3f49d7481afe5d176eb65b005e300045f9cee9ee32ede83e5657879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687728611, "uuid": "dea73da1-6615-42a8-ad64-48150b7add94", "value": "T10F351213F9C08AB2D522183316169F61A13D3D305F758ACBE3D56C5EDE222E0E7367A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687728611, "uuid": "37dbe1ad-3440-4ea7-b517-6c41e6b43da4", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687728611, "uuid": "8c2307ca-3f93-4c9f-8c2d-8190d3ad9e31", "value": "24576:PlMiZMVn1db5ATcLPkZeBEEbHlS9A9Ims+Jpxamu9qWl:i7PkZyg9i6UDpCqWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687728611, "uuid": "4e89b503-6d57-4854-a383-133ba154aa48", "value": 1133091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687728611, "uuid": "206dd1cb-41f2-4bc3-a0a3-10788cc80169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687728611, "uuid": "dab44439-f7e6-4208-a7b6-8e5b98fd8da6", "value": "7e5b9d33c345c2351e9f2295b617b617.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bdbcf6-134c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687692986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692986, "uuid": "bf34dd82-40f8-4f9a-8bed-0ccd824f81a0", "comment": "Malware payload (Mirai)", "value": "931b10a82661471bcecdf45207dd381c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692986, "uuid": "427d4013-a632-4c84-9d95-c161b1d6ad8b", "comment": "Malware payload (Mirai)", "value": "0bdbfa400115d998c269bd5515e8d02e23fb8862a2b0e3a0379bef92eb15c690", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692986, "uuid": "d749d631-e3a5-4d41-b9b0-25cc077680af", "comment": "Malware payload (Mirai)", "value": "b31b55f80b007e9bd7a08806ecebecf3fe4fdc76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692986, "uuid": "1764026f-0307-489c-9e58-79c1370a2fb3", "comment": "Malware payload (Mirai)", "value": "a81a8be534ba7a10008b4ba5f0676e31a9b01a17b4ed1e82979bc9c98bbabb6d8e9dc0520386ec0c7fb43c202694d404", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692986, "uuid": "a2d31dd1-f376-487a-b774-5bac6e7c9231", "value": "T14C23F1BE9A885C1ECC8CCDBF9461B2553F1534C169045BF8538F9AD8299EB43F88F528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692986, "uuid": "4383c68d-2053-435c-b5db-e07125b7efb9", "value": "768:WvOZYGqFgksOQQeFzjJ+iFm7/y/e3heqP3zcIjzigOhsIXeN1n1GIzdmv6757WM6:oeXRO90jJ9F5/KHX3Z1G0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687692986, "uuid": "c57bd051-5bf6-437e-a4af-deaa656217bf", "value": 47416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687692986, "uuid": "899a9d0a-743b-4c04-a4c6-ed1d4a421ba4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692986, "uuid": "eeaf3c0d-76fe-43be-9ae2-b414d7914175", "value": "931b10a82661471bcecdf45207dd381c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61bc604-1309-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Emotet)", "timestamp": 1687664373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687664373, "uuid": "257957e9-18c1-4a9a-a712-cfd4aa8dcfff", "comment": "Malware payload (Emotet)", "value": "da2e780d55c432edcfeff30e57284bdd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687664373, "uuid": "d10c7311-86dd-41bb-a0c0-380d430a939c", "comment": "Malware payload (Emotet)", "value": "0e70671889e441e9926c6a731ce722797526a7ebf785d4c8cd5fa6ae671c8924", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687664373, "uuid": "f6e97f9b-cee9-44ea-a968-0624ee3e1318", "comment": "Malware payload (Emotet)", "value": "f993e9cec7666d700df525bc985d3118b27961f7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687664373, "uuid": "3374ed3c-f41e-4b33-9436-34801c436571", "comment": "Malware payload (Emotet)", "value": "87d6f37879dd54a8232a9e98770fc3b71bccfe153d5de7103e12540e70b5cc901c3e8d94440ffa5f15754b530e3cd305", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687664373, "uuid": "2319c267-b038-4929-9d11-df40e114ade1", "value": "T1BF548D0377A0C877C55344738FD69B7AE6B9E9244E27870363A0DF3EEC746C1A926225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687664373, "uuid": "6ea721e3-a613-4931-b733-d9eee9966c96", "value": "2f0704ebd695b7ce6ae750b4b2cb2592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687664373, "uuid": "d39e1b64-81c1-405e-b6a6-72769e19ccae", "value": "3072:JAYspeoUzvHwnPeXPIthrxPs+h/b2WSaGqWvO0F0Zg+8I6zadMUKAaHKtb6Pr1Z:J/iUciehrxPTb2WbWvOXAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687664373, "uuid": "f823d4f6-33ca-4ef0-9508-9d26b19e491b", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687664373, "uuid": "a02f568e-5aa9-475a-9a7d-9e686551b033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687664373, "uuid": "6079dc0d-51aa-44b8-9dd7-e4165e64dc98", "value": "\u56fe\u7247.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b141798d-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676310, "uuid": "4a7bfd6c-1675-45b2-ac71-bdcc4d09e1e7", "comment": "Malware payload", "value": "6245edd1a82f6171d339306daa0db99f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676310, "uuid": "089db3df-6e51-4330-add1-71f1d377890f", "comment": "Malware payload", "value": "0f78aff7ae5311091367a67689d87ba646f95ac97ad501a6365758f2ad072632", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676310, "uuid": "1a0ce0fd-4ee9-4aa4-91ef-bb840fd7a85b", "comment": "Malware payload", "value": "c4d0844945acaa8043ba2119d84bc25abcf73ae4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676310, "uuid": "c5f09c2a-7781-4de3-9da9-b05d858ee955", "comment": "Malware payload", "value": "626ec7b5cd08b9b6fedc7abc0001ebc1f3a800fe6e25ee042648b18702cce875dc2217f621250c32e9605d4ecf1ec84c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676310, "uuid": "c44fa0f4-251e-4fc4-a679-5058d4ee41a7", "value": "T18B74E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED4C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676310, "uuid": "ba93c750-6ac5-442e-b2aa-ab200a68f2b3", "value": "6144:Nkzpkc86ueZHV56NwBAG9QuImtCoGRmd+BUKCP5LtuEulM:686uNNwBPCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676310, "uuid": "1f7f3935-af6b-4737-b2df-2f079ca2545c", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676310, "uuid": "e1fca80b-ee22-4770-8b5b-026158c40cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676310, "uuid": "bd763a45-1baf-4f64-a67d-4d4c599dc56c", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3301486-1328-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687677628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677628, "uuid": "3e651dfe-2fcd-4e81-a447-7d438a5894b6", "comment": "Malware payload (AsyncRAT)", "value": "88c714103392d29ac74838074a290481", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677628, "uuid": "4afc3451-8159-4a4e-acb3-aa89ecb37b54", "comment": "Malware payload (AsyncRAT)", "value": "103485a69410f59a8265939c25b0182ccefd11827f8a4beef2a1295926863d53", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677628, "uuid": "d7a710ef-62f3-4fa5-9095-d838e0a97b8c", "comment": "Malware payload (AsyncRAT)", "value": "81cfc8976ebd851164ca64460409256d3475b2f0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677628, "uuid": "c9f05877-a64e-4d64-8d47-8ecf5f86b8de", "comment": "Malware payload (AsyncRAT)", "value": "46c6bc6764ee5f3bd1dfb7ab6d708a68603bfee9b8e9d7b4ddebbf8220595f3da5d06343ae22f85fde41503a4d3e28f0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677628, "uuid": "ad0c2ab1-e71f-4ffa-9c3e-088c2c9650ae", "value": "T15404381437E81919E3FF9BB8F4B001258B72F8236913E76F289499EE1D62345D550BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677628, "uuid": "5258ec05-9006-49b5-b001-72edec6ad97a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677628, "uuid": "057e2a3c-0e90-498c-8301-8a3f172a4071", "value": "3072:G+STW8djpN6izj8mZw+GSv5hqIPu/i9bcJ2cTXre6+WpD:b8XN6W8mm+vvnXPSi9b45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687677628, "uuid": "13db3a81-4067-44d6-ba94-887a93f33d44", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687677628, "uuid": "54097347-3e4e-4d18-aba0-d461bf1d35cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677628, "uuid": "305f0928-d19a-4422-96de-8084b503b70d", "value": "88c714103392d29ac74838074a290481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c190838-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687676060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676060, "uuid": "66a608aa-b8ba-44e8-bb49-657e7a0edff7", "comment": "Malware payload (Rhadamanthys)", "value": "b4214e2a01b7c0b16d4424cfe997178b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676060, "uuid": "67abd7bc-b939-40f6-a78c-48d4a03e65d1", "comment": "Malware payload (Rhadamanthys)", "value": "107cbfabb6cacac0845c956b96c8f41235e986849a9a6e3154f3f92056ac6bdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676060, "uuid": "c82dabdf-5fda-4f4e-887a-ebaa93475a76", "comment": "Malware payload (Rhadamanthys)", "value": "24e7545fa80e9028dcbf85811d28947047f91782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676060, "uuid": "fa4130b2-1b7a-4291-b3e3-d18c54e17e2d", "comment": "Malware payload (Rhadamanthys)", "value": "13f7f3355ddc46880857593df9ddbc1d25d1668f1ce234e9c044518ff2f7fcec957022bf0c703b14590a0ff1ce507df8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676060, "uuid": "dc09815e-4d3e-4de2-a190-19bd6144fe37", "value": "T122944BA5BBF2ADC4CE8D33F388046BA4069E477645F2D2C88D295952173F6A5CB0B53C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676060, "uuid": "01959c45-7f67-43d6-8abd-fc5000126011", "value": "6144:L/E8DIpjK28t4snQxlp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zf:dEpj7snqv/cgu4VGn6OaM+ucjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676060, "uuid": "4a05f778-564f-433b-9d67-d9cfb90df08d", "value": 439462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676060, "uuid": "ed940441-9059-48ad-974b-9c29faa60a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676060, "uuid": "f3b7bf0d-ae4a-4ddb-838e-7f248984fb57", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abe4d07-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1687676031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676031, "uuid": "878b9bd0-ad51-47c4-8c83-434a6e7ca6a7", "comment": "Malware payload (SystemBC)", "value": "6ae917525435e23b07d15537fb40aea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676031, "uuid": "f63d37a4-6eb3-4cab-80b8-28f2be85c7df", "comment": "Malware payload (SystemBC)", "value": "160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676031, "uuid": "9255a4dd-a797-40d5-bfa5-1b9ec3e72536", "comment": "Malware payload (SystemBC)", "value": "7c85b447bb5608ba7fb6a332c033c0cdad0430ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676031, "uuid": "184de998-bc02-4d06-ab87-87dae687d092", "comment": "Malware payload (SystemBC)", "value": "bc8b9978ca476736b6b0f2ac476df164f6125fb7f05a077c1754988c4213ab61163b8ea27c7dceda587798e7a630eec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676031, "uuid": "ed9a4651-f5f1-4347-93af-7fb32fb8adf1", "value": "T119543880134B9B9EC81831B672A3177626F8ACAC45BCD31F674A6E745EE37F26C05217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676031, "uuid": "8b9478e4-f242-4f9f-9892-321bbb122d46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676031, "uuid": "c3cc2795-40c9-4cd5-bd59-a7f0b2cf3440", "value": "6144:Ft+WQdzUUPFTf2HHvKlHQho0jT21v3Ifz/x2ShelxPcWpv:61oqm+QbjTIwr/l00m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676031, "uuid": "97b1fda0-b23c-4d30-add8-030b7fabaf9a", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676031, "uuid": "6ef57866-d56d-4d92-8c28-3c4b36b4dac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676031, "uuid": "fa920343-90b9-4240-b18b-58b6c10d145b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06914946-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1687676023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676023, "uuid": "f8fd4d70-1bf4-4dd8-ad2e-e37746cd0cb6", "comment": "Malware payload (SystemBC)", "value": "8d7ebe871589d79f195f240dcef43a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676023, "uuid": "0a17ab91-202e-4359-95a5-0480388b8732", "comment": "Malware payload (SystemBC)", "value": "19397c6dce459330095edc72759d1e79e26f1e12f013cdaee6dbdb90d65aaae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676023, "uuid": "e855b6de-b3a7-4492-8fab-6e57da4f139a", "comment": "Malware payload (SystemBC)", "value": "f5315edc9bfeb6f37c9df6ad1f10cb3363412d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676023, "uuid": "54c232d5-3ff7-4fa0-9933-32c96bdbe69b", "comment": "Malware payload (SystemBC)", "value": "abbbb41d833a652d6305fbe20b183f626c34a173c38efc922c85e3473d8a0a9b16191475d60c7dfc25cbcd49823cf9a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676023, "uuid": "071656ea-7da0-4e64-be1a-9ad3aa9705da", "value": "T19F247E1272A3B871DC224A334D5FC6E4AA1EFE508F1876B723187E6F19B02E1D572352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676023, "uuid": "1a434087-674b-4a32-bdaa-35c4273f47e7", "value": "8577a8bca69eb3cc886ffba8fc991a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676023, "uuid": "1e02c981-8b49-4e38-bd1a-661ff2ea9a1b", "value": "3072:/M8Ejf0TGpNkCdEjDOCARNT4Hxh6skqg2d1vIH+J3Ul:DEj9ICdEjDgt4RuW1vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676023, "uuid": "c3c54333-3d69-464c-947a-2ab123352a24", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676023, "uuid": "0becbef1-47d9-4630-b102-5499f53c7d67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676023, "uuid": "c5020c8f-aeec-4e8b-a745-7e3b44bc9a7d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f79abff-136f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687707929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687707929, "uuid": "dda7b8cb-ad8c-4dd6-bbe7-412e88a7ac4f", "comment": "Malware payload", "value": "42f07d2147ffd3405efb75e18dc309fa", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687707929, "uuid": "bd75a5b8-6c48-401e-a685-28f7876d7b1b", "comment": "Malware payload", "value": "19d0522271b605a20e5fde96931f6f4e4e53ef561e75a86d2e081b9d2b41c20f", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687707929, "uuid": "026494af-6967-4407-b558-0463c2436a10", "comment": "Malware payload", "value": "cae85fe608bb3a106aa5cfb930c77d089c133fb9", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687707929, "uuid": "f5f6054f-244e-4d22-8140-3c5ffeed5c0f", "comment": "Malware payload", "value": "7f2c648500d4a58c1df27058882a4d1963cc20b00be44a4a7d2a856f084f2b70e4ccef3cae3504f47dc89220926d2742", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687707929, "uuid": "08251177-eeb4-4cbf-b884-cbb8bcbb4069", "value": "T115E5BD05A692DE6AD3C82B36A013995F4770D6223723BB1F9F7D06343D927B82D423D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687707929, "uuid": "bb85e52c-9c3a-4cfe-8de4-fd8d0a53b246", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687707929, "uuid": "906c98e5-0ef0-406e-b191-d361e7ad8b1d", "value": "49152:L+zOguBBWJfYqkIBlUTBnjWyUlxZVGKGJyKaSbr93Am8j39J4CxwtfDC5:6QnWJgqkFBK97VRLKTrJAoCxwte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687707929, "uuid": "ab695538-4a94-4aa2-a119-7532a47a469d", "value": 3251712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687707929, "uuid": "84ba4947-1bdc-432d-8d96-84dce89e6dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687707929, "uuid": "2e2955c1-0eee-4694-8d97-16213382e7f8", "value": "1687707912618843a3098163c4a77b02a70aafd58ac54f3cd7d6778bcd0f0e93f4a1409f33987.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e561a6-1338-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687684294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687684294, "uuid": "17350314-1251-4cb6-bd20-0cc0807fa97e", "comment": "Malware payload (Amadey)", "value": "3fbf996e2521e2fe48ec27a008bb1249", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687684294, "uuid": "10a904dd-2b0f-4749-a92d-ecc5e51e6ce7", "comment": "Malware payload (Amadey)", "value": "1b1ad9545962b79323343754bd959d6851fd23835739efe59c42293a75d96c3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687684294, "uuid": "907c0f84-fbb1-4caf-bccf-7e9cea5d3a08", "comment": "Malware payload (Amadey)", "value": "5d582e4bd5ca665b563bd30ef13818b3c6eb963e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687684294, "uuid": "eead5d52-4f77-4145-a3b5-2c32eb23ab1a", "comment": "Malware payload (Amadey)", "value": "6d21d31b47f87151b95e7064d843d28740760e868ec45c2a8dd0c97aedd0527a11fb83820df2702c4385f13bb69ea605", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687684294, "uuid": "157f790e-67db-4e62-936b-d1e2814e0311", "value": "T1D71611365264D5B1E3C3CBBBDB13E02C1EA960B8319F34956B568DCA2C9B27CD533819", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687684294, "uuid": "205b7be6-8d1f-4abe-82d0-0022f463a52d", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687684294, "uuid": "7da8063f-d784-4a1d-8166-485075f74574", "value": "98304:2t4VxMUVIBMI86MhLOs/SRxttrJkUsjpcWFDblQC8fo0OEvqZX53NA6TCL:04LMUVICoZRrtUWWF3lQCnuOY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687684294, "uuid": "5e3e3236-5b9c-44fd-84a8-54d6b341955c", "value": 4143104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687684294, "uuid": "d51bcd3a-6cc6-4d84-add5-3e54db81b323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687684294, "uuid": "61ec7c13-c441-4e2c-8a26-8df638b5bb2e", "value": "3fbf996e2521e2fe48ec27a008bb1249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc949216-1324-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687676007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676007, "uuid": "6cd90d76-6d07-4448-965e-d462231932f3", "comment": "Malware payload (RedLineStealer)", "value": "f98f3cfab75abb321e3141e7e71b0094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676007, "uuid": "3f6b89ee-5fd7-4274-b421-cebd1f2513ca", "comment": "Malware payload (RedLineStealer)", "value": "1cc9a5335e90cd21fb7cc7f39c7d5e13c55306b875bb9603d1a3479dba3e4d19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676007, "uuid": "2b4928b2-363e-4f1c-8de2-57c550efcf50", "comment": "Malware payload (RedLineStealer)", "value": "a10c545fb9410cead3ecb43c2940a1ab8a49a498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676007, "uuid": "c5f9d487-79e7-4bbf-bbe7-60d63f122f39", "comment": "Malware payload (RedLineStealer)", "value": "847d2ea3d49dd436720bdae9d21a9c59c5747fd0bc88911eb03ddf511c5eda9479781c3c81f7ad14650f524f6fef1b03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676007, "uuid": "18485965-ec67-4861-b9ab-885afac56a28", "value": "T12055AD132995B661D8D3B8B2462F83112F68F7B1AD5F74D9EFA83934903788D6CBB041", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676007, "uuid": "49661a23-8827-4e56-8a57-c14c2e8605ae", "value": "587a23ee0bccf95906f888e2a3c1c6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676007, "uuid": "705de61d-9ab4-4dd3-8ff9-a9f64204573e", "value": "24576:BAH89Mnnr2Zz/681FUjI0X+iGCC09xfine1tBt8MKOXlxACM5mslAgymbIjH5Dgc:a8KnCz/6hNXRZnfiQtBtD9XlxAz5J6g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676007, "uuid": "a9e28203-e4cc-44ee-ae17-315036ed6382", "value": 1358336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676007, "uuid": "32748b7c-ef74-4f30-b8fe-207139f349ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676007, "uuid": "6a526e8a-5e14-4635-8b95-c718f0a0a11c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045200c2-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678597, "uuid": "3b73a591-11db-4e6e-9a1d-100511299689", "comment": "Malware payload", "value": "c497df1d08817a7c01fbf42730804872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678597, "uuid": "3f84af82-3363-4d04-820b-c3802c77b123", "comment": "Malware payload", "value": "1fc7f9ae993d14f2a3b7ac92417771cfa0d20e728bc3ecef56fd4020b04c7746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678597, "uuid": "3125bea6-11a8-4512-8410-2c713d86c3ba", "comment": "Malware payload", "value": "06bf42849d1d32f52ca8e37fddb83f435812ebd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678597, "uuid": "aba0b872-0f46-41ec-8c00-3e6578545a17", "comment": "Malware payload", "value": "379d24b2124fb4ddbe8b64902638c0da1f5ad979e6cd53e96ee40ca7d54671bae8dbcd5fb0c6a51cf5bedda57cce63ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678597, "uuid": "c21939e4-c18b-4f17-8f58-67d2cff89678", "value": "T1D3C512D76094283508C7FB76CA18C31FB817A09522EF929D9FADEFCC4676535D688E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678597, "uuid": "288c39bf-86b7-4689-a96e-4fcfbfd1e54a", "value": "49152:SpZhRQZHj4YccEZIC8icieKIKBqqgOF+D7r+TNWHT1XWVCicwyyLavax0AvecNow:AZh+ZHj4PcEZIC8icieKIK0qgOF+DnYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678597, "uuid": "0a113f00-d7ef-40e5-a6cc-b2e68f89489e", "value": 2685269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678597, "uuid": "cbf9306e-f7a9-4ab7-afd8-23ef24c067fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678597, "uuid": "9c532efd-ee49-4db0-8693-89f3d8c5a17c", "value": "c497df1d08817a7c01fbf42730804872.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e53e20-1324-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Lu0Bot)", "timestamp": 1687675997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675997, "uuid": "100e6c7a-42ad-4137-8c27-b100e4ef98b6", "comment": "Malware payload (Lu0Bot)", "value": "5f56900cb1e33dbcec5a35cf3e2a7f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675997, "uuid": "cdf6f1d5-3214-44bc-a143-75c5460d4a50", "comment": "Malware payload (Lu0Bot)", "value": "22b643071879895cd947cf37c75c71b23af5fe4228f36b49571b1a47df137d06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675997, "uuid": "966f79a5-ea6f-48ff-952c-fed6abb6941c", "comment": "Malware payload (Lu0Bot)", "value": "fbe9824888f20a0f6d890e611950f10ec01af1f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675997, "uuid": "ad31afe7-4787-4a2d-986d-1d9a9fe6360c", "comment": "Malware payload (Lu0Bot)", "value": "0723c6eb330a75bf2fbd049e0e67654b803c8d0b6d3e24ac4a4d83110c30486d91a3c49adbf98e9badcc1954342468b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675997, "uuid": "620f0fbe-67a3-440c-a70d-82d5ebac3661", "value": "T17DC53365C4CC9A32D6F0233439F8437B25367EA5CBA443A76721584F9DA3AC065733B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675997, "uuid": "ee6bca09-a165-4629-8c69-6f7e9fa06ac2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675997, "uuid": "53062e99-8da3-449d-9c8c-abe40b8cf571", "value": "49152:E2VMAWRywiN7AqzGKWPy3tsdWT69leSkFAaGjv616zPtQAUozn9V1B+Ry:pKo5czXmidWn1FOz6cPtxJr9DBey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687675997, "uuid": "a2b0bd78-f84e-4a44-909b-1fb60ca46b32", "value": 2663592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687675997, "uuid": "cb82ac85-98f1-4eb9-b687-ff86ab3c5f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675997, "uuid": "765627ac-e917-42de-8e51-c77296b2c5c2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb14cb8-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676222, "uuid": "1674fb40-9dfc-468b-8c92-265c3b90b4a0", "comment": "Malware payload", "value": "8ebe05bccd33f6c7b3e7094f0cfb0c8c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676222, "uuid": "b9675001-1c00-4d5b-b95e-1520c41cff77", "comment": "Malware payload", "value": "23421ab85b24f8b734928e7e88c10807910525b9cb7306c5407f05cb5e66590b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676222, "uuid": "1e7b90ad-8428-4b2b-a5ae-c4c99e2bee2d", "comment": "Malware payload", "value": "984a1973695eb7eadcf5a66b77e2d9b980923e2f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676222, "uuid": "0b42c658-049a-475d-a5c2-99dd70fe572f", "comment": "Malware payload", "value": "d5668511d80834dcf6c93b0005ef5c061746f99ffa1bf5bf18feaad8227cfb166845054f601223ff111a06c5638b6dfd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676222, "uuid": "2695ae3f-cb13-4144-bb5c-267117b02b63", "value": "T13785AFF875047DE6266F576BCA96ACDC13B62B229ACBA4CD806477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676222, "uuid": "2e7ac11c-5be3-47c5-ade0-aef3fc35fcd5", "value": "24576:KKlJENe1urC4Im5VyF0C+SIXEACNxo/91lZr4j9Y5hiVyZbnIdTKAz7+5jajZuxI:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676222, "uuid": "a8796408-1c22-42b9-9930-e8aca9328d4c", "value": 1850277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676222, "uuid": "e9dacc5a-b67b-466f-9f10-9e46453d4e13", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676222, "uuid": "f4519a08-e0ce-46b5-82d5-d9403243882e", "value": "bank details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b784c78c-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687678468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678468, "uuid": "0fa34727-d5f4-4049-b0f6-50b5bedb24ee", "comment": "Malware payload (GCleaner)", "value": "fadf37db4b9d437b491a48be4d0add16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678468, "uuid": "db91737c-4600-4773-95d2-bbaa1fd500d3", "comment": "Malware payload (GCleaner)", "value": "237b17517e84da21c0826dbfcdf45df45f1176b9863958b40024275a12eab467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678468, "uuid": "5215e4fd-084f-4c67-857a-f7cee1babe65", "comment": "Malware payload (GCleaner)", "value": "c23af051a59a7081ecaa4770b5d07024413c8e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678468, "uuid": "30f8a358-7e9c-4c2d-92fa-a73c9a9e2f1e", "comment": "Malware payload (GCleaner)", "value": "20e31814bc0480b80c7701ffaa5da21d98496550a9072b303b69beecc3860344e4e84cf8cbfade573c0f5986098ebd8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678468, "uuid": "85467841-0a02-4fe0-9aa4-5f36e78665b6", "value": "T19D64C0D27190B831D5271A327D2AC6F43A2FFC618E2877BB2258BA1F0D712E1D572746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678468, "uuid": "29133004-175f-46c9-be22-0aa65e2e112b", "value": "c53fafc0836644811493602b966f3bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678468, "uuid": "bd73cc58-2c6a-4c11-9bee-702f213518eb", "value": "6144:ZCP5CYVVMDPZZSe0hK9PURaxvYwxJeTpDUo8X:ZLYVVM7kKJGwmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678468, "uuid": "dfc26b7f-f362-45bb-b471-89e6934b538a", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678468, "uuid": "eadb91ec-c0b7-4470-be65-41b720d1ab8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678468, "uuid": "baed00af-73d7-444a-8f0e-f66a9fc000cc", "value": "fadf37db4b9d437b491a48be4d0add16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8888a22-131c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687672510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672510, "uuid": "4877d9e2-b0d9-4f86-a5fe-b7b4e8cdf7d3", "comment": "Malware payload (Smoke Loader)", "value": "075791dd48ff20d426acf11da03f1870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672510, "uuid": "22183c05-b4d8-45a5-b45b-96c2be266eb0", "comment": "Malware payload (Smoke Loader)", "value": "24a47e7cc251c9e07c9774faf218ab4faeb86e017e8b087eb2033b9d03442915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672510, "uuid": "0ea7ba09-a1b3-41f3-aca7-c10bdc4cc836", "comment": "Malware payload (Smoke Loader)", "value": "815439ccb3c26e2d1f2ed3037a30e2686938edee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672510, "uuid": "d304625a-c598-4166-a776-311f0484ac32", "comment": "Malware payload (Smoke Loader)", "value": "33f63273c75fb94ab2c13dfb7766ba35bd9730c91459f515024477b5983afe46cc18d5a4401806b45c96e0cb7b46e8d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672510, "uuid": "0459eb66-773c-48f9-9abf-f57f89a16034", "value": "T1AF249ED279D0F431D563C631BD29CAA4F92EBC204F286ABB3358262F5DB12E1D53A351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672510, "uuid": "ce76fa2c-f894-4b31-a745-59a0d184b3db", "value": "9a21fb86d7cb757e687d836e62cdc05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672510, "uuid": "a2fd800b-b648-437f-a8fc-8b32ef5a0f44", "value": "3072:Ie83d2XN8CD9G09wTrze+PaUofs5f8lIq7LEogY02ZrrEC9voR:03pCD9G0CrFPafE5sLh5lrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687672510, "uuid": "dcc0ed08-970f-4a0c-897c-19bb3fe93d66", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687672510, "uuid": "6d18ce9f-1b97-4d50-b155-ba2f57caf58b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672510, "uuid": "a3152199-360a-487d-a041-5738e85fb330", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffe6f38-13b0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687736142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687736142, "uuid": "8d04a7d1-4734-4a9b-8bad-1a7a523c8ddf", "comment": "Malware payload (AgentTesla)", "value": "97de6669ef181ef42ab34e20b3a63a7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687736142, "uuid": "2ce6eb24-e87c-4abb-aefa-fdbd31813289", "comment": "Malware payload (AgentTesla)", "value": "24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687736142, "uuid": "acb41730-11ac-4848-b4e6-73c8b12b7b31", "comment": "Malware payload (AgentTesla)", "value": "36b2c90850b65ce06285e0c629c2f7fa077b2865", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687736142, "uuid": "118a7649-ce71-4f48-81f8-99efd23b331e", "comment": "Malware payload (AgentTesla)", "value": "751afcfa886c45153da93d640017fef165ae904bf61cf6154f097d4bea175a9dbfe43c9a3109cb06966c714ff68c13c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687736142, "uuid": "1682aa7e-3312-4543-9b99-c513d40b99f3", "value": "T14A0594BD298C76A79575D99F4DE1054BF23B7322B7138DA826D212C1C62261E37ECC0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687736142, "uuid": "29b706d1-45ae-4561-8cb8-f083c6a98157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687736142, "uuid": "b359b1f2-4f05-41e8-ac89-22a9a7b1bf54", "value": "12288:S6/hU5WRQeaNvEhlZeQkR4nSxUEMvBv8Mc/7nc4GqzrRN:S23zZeQkR4nkUd2GOVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687736142, "uuid": "9a974334-e2b4-41c1-99d4-3fe4d835601b", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687736142, "uuid": "1d9e51d2-09d6-47b2-bc71-5736501bcb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687736142, "uuid": "bceb6f22-3748-42d5-9f75-f1702f1c9ad2", "value": "SecuriteInfo.com.Win32.PWSX-gen.21369.13762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d877dc17-135b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687699568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699568, "uuid": "90653778-d115-4f14-837a-cdf85623bfe2", "comment": "Malware payload (AgentTesla)", "value": "447030bf893b032c392ed42d46359cc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699568, "uuid": "57f90888-828c-40bd-8fd8-1e1fa85ebc05", "comment": "Malware payload (AgentTesla)", "value": "25694aa5ebc3ffbe99a237060cddfefc1feb49f34fa738da2fd43a4366589b6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699568, "uuid": "ff663ce9-0244-46e7-9481-c70a0e596247", "comment": "Malware payload (AgentTesla)", "value": "4d805f3e4a04b4a07fd763f9327583bad4e0aa05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699568, "uuid": "8f0d9a29-3024-45ae-bac9-55cb3cbcd13e", "comment": "Malware payload (AgentTesla)", "value": "78a2fe7d7c70c32cd35d701d48efd1b553002ce1bc2ec502061139a9f00b52f1f76d883b72f6e513f892f53e452496e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699568, "uuid": "f999d8f8-c25f-479b-bd19-94ef0a9a6391", "value": "T19815AE03BAA68DB5DB8B3735D5BB48254FB8E8D12127E70FA54B13972E0376A9503313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699568, "uuid": "3515beb6-ef0f-4ecd-9dd8-d134230ee3cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699568, "uuid": "9e2bf083-d98a-4be2-a7f7-5f24e0e4fa09", "value": "24576:M0s4hhqKGlReM0EobAONuxYy6YnqzSQ4oxIigJR:Xs2NGjBcuxYy6YnhtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687699568, "uuid": "0db31c7f-002f-4fca-9130-9bc6afa78acc", "value": 941048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687699568, "uuid": "e01b4b9d-0aa0-43e8-97c2-d6f7573b4bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699568, "uuid": "4506b632-c2e4-4888-b0ec-0f668ee9c549", "value": "IMG_78720075pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d217d454-1302-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687661333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687661333, "uuid": "c40df6fa-75c5-47d3-becf-02884d352874", "comment": "Malware payload", "value": "456530fb23d7d0db9a6e17bb17fd6c83", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687661333, "uuid": "003273b7-380d-43d4-9bdf-29ce7a1bb8e7", "comment": "Malware payload", "value": "273ad3d99bfe92c6b1aaf164e9ccf21e6ebb6c2eb938f4b1ab36cc3d51463ab7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687661333, "uuid": "06835272-135d-431f-a903-bfde9383aa06", "comment": "Malware payload", "value": "3949dc24bd39469faa4b71a4115483666519ada0", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687661333, "uuid": "46e4073c-c3ca-4847-97bc-1022d75287e5", "comment": "Malware payload", "value": "2de83d53dea5202e0d50bf0c5567af979d6324efdfee90e7866a72853b3abe3459d4df2b9b8004fc53486ddc73d3da0f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687661333, "uuid": "d37757d2-bc88-467e-8875-da7eb53562d2", "value": "T1879602DBF798982FC87B04B2897E527112574D028E839B436C58371C697B2D82F9DBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687661333, "uuid": "ab0a7ff2-82bc-4f21-aa72-cd3b7e8352fa", "value": "196608:AIxROMlxjmR7Ao1SSLXVFTQxAeUdkrqVUGAfv9KNXqRXnI:Vq2mR784LIcZqR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687661333, "uuid": "dede1ddb-aadf-4209-ba5d-877abe3b0555", "value": 8681821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687661333, "uuid": "6df1de30-1c1d-4211-8133-bb141790cec5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687661333, "uuid": "d09c89e4-b50a-4476-8bcd-dee41a33cf3c", "value": "aplicativo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab6395d-12ff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687659978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687659978, "uuid": "7f0323bc-6b97-4ae1-b1f7-cb32cbc924c3", "comment": "Malware payload (CoinMiner)", "value": "448192390a65b9cffaf11d40b5e9ac7b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687659978, "uuid": "c79b282c-6526-42c4-a15a-1bad7fba3ea2", "comment": "Malware payload (CoinMiner)", "value": "27534f1412396fe898ff5eb25143468b21b0358d157f7a82f54fc61897296960", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687659978, "uuid": "7c966fe7-528d-472f-a73c-d348d9a15c7e", "comment": "Malware payload (CoinMiner)", "value": "6201ba1c2d372bee9939529a9647ecba1752a8ac", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687659978, "uuid": "401ab4f3-9a89-45e6-ad6d-8e3a452dc328", "comment": "Malware payload (CoinMiner)", "value": "503ff15c150191303a4d66f3c31c55024d0b3415c5a1d7a026bcc16f1f74300b63db6fe76ec417042ec610adec28385a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687659978, "uuid": "98ba0277-145e-48aa-8be2-3f1fb4c0faeb", "value": "T16756D1C04C0A553DCF9387775EFB7D41798D980BA83763BF55AB976E09A70482AC3822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687659978, "uuid": "a73c6296-ab98-4cb4-be2e-236eb77c4ccd", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687659978, "uuid": "636d839b-bcf0-4bec-8f52-e777bb8e3c17", "value": "98304:fRKSIpbX1haCVfGdxBjLwH9xR59xgRUICMchthBjqVa:fMSIpbX1YIfADnm9xT9xgRFQqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687659978, "uuid": "37add150-d0bb-4028-998f-95ad0093759a", "value": 6220568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687659978, "uuid": "3a299caa-067f-4ec9-9bc2-41d94cfcbe75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687659978, "uuid": "7a8c7c05-fb95-42b9-b422-3b345c671d07", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a407041c-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687678435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678435, "uuid": "a1105355-d07c-4cf7-88b6-6726d9298964", "comment": "Malware payload (GCleaner)", "value": "77df8b9472f2196d0ff7694009769325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678435, "uuid": "9dd1083b-9656-472a-9062-0b833cb6dff8", "comment": "Malware payload (GCleaner)", "value": "2ac34c2817e2e90ec1c3cf2c09aba73cc7aaba0243c9f01d22bd131539de2d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678435, "uuid": "6342d62b-9c5a-4cf7-91f8-4c991d6d4f5e", "comment": "Malware payload (GCleaner)", "value": "73feee373a3b623c9d27d4d94c777f416fac5fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678435, "uuid": "897a36e2-acae-4c07-8782-5e776c31edc4", "comment": "Malware payload (GCleaner)", "value": "cf9ddc9ed2f9647ce8c421e7bda4c6a87a3d4a0700ab1e61fad5045ffec1a0a5cc8e23ce7cfac2fcc0d3d735fc2d3379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678435, "uuid": "da9ab454-f2ce-485d-a9e8-8836a8a15506", "value": "T14264C01261A3B871DD211A338D6EC6E4AA2EFF508F583B5723187E6F1DB12E1C672351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678435, "uuid": "10b1dff4-5201-45cf-8f60-be241e08e249", "value": "329453ddc461a51b7789ac2d751e2c20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678435, "uuid": "80d262aa-06ea-4cc6-8e8e-afdb1bb79d44", "value": "6144:JrbroCQZbI8kJBr3+NU3rr62cs53ZDZQt5m82cZVH/UH:JbNQZbI8QBa2ZDZYPH/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678435, "uuid": "a81898e2-d4c5-4949-80b3-26edd4dd3bb9", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678435, "uuid": "ba8b6bf4-0ded-4c85-b379-d8f9509c0504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678435, "uuid": "f98938cc-11d8-401a-86d4-890602299149", "value": "77df8b9472f2196d0ff7694009769325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8400ef1e-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687678811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678811, "uuid": "fde7c4fa-ca4e-4671-87a3-272aeedb95ab", "comment": "Malware payload (Fabookie)", "value": "ea11d0630e80d6352a12d2f6038e10cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678811, "uuid": "5bd74873-4f0b-4ccc-a6c2-893779eff72b", "comment": "Malware payload (Fabookie)", "value": "2b21d02167f4e5bb4754d83bf9d69bcbd09b5a1507ab8045eaefb1980ecb989f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678811, "uuid": "15facced-cd0a-4389-b4c6-bff74b271262", "comment": "Malware payload (Fabookie)", "value": "68ebbf2da9c694c1dfc5fbcf424001073fb8ab6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678811, "uuid": "65514d19-41e6-450f-8cf0-249ed47edb66", "comment": "Malware payload (Fabookie)", "value": "41aa637e41978faeeb9248687b57d5629c8f13db61c7ca5cc0f0551e3a2a78b976687b16e30cdf2dc14f7c15a20fe24e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678811, "uuid": "292c5f39-8884-47d8-b1a3-181192f917af", "value": "T180949EE1E35040E5D477C2B982734B63E7F27C285B214ADF4659B6292F337D28936A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678811, "uuid": "c60e1324-263c-47e0-a9ae-7ab872d012af", "value": "d1884757532ce7b0014241f40262c929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678811, "uuid": "3ffe0922-68f7-46d1-873a-d3ef1dc26209", "value": "6144:ul073J3XYf1K4tit9rVDWso3T+cbJ5JIJAbW0we3:z3JnYNKP7x5oCIJ5MZ0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678811, "uuid": "d62063a2-3599-435d-9d05-ce40d29d2b68", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678811, "uuid": "408ef7c4-a9af-4a48-8b21-d403c817c272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678811, "uuid": "23a68be0-527e-4801-a7ba-4f0ce582cfdb", "value": "ea11d0630e80d6352a12d2f6038e10cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2a43ca-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687717644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717644, "uuid": "13899a4f-e4da-4ec3-b609-d91567083a0f", "comment": "Malware payload", "value": "e0e54e80ea12b107483903f988bc050a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717644, "uuid": "b5508d40-3a1c-493e-a572-eff03d5c9745", "comment": "Malware payload", "value": "2c741ac0b78e55a8d4b4be1c8feaf02e574dee2f18c51445db15778075455b0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717644, "uuid": "321d0c5f-a783-4da3-ac99-be02a698402f", "comment": "Malware payload", "value": "a64fff6c7fa538099d41793f095e1d2d5acef6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717644, "uuid": "04b48d08-89a5-4284-886e-3fcbc755bfb5", "comment": "Malware payload", "value": "c21ea61883f185a1ebaf275a0f45c79804a98066f422dfdd03ce2c628fab93ef18a44e1177ebc2e805a106626a50b6ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717644, "uuid": "136414dd-b7a9-447a-bd1a-4e82c9d1b30f", "value": "T181635C53AAB865B1FB6682702935112B0A1B2C3505D0DF2F3D1B5E5E2836AD3DDF4B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717644, "uuid": "6bfcfe95-7579-468f-b6d7-e774a7d6e1bb", "value": "2f28dd1d9b83f2625461f1651b9616bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717644, "uuid": "598e6108-444f-4050-95d6-aaf64637d25f", "value": "768:2FXYxjW5hGfKiNQA9PLVjK7W5hiPnTjd60rFYFICXf6KfW5h:uIQFliUTjd6MYCCXiKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717644, "uuid": "3325b9d3-7348-457a-8683-7503ddde3a36", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717644, "uuid": "8008cedc-3030-458f-8a90-ae57cc651685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717644, "uuid": "de9bbbc1-67b6-4847-9b45-1d4bfcbf4697", "value": "SecuriteInfo.com.Flooder.Win32.Sloot.b.26008.26932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6434c5f-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676291, "uuid": "611b49a8-8183-4877-af6f-22951ccaad69", "comment": "Malware payload", "value": "b3a6bf3b6a777a7b14b028a6e07bf84e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676291, "uuid": "80be8451-b5eb-4449-8bb5-22f0b780ea68", "comment": "Malware payload", "value": "2d3744a0006d83727ad341fc6606b6a8bc0aa5c7fba9255ba30f23eab32a90fd", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676291, "uuid": "a2be4420-ac60-43dc-b231-0450c71dfcb5", "comment": "Malware payload", "value": "4be5204016a171f81d3c9b15d192c5ca00d36a72", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676291, "uuid": "2bcbe3b9-186f-4971-a2ee-2f55914b5a32", "comment": "Malware payload", "value": "5513b77701b2734a197b0d853e6f87e43c24fc0d6dc7fca76ace5adfda723686ecc4bac0818f8340958f06851f0c6dba", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676291, "uuid": "beae7760-fcd4-4a2a-9d56-ea37b2363f6c", "value": "T11E74E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676291, "uuid": "dea4c73c-67cf-4788-8e54-85c0a78aa007", "value": "6144:Nkzpkc86ueZHV56NwBAGQQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBSCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676291, "uuid": "59b7ce79-b054-4935-a7b1-cf2d8fd31069", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676291, "uuid": "2e33673b-c1b0-4bbf-9a4d-fc752841f3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676291, "uuid": "904db9e2-670d-42fc-9c85-09b5d0bf90eb", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5d2f1c-1353-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687696189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687696189, "uuid": "3906dad4-8781-4102-b619-e8ad23a87c92", "comment": "Malware payload (RedLineStealer)", "value": "3389eb5ccff67d75d8446bd40782be20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687696189, "uuid": "f3990900-ef59-4aac-af80-caa1238d5a69", "comment": "Malware payload (RedLineStealer)", "value": "2f65085666c2b43a9613c1a4e9e75bcaba63bcff97ea5f661761f9801dcc0c30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687696189, "uuid": "a9ae4926-a21c-4b49-b541-2b55f2ee2ca0", "comment": "Malware payload (RedLineStealer)", "value": "ab14fe192d8083a5754333730d32e3544bf18fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687696189, "uuid": "826b8b36-f890-4afe-829f-d376bb763808", "comment": "Malware payload (RedLineStealer)", "value": "af462a95f8fb4196eedee438c7c6780c59b64acbe65c402c3f341bc63371a35c7e4492cee877bfcc8b955ceb9f0cb7f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687696189, "uuid": "41da27f1-b535-4172-af3b-20ecfd6c8283", "value": "T1321611321154D6B5E3C3CBB7C713E42D1EA924B93A9F705A2B554CDA2CA727CE433818", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687696189, "uuid": "b176b8af-2849-4451-b14a-81ab8010edd1", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687696189, "uuid": "4668a3ce-1676-4fc8-a1a0-c94b729f8fb7", "value": "98304:mJErRRgkap2KO+XHXlZMNVbZKt7Y6WIMY/L4FAJgafR9U2Vbb3uR7ZlQS6W5f547:RrRz+XHXlZoAPWM/UFijbbu7lQDW5f5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687696189, "uuid": "6ddfa8f7-b27d-4fca-818c-06198c2e05ec", "value": 4114432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687696189, "uuid": "aab36926-c9c7-4c41-bb1f-6e6c5ab4d24b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687696189, "uuid": "c5f61f1d-f1cd-4fbb-ae9d-c854cc723537", "value": "SecuriteInfo.com.Variant.Lazy.355257.29676.7440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf04a6d-133f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687687334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687687334, "uuid": "78b682eb-5d66-4364-9eec-03fc66ce5f7b", "comment": "Malware payload (RedLineStealer)", "value": "f5c6596ed435c7cbb67627752d8b7d01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687687334, "uuid": "83c2d93d-b77f-44f6-a188-2c360206420f", "comment": "Malware payload (RedLineStealer)", "value": "3283e60979e2767695506468f28d11aa16817e52182ce35d3aa99c0e02d3e8d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687687334, "uuid": "4b60841c-0c27-4770-9ac5-5eee5469fa23", "comment": "Malware payload (RedLineStealer)", "value": "63550077c54bbaf2514d46d5b68bff30c8e22011", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687687334, "uuid": "f181122a-18b3-484b-8f9d-608eb57310ba", "comment": "Malware payload (RedLineStealer)", "value": "fbd90bc5fa875ae659ef46657c28adc94df3ba5db8ece8fe0e5f5855717bb4e209054e9c724532b8499a6d07c9dcbfda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687687334, "uuid": "0a9a3aae-8314-4d39-b4ef-172ee1c20e87", "value": "T1940601322E26C1B5E3CBDB36C753C06D5E29217C359FB0981BAA4CC569AB57DC1B3A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687687334, "uuid": "3e6c99b9-a95a-4c96-9557-b541cfc102eb", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687687334, "uuid": "afc99ad4-c318-4edd-b603-8ece9144b88f", "value": "98304:H23bdJJro0k5E89nwCtoJXJU+TTFQR+iDm4R4XSxjCaq4knwCSV7ur9a:W3bVo0RCtoNZZ4KvXSxjpqjw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687687334, "uuid": "ede70a43-57dd-4f65-98b7-3ee84f32d5a9", "value": 3809792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687687334, "uuid": "43f9e151-a580-41d7-901d-0225c43afba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687687334, "uuid": "d6d32c07-097c-4a40-a8a2-319a59a546c5", "value": "f5c6596ed435c7cbb67627752d8b7d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202c4312-1323-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687675207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675207, "uuid": "35dbfe33-b17d-4b5d-9377-8062049d2f92", "comment": "Malware payload (Amadey)", "value": "f92251dfe66ad437726ac07d560644c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675207, "uuid": "244fa047-c5e7-4f9e-aaa9-4ec03350d802", "comment": "Malware payload (Amadey)", "value": "32b5cf8561d853e122dd1d46e6c82bcd363dab62923415509a5484cfbf4fd916", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675207, "uuid": "b8edec91-aa23-4351-8e5b-192ac4ad6705", "comment": "Malware payload (Amadey)", "value": "cb12a9f26a9dbb8ee2a53384be36eb8f9ff307dc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675207, "uuid": "df998bd2-5e42-4671-924c-b8b2d43dc447", "comment": "Malware payload (Amadey)", "value": "c4590a46912ab4d3ead8d1e2674c3b12f495bde6c1c30e07b9ec43788748c04b825e285f952950cd74b307ee9f35f2e0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675207, "uuid": "b66804a1-2d58-4e91-ae18-eebad791f4cf", "value": "T1BA24AFD273A0F471E4630631BD29C6E43A2EFC614F6876B72B682A2F1EB12D1D671351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675207, "uuid": "e6f00263-0d5a-4f4c-932b-35029007680e", "value": "9a21fb86d7cb757e687d836e62cdc05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675207, "uuid": "8cb9b5a4-24a1-44e0-a9e4-63066fbcebbb", "value": "3072:tS83uP3NYCBRZQzlwTbHjpiBB0ocyRb/HLYOXhClByER:v3vCBRZQz6H6s2/LbXh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687675207, "uuid": "57838ca1-8bc4-4598-b052-dbf8e43090fc", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687675207, "uuid": "5363f5d4-fc5c-4fed-bc76-e5167f7b5917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675207, "uuid": "b12f0459-baf8-4364-8e55-79258cf5655c", "value": "f92251dfe66ad437726ac07d560644c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8106696-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678952, "uuid": "488b05a8-7133-40a3-97dd-01638e0d303f", "comment": "Malware payload", "value": "0580a4a381927fca0c0dd5ae76701a9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678952, "uuid": "93e64957-bf0b-4e11-928d-4ef7379b6aef", "comment": "Malware payload", "value": "34f4ef127d5fe26d3db60c0562bb7f7923a4169960efe5de6ab6a3f59645ab35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678952, "uuid": "ae82c1af-0162-4e65-aa49-aa7d745625c8", "comment": "Malware payload", "value": "d3b553ee088bbeee5d329f26778babd2892892a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678952, "uuid": "b0c9d625-91d0-47e9-b57d-b38b3e867f53", "comment": "Malware payload", "value": "edb2ff993a180e0549dddc884d3b0f48f90b9b839940c03ea64f0a2c2afd438580a93dd770bf621b3be623ae1f9d34a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678952, "uuid": "3ceee7c3-af29-417a-947d-4ef02accc756", "value": "T128A512BA73910C73E62F7745D0A8829FCA112F54D7D3E48C51378CEF76A9874E8A2948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678952, "uuid": "8f6066d8-c0d2-48bc-8fa8-32c977d6e943", "value": "49152:NN2Ew7qMYN7Q8ySsHs8Er9anIL/Lca3ohyfCJ:XVSqMYN08yFsR9anw/Lca3ohvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678952, "uuid": "3b92961b-b1e1-4c8b-b25f-4a4a7912ab0d", "value": 2098527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678952, "uuid": "e1695214-3d18-47c2-b4f5-54b4e8550c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678952, "uuid": "e20e255e-22a0-4468-9d44-8d6ee957af17", "value": "0580a4a381927fca0c0dd5ae76701a9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c379f391-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676340, "uuid": "40aa2055-8610-42cd-b8c0-a286064c1345", "comment": "Malware payload", "value": "eff44b56ab4265e71738a7d80fd139de", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676340, "uuid": "b993c775-1fe8-451f-893b-a641e0237425", "comment": "Malware payload", "value": "3588ac1110d1f1e93d21ffc86e568e5a598b6b398dd15777922f785320e68ce7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676340, "uuid": "e8c8643f-732d-492c-9fd1-c45796ee8728", "comment": "Malware payload", "value": "a8bb3ef5ff2043575cf8b0f485d989815c775bfd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676340, "uuid": "a7ee30b2-4a17-4d49-9891-c822153b3f99", "comment": "Malware payload", "value": "f6a4af75153ef933ae89160f8c82a1d6f95d6e17897186fc25fbb41749f6b90d84a0283822b299b41e35d6cc913a49ed", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676340, "uuid": "77e21e49-2d75-4459-8ef5-a45309cf859e", "value": "T1B074E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676340, "uuid": "50ad46ac-7098-4c98-a6f1-9b846d348ea1", "value": "6144:Nkzpkc86ueZHV56NwBAGpQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBjCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676340, "uuid": "966916b0-2844-4ae3-b944-8abac42c94f5", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676340, "uuid": "c8ee33ab-a741-4d43-b59c-145024923629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676340, "uuid": "89523e59-4f32-44e8-9f4a-84dad35fa33b", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5230d336-131b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687671855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687671855, "uuid": "5628c8ec-52bf-4a4b-a669-db25cecef663", "comment": "Malware payload (RedLineStealer)", "value": "2a506673a75f5eb2a0a4c8e35d0735d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687671855, "uuid": "e7a0a330-c778-4a5f-9ebd-099a6b710302", "comment": "Malware payload (RedLineStealer)", "value": "369c157c2b2ff64eb6080310987a7fb6baca949c3b8a5843564624d2880577f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687671855, "uuid": "585d989d-e0cd-43ab-9ae4-35367a00017f", "comment": "Malware payload (RedLineStealer)", "value": "86544d36bd68c9e9a2345422432080f2e051b4c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687671855, "uuid": "de2f5dad-d5a3-49c5-96e9-e10f3de35096", "comment": "Malware payload (RedLineStealer)", "value": "bb82d0bd70f26acf22b94abf1beb418481d3e2512385643dfe50f8c94936ecb1e108bf346e1e34e9d04e39e8e7187ff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687671855, "uuid": "7dfedea7-eebb-4cf7-9488-e5483a4e536c", "value": "T16154D0D671B1B871D8670A317D29C6E07A2EFC118F2867BB2358272F5EB16E2D931341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687671855, "uuid": "a9e38deb-95b5-455f-8c08-25e25916ef1f", "value": "9a21fb86d7cb757e687d836e62cdc05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687671855, "uuid": "0d22d0a6-3577-4d9d-bb58-6a2c6865515c", "value": "3072:MS83KaTN4Co3sVBwTRiwcNA0cccxv1GsJ+4axsxdQrPmm8WLlVyS7g0zsdbWOttj:03CCo3sVGR6cDGy+4OioiSMw0nnVDkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687671855, "uuid": "1b1030e8-1187-4569-9a37-805550e7f011", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687671855, "uuid": "14152f22-f4ab-41de-afb6-ee0ab7378d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687671855, "uuid": "8dc29cd1-31bf-47bb-a07d-25034d5388a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a6839c-135f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1687701008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687701008, "uuid": "6862f10e-64b9-448d-ad34-f8f285ee71b7", "comment": "Malware payload (DCRat)", "value": "1945e9b9e7b54901fb4443d1850f2223", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687701008, "uuid": "09549c4b-072a-4b38-8187-57cdaa8d0c03", "comment": "Malware payload (DCRat)", "value": "3927622ef8e0a99764011d9f98f47bf0eb1a39df514a7e02e78d3cc7773c4944", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687701008, "uuid": "d2e965a0-40cc-4b7a-92cf-a0ed48b06828", "comment": "Malware payload (DCRat)", "value": "10cc5512e921e4d617f0c917589812f6179bf90b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687701008, "uuid": "2f2a51b5-2061-489c-8c0b-7e6df6594b07", "comment": "Malware payload (DCRat)", "value": "5051783a07c5c74dcb6ecc563c4b1583d635e7be0b294de976978c90819fb7b9ea3f9d251baf4a9cafd90484541f0a0a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687701008, "uuid": "af6254b3-46c5-4bfa-9424-8c70d39bc680", "value": "T14A452AA27E46DD02C16D163BC9DF886807A8EF417BA6DB1A7E5F335D24123A70D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687701008, "uuid": "dcad5648-bfae-4f11-bd8a-17987edf37ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687701008, "uuid": "5704a821-de00-4178-8843-7416d8c9c632", "value": "24576:HDqgcjRDt0CD6eB/cqN8qpl55cr/BT7+4:jUftcqnn5iRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687701008, "uuid": "1359fe9b-875a-4e38-926e-7910b7ee5c19", "value": 1227264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687701008, "uuid": "1db8f339-14fd-4b06-8fc8-5622c4750619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687701008, "uuid": "77d4ecdc-6141-455e-a460-124233d82afb", "value": "HEUR-Backdoor.MSIL.LightStone.gen-3927622ef8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2effe8a2-1320-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687673944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673944, "uuid": "917feeb3-15f7-42d7-8118-d3a4f4efe73e", "comment": "Malware payload (RedLineStealer)", "value": "078ce12fd14dbcdb478673f1d0bc4fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673944, "uuid": "0f29e5c9-a829-489e-bf71-8c74e685bbc8", "comment": "Malware payload (RedLineStealer)", "value": "3a054bcc44b57c0cc62512768e7cfe21159d0530d775ae7d04c5b4eeea17c117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673944, "uuid": "c1f086b2-dab2-4362-bac1-dcf050391c74", "comment": "Malware payload (RedLineStealer)", "value": "b2c929b14cbf000473f6c74d5a02acc6fdcb2a05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673944, "uuid": "40192177-81d8-4a84-a46b-c2aa61b1b03d", "comment": "Malware payload (RedLineStealer)", "value": "d398fb1da159db9d950ce86fee0394b154f46d25c6f11764d7631d31234eacdb7950abf79ae170bd1df9524b25285b2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673944, "uuid": "b969e85f-05c4-424f-9768-2b79856c36cb", "value": "T1AA55AD132985F662D8D3A8B2452F83112F68F7B1ED5F78D5EFA83934903798D6CBA101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673944, "uuid": "808e2cce-c176-47ff-9b72-ef40cb4f1358", "value": "587a23ee0bccf95906f888e2a3c1c6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673944, "uuid": "152fc9f9-863f-44c2-aefa-c0cf4b3ef6cb", "value": "24576:9fHMY8JAeldtWShdsTp/6DlTEFK2X0bJr+YAiXbeKzKsf/a5gGiYc8KJfklT2gJJ:9fH58JJZWNSAK2kb1+YAiy8KsfUrFK6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687673944, "uuid": "772c4f11-c9e4-4c18-96ff-8ce6287141d8", "value": 1328640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687673944, "uuid": "f601f58a-0a61-4c92-aab4-19f9d506db48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673944, "uuid": "a601548a-3f30-4ed7-b9bc-f1c9af836c13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd55718-135c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687699792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699792, "uuid": "bfcf8081-b8fc-4aab-a66b-d78a4f4095f0", "comment": "Malware payload (RedLineStealer)", "value": "d2510cc092d50b71436e30770113683a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699792, "uuid": "218ec9b4-2fbe-4a8e-9cef-c08fea134865", "comment": "Malware payload (RedLineStealer)", "value": "3bd157bfa96b1fa3ec83e8235fecdc4ab70c2378ab6a0694a0bb05e068294563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699792, "uuid": "2694a85e-fa98-46cb-b8a6-b75f89af8161", "comment": "Malware payload (RedLineStealer)", "value": "ca855297b6ecf65a45797e53f21e65b88c24b6ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699792, "uuid": "e47d4cf7-b14c-4049-9c01-3659d764d7c1", "comment": "Malware payload (RedLineStealer)", "value": "3d48292da8b4c98cd0b48fd611c7bc6023092edd82e7132e29ef0b882f9219b752d470b41d027c278de5398ca7c22c98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699792, "uuid": "e7a14d99-7a88-44fa-ab2f-862755c7c196", "value": "T1E60601361E26C5B5E3CBDB36CB43C02D0D291179359FB4986BAA8CC579AB57CC1B3A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699792, "uuid": "f9a8ba87-d3d0-478f-85f2-2d16d5bd9058", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699792, "uuid": "d93a9dd2-5857-466a-80aa-1cf19ae27430", "value": "98304:WHwAbEaa006IVFPi/L/Ylw2x+nv6KaJob0z8ZVhHc4lWuoNsDNzICHjiQRV2wF73:CwUEapn/732x+nyzJoQoVG4MNsDNzICD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687699792, "uuid": "39592332-2f29-498b-a5e4-23907f82d791", "value": 3809792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687699792, "uuid": "e7dadc25-02b4-4f8a-a67d-58ae4d68c747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699792, "uuid": "83d32232-e95b-464c-aee4-c71ec2025d1a", "value": "SecuriteInfo.com.Variant.Lazy.355257.23923.29281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c793d793-136c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687706842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706842, "uuid": "278e84c7-1e5f-420e-9903-4c639e84f2cd", "comment": "Malware payload (Amadey)", "value": "4c194ceada5ec6b2ef972811c29eecb5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706842, "uuid": "277738b0-d0a5-4f24-b5f6-2cd1cea1799f", "comment": "Malware payload (Amadey)", "value": "3cb051476c66ca5f3613450a836fae02609930a43fa694a8096f54a713e4fa26", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706842, "uuid": "def62e08-5432-4449-a6ad-ee79994dd2f4", "comment": "Malware payload (Amadey)", "value": "08e7cf89985fea989a7d4a6a9e82411cd2a2222a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706842, "uuid": "f1d9c2c0-d7f2-4dd7-96dd-f04520577506", "comment": "Malware payload (Amadey)", "value": "ca5767988681ce71a8bdfdb2f443cc6c9a8968eca7a2bdec411647ea18b68073c4e566115d475829cf38667d31da95a5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706842, "uuid": "5663f7a1-9f74-42af-b98f-146e14dc22e6", "value": "T1ED1612365454E9B5E3C3CBB7D703E82C5E6914B9359F35892B964CCA2CA32BCE133819", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706842, "uuid": "c679c798-0a34-41fc-b6d1-6a20a5e92f4d", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706842, "uuid": "42846c05-fff3-48a4-ab6d-1032c69ce9d2", "value": "98304:KE+SpoQbZuTinI0tEfWxe0/hTgeb4aQApF/+MVvoM5NtSH14hV9US9XEDGaNHIi+:ySCBunI0tEfNPeb4FvM3Ng4hnx9CNHIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687706842, "uuid": "af7c91d7-9077-4f1c-9da6-5fe2e81062a1", "value": 4128768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687706842, "uuid": "c2aeed1a-db09-4a28-a954-227f9fb7f2be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706842, "uuid": "6bd53894-2a65-499c-b342-5972e5abc4be", "value": "SecuriteInfo.com.Variant.Lazy.355257.11036.6882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de9e7b8-1316-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1687669808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687669808, "uuid": "3659a407-df83-4634-bac1-22d89e1fcb4a", "comment": "Malware payload (DCRat)", "value": "feb8efa70144a1315c6e7d8b63f354f8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687669808, "uuid": "7f81c08b-7860-4ec3-aef6-63f8a2e55d73", "comment": "Malware payload (DCRat)", "value": "3cb9cb03ac9db33b88322aa7ce255410b83c4f5d4726641b1dc6b3955a7c64c9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687669808, "uuid": "31ff802f-7544-48fa-8625-a82a35a215c7", "comment": "Malware payload (DCRat)", "value": "c9a44442713da222339ccab4d057d4d85a89557b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687669808, "uuid": "a2be1894-bf67-479a-b431-e54c60176e55", "comment": "Malware payload (DCRat)", "value": "033c50535a5a17a5a616000011d1d050139f938b399dbc30f06d2d09f9b4a34e7f0d9f930a4434c45cd1e34d05160d91", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687669808, "uuid": "7eb17dd7-028c-4e4c-b898-3992b63e1d4b", "value": "T10D6549027E46DD12C02A9637C9EF946407A9BD013F66CB1F7EAF335D66923A24D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687669808, "uuid": "d045f402-4741-490b-94c5-b9a484713946", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687669808, "uuid": "f5fb6941-f292-468d-9b57-1dfa9a48653e", "value": "24576:U2G/nvxW3Ww0t8EXLg2NYc9+8OxuSXQMO+WGne9QSSefHN+F+4i:UbA30n7fyc9YQCWQSSefthR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687669808, "uuid": "0cb4fa51-8ba6-40ac-89dc-abe131ff733f", "value": 1497719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687669808, "uuid": "d7a0d735-aa6c-423b-8017-bf297ca5c5fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687669808, "uuid": "0338f7fe-5e30-4e31-8c74-dafd18017284", "value": "HEUR-Backdoor.MSIL.LightStone.gen-3cb9cb03ac9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e863fcce-1309-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687664376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687664376, "uuid": "a2f3148d-3c16-42ef-8203-8b9f8cbdbf10", "comment": "Malware payload (AgentTesla)", "value": "6b90959b8fe28679025b61b5cdae040b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687664376, "uuid": "bc3c64a5-21a8-4bff-8b07-0d3444b3ec0c", "comment": "Malware payload (AgentTesla)", "value": "3cdc44e50c69cb9e0294c17909cfe32a37cb0409afe43705094621024e8a2a76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687664376, "uuid": "02bebbf6-d67b-4344-9b10-855280cf75ab", "comment": "Malware payload (AgentTesla)", "value": "6235e5768ae2f55273836250d2acd430ac77b17e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687664376, "uuid": "67d89409-906c-4f8c-856a-8f8c413232f4", "comment": "Malware payload (AgentTesla)", "value": "f802d13c4c0f1bcc04eb61d58b1a2a1b2db7b9020f41833a56c5cd5e6a5deef679c68c478ce76a5d00e3990225a9343f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687664376, "uuid": "f0ba6be3-3aa0-4b2b-a710-ea708d3d9080", "value": "T13684222477E2D463CAA38EF216385B5A0FB8D70724759B1F976008DDBE21701E90E7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687664376, "uuid": "7e9362d1-98ca-4cf2-8f4a-665ed651a6a0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687664376, "uuid": "be89d0a2-b316-4749-b8e4-af565c98f3f9", "value": "6144:vYa6S+cs/Y5Q0gWxgRPYHdAXMuOxLLLVU5t1J2mPKkidyMhAXH1FzYoaor2iTxvO:vYEFlvRgR8fxLLL258mPKkFEcF3fr2SG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687664376, "uuid": "43b2f3ff-534a-4027-b2b0-5e916f90c153", "value": 374135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687664376, "uuid": "0869a14c-d284-4787-a731-fb0255f4633f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687664376, "uuid": "7e2346e4-854a-4f74-b3fc-498badc1a3a8", "value": "6b90959b8fe28679025b61b5cdae040b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1c5072-1328-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687677620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677620, "uuid": "db11e77d-b415-45e2-aa20-5aae416bb3d2", "comment": "Malware payload (AsyncRAT)", "value": "719778b6e31b01c276640cab10e85985", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677620, "uuid": "4f0941e6-c62b-4ed9-adc4-436dc081f427", "comment": "Malware payload (AsyncRAT)", "value": "3ebe1284c0ff1d377e185dc083722b06e7582f0fbb7520803dcd287a276eef8e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677620, "uuid": "bf0b0534-dbd9-4132-9247-1e9c6b4d212d", "comment": "Malware payload (AsyncRAT)", "value": "86e2aff1d571383365d2bf41cdfe221eadd32948", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677620, "uuid": "36deb82c-c049-4334-af80-e8fbf64d4eba", "comment": "Malware payload (AsyncRAT)", "value": "0630282a6a96fca630c0df7b84f44464a63c3964f2a020a5f2c6735e95b75c01e6f06cd5273250e65ce626be758f61f0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677620, "uuid": "3f56621b-9bcd-48b7-8330-5367255c5350", "value": "T11C04391437E81919E3FFCBB8F4B002259B72B8236913E76F28A459ED1D62345E550BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677620, "uuid": "26eef91e-8c96-456e-b2bb-dde8e70569be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677620, "uuid": "ebe2d441-5f5d-4067-ac14-8df6d2672a63", "value": "3072:G+STW8djpN6izj8mZw+GSv5hqIPu/i9bcJ2cCw41ex6+WpD:b8XN6W8mm+vvnXPSi9b4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687677620, "uuid": "fea80dbf-e8f7-4346-a503-6062a2952ba4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687677620, "uuid": "28f103ac-40de-47b4-8058-fd2a94257902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677620, "uuid": "34558861-f116-4881-bbf1-af7fb339749e", "value": "719778b6e31b01c276640cab10e85985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b332daee-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676313, "uuid": "9e932336-c8e8-4a95-bf7e-bfe41083b929", "comment": "Malware payload", "value": "c44d7cf09c1252dd6be558f5f46c491d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676313, "uuid": "1230c569-904e-481c-998d-55376e64e01f", "comment": "Malware payload", "value": "40dc477c63b034e5e3fc7b0175e3f6eaf33d0b6bdd8c185623ea8680b852e18c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676313, "uuid": "235f8bf2-9b04-4049-afd4-183f7b451965", "comment": "Malware payload", "value": "81b7c1ba2fe9b5af2fdfeccc7be83d79dd9555bd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676313, "uuid": "6ca3e88f-146b-420f-ac04-36973d27fb78", "comment": "Malware payload", "value": "098e5c809edb5d902253bd59542fc553145ac91504a7b227038cf5351bf2e5515f9337937a9797580bdc5588dfd91d60", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676313, "uuid": "2f4f1e09-9553-4b94-8168-8834f4983deb", "value": "T1C474E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676313, "uuid": "918f29ca-fe22-4432-9fff-07005cf5f2f6", "value": "6144:Nkzpkc86ueZHV56NwBAGMQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBWCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676313, "uuid": "f5d12400-6add-4b87-a90e-e27eb1f2c0c1", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676313, "uuid": "6b80dc7d-0317-42b7-bb9c-a17e84ad95f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676313, "uuid": "a05c8fae-71f7-4c21-9160-60915f42ad99", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56db7935-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687676158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676158, "uuid": "5f87bd04-f872-4d23-909e-faece804d10d", "comment": "Malware payload (SnakeKeylogger)", "value": "c5bc4cc535a232dbb2ba96dcaec502ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676158, "uuid": "d147e3cf-57e7-4a58-bd17-b7d6982d1b81", "comment": "Malware payload (SnakeKeylogger)", "value": "4290a78ffba42133cf4952389a5945a4961961056425284fe2142784bf4af9a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676158, "uuid": "3a574886-f196-40f3-9cf9-fb1cba80cad7", "comment": "Malware payload (SnakeKeylogger)", "value": "1ebb6e68ec6566bb67bfd6840e1b2b237c030dc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676158, "uuid": "2cefa19d-9165-4000-bf24-852d9f964a15", "comment": "Malware payload (SnakeKeylogger)", "value": "9c4674c1619568a1f091b6fe417048c7fc32fddaed4c63fc85074e166aa17f647d86822fc0ecd0562ebaba02ea86b12d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676158, "uuid": "a8266040-8c18-43a2-880d-471713717ae0", "value": "T10765CF136A9A954EE5A96D3ACC7F1EB48BE0AC0BD530D13138F1FDA86DF84417817E09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676158, "uuid": "822c2e83-f1c1-497e-85f0-c55295d57742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676158, "uuid": "82292526-3e60-42a3-9fc9-bffb4155ccbc", "value": "12288:ePBvQdL9pBjzyHjDkU8Bl+lz2R3sZFjmNCxCJQTFoa05mdM9/qWh:x+lz2R3sZ5mNCZ6a0ArWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676158, "uuid": "ee3ce692-f399-4d1c-afb2-819094d6bb2d", "value": 1511608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676158, "uuid": "a20152f2-36fe-4b12-a3ef-30f3b4b5d526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676158, "uuid": "f5c090bd-fa3a-4b1f-84fb-c4cbf6f8171e", "value": "c5bc4cc535a232dbb2ba96dcaec502ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e86de1-138d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Empyrean)", "timestamp": 1687720923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687720923, "uuid": "4ef75a53-03ba-4242-8824-fd5c0e248fca", "comment": "Malware payload (Empyrean)", "value": "ad02ab7ab668553908f2fa5bd6f16941", "object_relation": "md5", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687720923, "uuid": "f4938d73-94e1-45ec-bba0-11d73afe1341", "comment": "Malware payload (Empyrean)", "value": "4386a2b2a177f5c628bbc672d5efb2736d4b86ece30eee7726bdeb19c27d4faa", "object_relation": "sha256", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687720923, "uuid": "ca830343-5440-4895-bfa7-67b5c06524c7", "comment": "Malware payload (Empyrean)", "value": "f2e960609c08b43fe535534b795c3ba32ccc8abf", "object_relation": "sha1", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687720923, "uuid": "c7906659-a8a8-422b-8d05-9d7eddf5fa57", "comment": "Malware payload (Empyrean)", "value": "0dfcd9d80441bc985691bd93a3286850efb3b71e39ad2921e993d40e2bdad7d67bfd69a1b2caf0d07d34c8386e3de942", "object_relation": "sha3-384", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687720923, "uuid": "8febdfca-8044-4f82-897a-e43e4b947d78", "value": "T185E633F0629409D2DDA6A53F285E884B4175FC0623A4E98F43A5DA3D8F633256C7FF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687720923, "uuid": "8ff500bb-8e5e-4a8f-89de-8d923d99d099", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687720923, "uuid": "9dfa6f1e-4fda-4a28-a823-d6b62e8f4b40", "value": "196608:p0/lOqPnih8FXj+hYeB0sKYu/PaQgKDnO8NpHzgsAGKaRZtG7EagtglKJMEemE4i:pqPnLFCjQpDOETgsv/GIZsKZeovN5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687720923, "uuid": "1756a0c5-ccb1-43ea-9b14-a20dca61e234", "value": 14598485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687720923, "uuid": "7cd3e1d5-3d3b-445a-b98f-473e8f632b01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687720923, "uuid": "dc36d9d4-e983-4bb5-bcbb-105925f72e34", "value": "dis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f05a02-1353-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687695774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695774, "uuid": "8c1b4c4a-cfbf-4a91-a9a5-2b544420b6c2", "comment": "Malware payload (Mirai)", "value": "843e73f960f6eba1c0deca2c444793be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695774, "uuid": "32043d2a-20b9-425f-8df8-dd2f15c64635", "comment": "Malware payload (Mirai)", "value": "45231ce1145a98bf8d3f08fc8e8c18dd82cc8c127e896586ddc97791be785677", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695774, "uuid": "901c0b27-4606-4905-bb25-c2898fd4970a", "comment": "Malware payload (Mirai)", "value": "6831ad1438c16cb640f860c1ae87535a19b287f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695774, "uuid": "7f6dcc98-8fc7-4adf-a5c1-b6bd684d8a29", "comment": "Malware payload (Mirai)", "value": "e6c5f369c11a3948dd4cc4a236725bc1c621fb3f6413d99094d917fcac015111093c9d9d1c79af14054be485f9bc1634", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695774, "uuid": "ab754b53-1a12-4da7-9d63-ffc37391fbdb", "value": "T1FEC34B356E762D27C2D6A87B02F30361B1F2138935B8CA1D7EB00E4EBF59660315767A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695774, "uuid": "be4755f2-ecda-418e-a31e-22c80f445006", "value": "1536:+3gqMMrvYBqibvfrs/wBIdPIhNnhqo9dlDuQ/vZ2lk52pAtkQnVNNS1XmBF:+wq9LYBHqaNnBZ2lUqg/S9mBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687695774, "uuid": "9ef8db73-53e2-4c12-922b-ec34acfe1a89", "value": 129312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687695774, "uuid": "0bec5833-223c-4960-a731-d6819b8fa73e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695774, "uuid": "c465b64c-737d-4e4e-ada4-433120869e15", "value": "843e73f960f6eba1c0deca2c444793be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565fe1cd-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678305, "uuid": "ce0216e2-7cf8-484d-bf09-6c7254c80f0c", "comment": "Malware payload", "value": "0635a4f5344c1fdbc1fec2b6476eb77f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678305, "uuid": "d5ed3a2c-6a29-483f-89f2-4045550b308c", "comment": "Malware payload", "value": "490fe4b5856d7a44d685735f35b5a932eb496a77046776ee27bd52e155cbaa6f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678305, "uuid": "d36c6e1b-221c-4b21-8f4b-adbc87c5f822", "comment": "Malware payload", "value": "bc946611d87de52a36c15c3661fd3b10ad7a95e4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678305, "uuid": "0019b456-5b27-4007-8e8d-b7aed4c1f3ca", "comment": "Malware payload", "value": "4616c7b1e2a862d1f338e194dfb89f0cf15bf9211a4162c08de056d30d1965e03378a3e5afb561b0d2313a39bf4fa655", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678305, "uuid": "988b698d-47b2-41c7-8981-538b628eff0c", "value": "T1C6644B1EF5A7B8BCC6D3E4B4D6BE87B1B934744D05B42A336780EA701252BE45338E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678305, "uuid": "d214ebad-5c80-4ad8-bf29-b5fb99001878", "value": "233f3d50f8ad1fa8b6c33359ee5261c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678305, "uuid": "85fdc842-4ee8-4013-8216-bca1a091aad5", "value": "6144:rqYMp1whyZAJfpTGfltYyMpfmA3a8yqgf2bMUDc:rqYMp1HaJfpfJmA3rg+bHDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678305, "uuid": "2c1fcab0-b7f5-42df-ac8f-f44b8283b034", "value": 321545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678305, "uuid": "a85c06df-ce06-42ee-95f8-9e34f31a9d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678305, "uuid": "eb2ba83d-a82d-4bbf-8b8d-d497c2fadd60", "value": "0635a4f5344c1fdbc1fec2b6476eb77f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f105706a-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687717649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717649, "uuid": "f322af8f-a23b-42cb-bb91-e178327b0fc6", "comment": "Malware payload", "value": "f109a02669095b81e0af38063bf035ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717649, "uuid": "346b2c70-07fb-413f-909c-31a0e9b23b42", "comment": "Malware payload", "value": "49ebdee426ca652d26f305f75b6cb8bae62e1be4cae0945a7d6dc97629d89bdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717649, "uuid": "96dac05c-a468-4532-9b1f-b2d7110f2a77", "comment": "Malware payload", "value": "6ccf654211b2e32bf2366e6ea38204ba0c59cc10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717649, "uuid": "eeb7c16d-0e85-41ac-8e16-fabac911c59a", "comment": "Malware payload", "value": "4edd758bf9193ea01a9b576c7bb642f59e0ca886ac2ced5701c606f7c34ce075f0b3325deabfd71c3f3bbc92ceeeaa9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717649, "uuid": "12e68c65-809d-462e-b100-1efc26449fec", "value": "T1D30618B17786D8F2C81F1B3009578BCC32129DA555EA6E3BA7533DECD97A3C00C9A694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717649, "uuid": "e96b10a4-324c-44ae-a272-87ee498fbb88", "value": "12288:ZeFA4zbDWynB9VQBk7ZS0N7d6+/Sf3SzR6o:0FA4LW6VljG05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717649, "uuid": "7df71972-302e-4a6a-9276-f2b57a417839", "value": 3834368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717649, "uuid": "8a0e0479-1251-49ce-b31b-947db0e42b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717649, "uuid": "ebfc3f31-fbb8-43f4-8294-1904c9cb2f45", "value": "SecuriteInfo.com.W32.Tibs.P.gen.Eldorado.3102.8656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f975a6de-1353-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687696188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687696188, "uuid": "5c09893e-fa1e-4998-b506-e52518af28b0", "comment": "Malware payload (RedLineStealer)", "value": "bf1bce3f0d7112f8bdf352cd3b5d77e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687696188, "uuid": "ea091e29-389d-4f9e-9fa0-585928899681", "comment": "Malware payload (RedLineStealer)", "value": "4dcc15bdebbe7b5fcdfc81fdb3e09739ae6a79ac1e277631bdd807f447af8efc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687696188, "uuid": "0b839d7a-25a4-449b-98af-f0ea18a0f8e7", "comment": "Malware payload (RedLineStealer)", "value": "158f01c707e77f63192c4649c977aa531862014d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687696188, "uuid": "6d5c865c-367b-493f-b8ac-558b08aed2c1", "comment": "Malware payload (RedLineStealer)", "value": "8f042fb955c3a0f484b0fcff051f232aaa7eae1b855eb8d3842176f391fc141ffbab86daa593b66565d319bcc526f3db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687696188, "uuid": "6bd3a8e0-84be-41e9-abc9-0a78b2648cf3", "value": "T1980601361E25C575E3DBCB34CB83C42D1E29267836AFB0992B594C86396F5ACD233E05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687696188, "uuid": "3308ae41-b0cf-464e-a213-639ef4d8d037", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687696188, "uuid": "70a73ce4-1820-427d-940d-e88b5a39c360", "value": "98304:ol+4btRVJhjtCajKzy12wKgXttaQtG7Sa3Dm9SE/UGVL3AlI8oJwjAhmL2uJsFVm:ol+4rVJhj/2cBGOwmoE/RLQy1JiWu6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687696188, "uuid": "6ad31b56-0177-4814-a7b4-00a2076124a5", "value": 3795456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687696188, "uuid": "53ca7d6f-f9d0-49ab-8be1-75cf99755709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687696188, "uuid": "cb7e1a1f-dec3-4763-b834-9887b13a0d92", "value": "SecuriteInfo.com.Variant.Lazy.355257.2925.18754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14754a3-139b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687727071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727071, "uuid": "75a6eec0-0e47-4f55-a607-a65a78fdf87e", "comment": "Malware payload", "value": "0185c909c96a40ed81f64afc897a9b52", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727071, "uuid": "7f401cde-ff9c-47d7-b284-f3e04ae47718", "comment": "Malware payload", "value": "4e1e9baa83e4e1f612490a1348ba9d6aa431563ad96320705d3ea886a8ede4e9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727071, "uuid": "c70f2d6e-e951-46eb-9d1e-51d5b61f91a3", "comment": "Malware payload", "value": "41bd98fc807ec4871a47ac46012c048e630a347d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727071, "uuid": "e8da637b-bbad-4cef-bf4c-f0960d0ffd5b", "comment": "Malware payload", "value": "af0e37938e9f0b725fb02c730e804500aec3775c4780416da0bcb2db7bfd4d14fbf2c9d672b9545ce06f006f990d052d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727071, "uuid": "1163f229-325d-4eb5-a563-6f78bb9965dd", "value": "T11F65125103BC5B33E6FE1379F0A521888BE0E94B7296C7B7884936EB5913375E913293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727071, "uuid": "ed7b911d-95f0-43b8-a498-c49e9dcbbe6a", "value": "24576:mpu5keyXVkCBQqYIUfBuGarX9ykCVCuPhYqmjr51U1hyHR0vpew14zNXD:akkeiRBQCUJuGahyDVCbZx0RewaNXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687727071, "uuid": "f2abe0c9-ccd3-466c-9ff8-f7a839204987", "value": 1538560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687727071, "uuid": "9cbc4e18-59e5-4dd1-86ad-4cb40c840337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727071, "uuid": "175a0b30-8422-40ce-a7b2-47535fae22b5", "value": "0185c909c96a40ed81f64afc897a9b52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01d4c32-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676281, "uuid": "0fda3897-9c89-4634-8f3a-e4ac16e82a6b", "comment": "Malware payload", "value": "9f1cef7aef63e7265960b8682b405355", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676281, "uuid": "f7a36427-592d-4bfc-840b-8c503cac59cc", "comment": "Malware payload", "value": "4e7aeb2d1bdfedc19b7544875d27241fbb82a788c19d8c515fc66858565429ee", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676281, "uuid": "2afb433f-58ac-4313-855c-52bea10b3a25", "comment": "Malware payload", "value": "ea608ef5ef7cfdc3aa69d30d12d5ae7175a17352", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676281, "uuid": "a8cc04a7-77e4-40a2-9416-d8b0768606ab", "comment": "Malware payload", "value": "230ab5a43270f6cfe62c5685465dec6791626e71c4810c97c25b2fca38699963370802fa187225481e8843177dfc2da1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676281, "uuid": "93c9494c-7e1d-410e-9f03-91426c8b8071", "value": "T10D74E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED4C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676281, "uuid": "012150a4-2c90-43e9-bba5-5b1646752a53", "value": "6144:Nkzpkc86ueZHV56NwB6GSxuIXtCoGRmd+BUKCP5LtuEulM:686uNNwBsCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676281, "uuid": "146508f5-b0f7-41c7-a47e-d0282d5154f9", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676281, "uuid": "36f813d6-4de0-4a71-bab6-704e764ee8f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676281, "uuid": "eb160ef2-3714-4f58-9f34-3d27dd929dfd", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3eaacd-131c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687672194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672194, "uuid": "52961c37-17a4-4797-9f2c-949a6c92a315", "comment": "Malware payload (Fabookie)", "value": "902fac8e9d0924c952ba3705cd257043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672194, "uuid": "3ae24a4d-c7b0-4586-8704-46b9166cc15c", "comment": "Malware payload (Fabookie)", "value": "4f2f8e8f530beb89c23e7a43a6a82498bd44739688e273f3ea4e4dde4aea38ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672194, "uuid": "9f7e5d89-06e8-48c2-bfc2-962afc7bb7ef", "comment": "Malware payload (Fabookie)", "value": "25ff68caf7840bfcd0a1b8ffb627625462c2b498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672194, "uuid": "1c6b322a-07f9-4b37-8297-f5e8b42462fb", "comment": "Malware payload (Fabookie)", "value": "38858f10926ea485914923a28ffb2d82d938e17cde7fd6a1d0018ae909951b0bc82f7216bc64865c9b938e3bca7f31db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672194, "uuid": "4d34ad63-41ad-43fe-ad52-acda0d09dd79", "value": "T19B644C156FB81CB6D017B43F0C6E84524B337827166783F7A496DEAC0EF76E8D466822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672194, "uuid": "a67f35ba-295e-42bc-991b-75122256154e", "value": "a7a19cad0c2c193feb43fc00c1b6b502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672194, "uuid": "7cf12085-11e6-4adb-b248-5c223db61fcf", "value": "3072:P8k/T2YQ0qrN6NtVcOXoK5UW2MUPj09vJqxEm4x1ESuQG+3SeyRS6CSfKVu1xgC8:52At3oPWCPj2voxEvTEPp/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687672194, "uuid": "db5a1a10-8ff2-40cd-98b2-6a19820a7bad", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687672194, "uuid": "7c53fc7f-aa61-40a1-ae3e-4945c2cb648e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672194, "uuid": "7351a1d4-ee91-4a18-8275-584261560331", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1802c981-1397-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687725015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687725015, "uuid": "052b7665-07ce-4d6e-b0b6-7f44d2ae0d70", "comment": "Malware payload (AveMariaRAT)", "value": "4a04139d91df7de08a286bfe99cb4303", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687725015, "uuid": "c44e32cc-ce17-4633-846f-932cf995c28f", "comment": "Malware payload (AveMariaRAT)", "value": "565dab2ca2cccf49101da65093fb864c4857590db13be7d2fb943cfa2abad13e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687725015, "uuid": "44625366-cdbd-4f03-91e3-a6ac7beff6b8", "comment": "Malware payload (AveMariaRAT)", "value": "c202d4be537e855adbf519fe5643c303d53d1796", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687725015, "uuid": "c4713d57-1935-402d-9d23-b5733ac26339", "comment": "Malware payload (AveMariaRAT)", "value": "cf7c9e383520f782ce600c9d1f59c19ff94147e928d41e7898660bd08c7fefa95e1552a2d8822658166cf030df574a77", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687725015, "uuid": "f3517f3c-4e39-4dc9-b266-f942b8709233", "value": "T18FE37D227BE54039F7B705701AF93E25D7ACBE310E31CA4B5BD4488B58B1589E9363A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687725015, "uuid": "4ba0898e-b2dc-49f0-812c-d93fa23f8f40", "value": "0145d2c473bdbcd7b46a054bd6893ec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687725015, "uuid": "cf658884-f66b-4977-a732-dfe00be395de", "value": "3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687725015, "uuid": "650bb8ec-f1f4-46f0-b905-5deb23417819", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687725015, "uuid": "88070ee7-8dd8-4621-b2db-a30fb5f86e37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687725015, "uuid": "72f7dbbf-b72e-49b5-9397-0371927641f2", "value": "4a04139d91df7de08a286bfe99cb4303.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143f10c2-136b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687706111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706111, "uuid": "7a414245-e6ea-48d4-8f89-fcac64c26b02", "comment": "Malware payload (njrat)", "value": "2fd723bb641a1fad6c953c08d1453aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706111, "uuid": "f49bc68c-919e-40fa-911f-c95729477258", "comment": "Malware payload (njrat)", "value": "5a27e92932c24efee1731d2561f947da87ecf258910647e0963b2c0927a70606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706111, "uuid": "f9530e51-8cdb-447b-bf2d-a305d89ace6d", "comment": "Malware payload (njrat)", "value": "bc0ed86341935b7164963bf1ada6f486b216e68c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706111, "uuid": "c6706616-0a29-4cc2-a224-8e0e3c5646a4", "comment": "Malware payload (njrat)", "value": "69144e116ad569857e6957fb84258f825b4468c164c7c2c120c84d74cb9f44b632c68dd508dbb94ec65312d397b3c9e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706111, "uuid": "ef5346f4-df7f-4ea8-af59-82fb69797232", "value": "T11093AB2124FF516DF3A79BF25FC8F4BE896AE237250AB1BA219103478721E40CD52776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706111, "uuid": "64d57429-8ebd-453b-b16f-e3b3737c7e8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706111, "uuid": "c91b8ec5-4f64-4720-81bf-2a70bb03173b", "value": "1536:DW8keawDDcQuPEK1EZiQlfzfvaCzh8SFh8/offx:DW8keafEK1WSYjr8qJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687706111, "uuid": "7d6d0954-dc42-4c11-9642-d6d2fd3c4183", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687706111, "uuid": "a7fcab29-2cce-4a34-b197-664238c9e9e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706111, "uuid": "f48bef69-b943-4945-9591-904dda8ce3d5", "value": "HEUR-Trojan.MSIL.Generic-5a27e92932c24efee173.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fd2529-12ff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687660042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660042, "uuid": "8e00e9d1-a919-4197-b365-ff62fdd86cfc", "comment": "Malware payload (Amadey)", "value": "75736d164f6f4ae0bb6f856d8dc01db4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660042, "uuid": "679470e5-1973-4900-a091-997b080569e3", "comment": "Malware payload (Amadey)", "value": "5aad31095b0b9a429fed8773a233eb872868467d33f52b9d6f6e7fa078092011", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660042, "uuid": "a6deb5a6-af2f-47a4-9984-e67c46710d60", "comment": "Malware payload (Amadey)", "value": "a280cc0281045dca631a09978a9132ba9d58a2a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660042, "uuid": "0bebecd2-cc52-494d-8139-605b0f130645", "comment": "Malware payload (Amadey)", "value": "c2e94367a345cf1f4b7ec6aa7c4cf1632060e4b4f9a89ade1aa5ebad29af060845a99ecf1d5e09eaf47a0fff22210435", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660042, "uuid": "613ed3b7-5a23-4de9-9fa4-fe393150ab2c", "value": "T1A026BD14DDBBA0879546D12B6334FA69C674320B3658DDDE09590ACE280F2C94F92FEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660042, "uuid": "ddd48f94-873f-49c4-9558-94b187b1c94b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660042, "uuid": "c15f9c0b-8ca4-4e83-9b7e-385612c744db", "value": "98304:0Wo3BduYaE+I9noizGfIYVcfa9n06bTpHWOTez/M6bsUn5v:0X3BgHETKHqa9nhpxezhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687660042, "uuid": "ed71b833-13e7-47a3-8f12-819d40100185", "value": 4534784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687660042, "uuid": "6f2cc93e-eb9c-415a-99c9-8ea18a9d9b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660042, "uuid": "acd2d1cd-df97-4678-8a79-e5d9fd4fd054", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83a9788-1375-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687710654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687710654, "uuid": "50be9a2e-1124-40c5-8f13-68767a6d066b", "comment": "Malware payload (Amadey)", "value": "b1015b8711b2e3c3e6c0b290d2db49d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687710654, "uuid": "2df0fb9b-d8b5-406a-807b-163c39e12e46", "comment": "Malware payload (Amadey)", "value": "5b84bbeb5f4470d18c8c99a06ca654922413a224332cd92defef825e879f334e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687710654, "uuid": "a72f3616-739f-47f8-9326-d7d30e862d49", "comment": "Malware payload (Amadey)", "value": "91d741df29582ad1731a06f459eee8fa6630b053", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687710654, "uuid": "302cc3de-62b3-433d-8f76-9f03ad6be0f5", "comment": "Malware payload (Amadey)", "value": "a9c8a3342d7e1e7361331b7b837dc1e591b2e794ab1b1fcc53770aad5d6bcf8aac863f1befa1fae79e768d1115226858", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687710654, "uuid": "277fc0d2-1f7d-458d-8aa5-91c4c796c6ea", "value": "T18A0601361E26C5B5E3D7DB36C783C06D0E282178369FB0986BA64CC539AB57DC1B3A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687710654, "uuid": "05f3f3c0-c623-4b67-85e9-d2384431642f", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687710654, "uuid": "1a1dcdc2-8f32-42f0-99b8-3db2e9c74f6f", "value": "98304:iHwAhEaa006IVFPkolk9oliqLUHpQiF5l66FHgiW2TIOB9udksMHQrIFVyGVs3Gl:mwiEapL09LQ5l6mc09udhCQOVTVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687710654, "uuid": "b0ab55e3-a09d-4a48-bb44-c02c1d8a37ac", "value": 3809792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687710654, "uuid": "d21795c3-61cc-414c-9d45-efe1fa36754f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687710654, "uuid": "03e49c41-1d31-4db6-ac9c-ac256445a05c", "value": "SecuriteInfo.com.Variant.Lazy.355257.7494.30182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7a84f3-134c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687692921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692921, "uuid": "3a5ffad7-a77b-4bae-bd44-3b67c5d36981", "comment": "Malware payload (RedLineStealer)", "value": "d2db1075fea9ef50bc28b740d2ef564a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692921, "uuid": "6dacd80b-6567-41bf-8d7b-aa027e84e3da", "comment": "Malware payload (RedLineStealer)", "value": "5b850a5738478d8973e71f4ff93f40668ce24ebb8b83277f4df93adcabd8181b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692921, "uuid": "ffcc68b4-299b-4e6b-9f01-7aa7c380202c", "comment": "Malware payload (RedLineStealer)", "value": "28c55ff2bae7147af41d8764aa7876457e26ac12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692921, "uuid": "6d8b8e4a-e7bd-47ce-8282-ec446fedfca9", "comment": "Malware payload (RedLineStealer)", "value": "75eede65be9f5de50266ed0e08785811c43c4613df7b2c301d5c7f88987a00aa26a6a033638e76d8f0637bc7ea9f9599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692921, "uuid": "042e81ca-045e-4445-952d-8e4b49e4d01a", "value": "T1141612322A60D5B1E3D3CB7BD703E42C1EA820B935AF78556B548CD62C972BCE573819", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692921, "uuid": "06a3529b-c5a1-4077-a1e7-6916f1cadbc7", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692921, "uuid": "177b5575-9d90-4cc8-976e-d520a48006de", "value": "98304:hLqvY3ZBtshIHeCCNrR96XNGDEv2gKb4EEB0IxYaA6fY5+w47XEnWHGBK+VNFfij:hLT+u3ER96XNGFgU4EEBvx3wAwSXEnWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687692921, "uuid": "4fbce056-dfc3-4902-b535-9901344d687b", "value": 4110848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687692921, "uuid": "21f07aec-72de-44ae-874c-e0223dd8b006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692921, "uuid": "bd92a076-dd3d-4f4d-a987-bf14cd2b5e9a", "value": "SecuriteInfo.com.Variant.Lazy.355257.2581.1331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24575a5-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687717651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717651, "uuid": "32ca53ff-76fc-4667-a108-01996c6f3abb", "comment": "Malware payload", "value": "33036152f573ccc6201beeb228679ed5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717651, "uuid": "0cfbc732-c9e7-4810-8db3-d3a82c4baa3e", "comment": "Malware payload", "value": "5bd9e95893ac207871c86674d6569296fd11d00f74473fb402afcf211b05cdd7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717651, "uuid": "7abe7dd0-0d99-45f4-b05c-d57eb7a9ffa6", "comment": "Malware payload", "value": "f8ef190a9a8731b2c10704a5ff82651b956cdf75", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717651, "uuid": "5e28d8d6-d63d-4804-810f-b7cdd8562580", "comment": "Malware payload", "value": "b738fcb12820905be260300f147902df029728e3f09871fc0d72af58991be09fda8bd42bec583d660f0c27eb87fffb4e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717651, "uuid": "87cc6bfe-f5f2-4ccd-9000-65fcb03b1e4b", "value": "T196E39ED333C4CD66D23B16BA2C67C66692317D9AA5B2871B7BC0B70F4D32B844D216C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717651, "uuid": "07c9633f-d3ba-4e51-a4fe-f5df73562cea", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717651, "uuid": "33727f8d-5f0f-4e22-8867-bc116ad7ef2a", "value": "3072:DlGajUsmdaicl+5gX53r3p2F/TXIm2CMqUTxur/f619l:3jUJx5m3r5WUqUTxum19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717651, "uuid": "80aa067f-04d7-43d1-b936-f99947c8dcf8", "value": 148111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717651, "uuid": "bde558cf-214b-49c1-a223-3c9778566763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717651, "uuid": "facda2d0-f962-4f74-9e89-82c70489900f", "value": "SecuriteInfo.com.Trojan.MSIL.MPRESS.456.3813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50497b58-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687676147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676147, "uuid": "2676e9f8-487e-4685-bbfa-5b379175c8cc", "comment": "Malware payload (SnakeKeylogger)", "value": "f188cd4bd817a4ccb603b89bda726505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676147, "uuid": "7bed5d95-5776-4bf9-80b1-dc22d72a383b", "comment": "Malware payload (SnakeKeylogger)", "value": "5d6b1261e0b386aa76ee1d920a2b37962e62257242d8dbc9732c23e29342aa47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676147, "uuid": "2e4c9788-3930-4c41-ba6a-89eb56925098", "comment": "Malware payload (SnakeKeylogger)", "value": "eb3443533599cec377693cf14325cc014852cab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676147, "uuid": "9615d665-9fb3-4ef2-aaf5-2a4ec06a32fc", "comment": "Malware payload (SnakeKeylogger)", "value": "8e7030ed8e017e4eda810cab9e633e9006dd1b59e79c73bb79cc2091b13bb2cfa44f3a568fc8a8f1c6f352930036a4d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676147, "uuid": "9de8a49c-342b-47c4-9a8c-4ba3c9e90dd7", "value": "T106C3F61D7BF88900E5FF8A7315B25211CBB5B8611A5ACD1D1AC2F8592A7C780CE1BF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676147, "uuid": "4c04565d-9dcd-409b-a4d8-d512f798cefe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676147, "uuid": "ba00e2b1-1b37-42a1-8991-9896756dbe23", "value": "1536:0mtcOks6s+sSyJrDKfTvXCg59SqX7b/U2GXO/piOWBPhF0Kcl:0mtcXls3dJrDKfTfdOE7b8+wBPhFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676147, "uuid": "7c6e66be-c3bf-423d-9f9a-5fa4cee2f3a5", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676147, "uuid": "653a3f29-c7dd-46b6-9016-b9103fb2f4be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676147, "uuid": "321232cd-6bd4-45ad-8a37-4346faeb0002", "value": "f188cd4bd817a4ccb603b89bda726505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b4ac61-1396-11ee-b3cf-42010a9c0076", "comment": "Malware payload (N-W0rm)", "timestamp": 1687724711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687724711, "uuid": "c20eb2a0-225e-453f-a446-914363bf6296", "comment": "Malware payload (N-W0rm)", "value": "be2ef16c72f19b8af1de903ca869d47c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687724711, "uuid": "f0ce41e4-3d5e-4ed0-b4db-9e86f670a3ad", "comment": "Malware payload (N-W0rm)", "value": "5e80077607f2345cc1c874a9e49b54bf923bb2d52a58bcf7ac3ca22fc8539f4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687724711, "uuid": "0d05297b-5be4-4842-b486-d383a34e11ba", "comment": "Malware payload (N-W0rm)", "value": "88b781469d33e4f4af8d482c97f83e3e115d0d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687724711, "uuid": "4491ef1e-7c2c-4bc7-a321-84a5c8067ad4", "comment": "Malware payload (N-W0rm)", "value": "36b5a090fcfc57d59d6e77aff823ea83b8711a1cb9be57ea21a5799c46de2c731e05c57b232a33aaa88526bd10abc6de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687724711, "uuid": "afae03c2-994f-42c0-bcd6-49250be16a22", "value": "T197D433C94F7CF649E5815AF0BE9CB34B0D3D04696C22166366AB43ABD00B4970DEAFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687724711, "uuid": "991d0509-f917-46fb-8252-6f23d56f33c7", "value": "12288:Wr6sEb6XArB5MINU9T1K2YXj5Xfg1iWv6G8D7sIVEt80v9iYkqBT:Wr6sEbgGBFNUZOFfHXlVA80v9yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687724711, "uuid": "11f4fc1e-fe35-4542-9a13-d09b815ba837", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687724711, "uuid": "0cf549b4-0588-4d2d-9bd1-4dcc95c038db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687724711, "uuid": "9b37baae-99be-4a48-b795-9f428e9b69ed", "value": "be2ef16c72f19b8af1de903ca869d47c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18269c3c-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678630, "uuid": "0b0b2f1b-579d-4782-bfbc-8219b2e6f396", "comment": "Malware payload", "value": "0dcaa8ffea552ef8a4e5bcc1e071af49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678630, "uuid": "634fefce-23ac-433c-b2a4-b5f7cf69d8b0", "comment": "Malware payload", "value": "603064a2e40abb2fc9a8885d966d7407c2dbcbe0b96cd8f4ebaa3b483050d892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678630, "uuid": "d10abfae-5b16-4389-bcc8-1a214effe2d9", "comment": "Malware payload", "value": "449e1942fc59bde95e84a560b10c3e8c1f735aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678630, "uuid": "c5275a0c-1b2e-4a1f-8d98-50368f96ded4", "comment": "Malware payload", "value": "cf689c589824da4b7f94ccc49290feecd5b062a79c623ea8bf78c44a3ae2119f3428211075ee503ca0c7e0a7d67a6438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678630, "uuid": "1bb43a10-9bf5-41df-98f7-1b2ee251a078", "value": "T16916D600D601561ADDBB24F54AAD313EB14CDFA0131864D782C86AFEDBBA6F13E3519B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678630, "uuid": "f3dcefed-0e38-47eb-a934-dcb149ce9d4a", "value": "49152:HLz6va++B6xN2+V+tfG2VcruFG2KALO9D3pMDuDhEDL4xqU9uBB7fQbAP:rzC+CqfG2VcruFG2KAyVEDLvTQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678630, "uuid": "a8aab09d-5e5e-46bd-9a7d-1f74e65473dc", "value": 4244185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678630, "uuid": "ae0a35a3-aea4-4d08-a1c6-eefe79488deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678630, "uuid": "ba280855-cb9f-4ae2-b09b-2e31fa99b720", "value": "0dcaa8ffea552ef8a4e5bcc1e071af49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd18abd9-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678934, "uuid": "6f34b560-c37f-4db5-8c89-1040b544933d", "comment": "Malware payload", "value": "8de7b0b54041c85d89575072dd926f09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678934, "uuid": "6d03a34b-385f-42ee-9562-4fca3aff57f4", "comment": "Malware payload", "value": "6241dc2ac2d2b14d6c220040b7e39755bc2e4034e70cbffd21cb8fcc44c151cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678934, "uuid": "db0be86a-ba3c-4266-abab-d7e7007195aa", "comment": "Malware payload", "value": "6a11997ef7ecec924094be03c9458e804dc67e9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678934, "uuid": "06f6cbc8-6c8d-4323-bb8c-47a9fc40e134", "comment": "Malware payload", "value": "3caeac506730b47304c80da28385089aa4325fdb50f85effe78e3a66f45dbeeae16bfdb5bb63f25459f91dd3461f45c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678934, "uuid": "b41e3400-51a2-4551-b448-0c4583d5ee00", "value": "T1181612396640D57BD3C32530E953811F0C1A68B1AACFB999738BDDEA09A36BCC575BC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678934, "uuid": "abe7254a-54f7-438e-88b5-113cfe231434", "value": "b75a410f32d1182cc8c70c950c27136f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678934, "uuid": "4d272f45-e2d9-4718-9a8b-8fbc1778dce2", "value": "98304:IM3IoolykWaQWk/hgnr4BkDAz8SjW/DEXM95grZJyLFXCBuHISh2SMJBAgcV4ZPS:8oolykoWk/hgQd8IW/DreaCBuoG2SMJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678934, "uuid": "aaf63569-a7e2-49e5-9959-bde44439738f", "value": 4125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678934, "uuid": "86a5e038-ece9-4b7f-8cd1-7922188d4adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678934, "uuid": "5fb6bbf2-8ff6-4d09-aba9-030dbd2d5639", "value": "8de7b0b54041c85d89575072dd926f09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4ae795-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687679016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687679016, "uuid": "ed99eb96-3b0a-40f6-88fe-945069b2b914", "comment": "Malware payload", "value": "d3adfcba2456a4c47e6c2630345d9790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687679016, "uuid": "a98fbd1a-594a-42ec-9f1d-e506fc45dff8", "comment": "Malware payload", "value": "69c569b4ff297f636b50e6b17e1a02cacc24a75dc2a0b73d3fffa271d90c679c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687679016, "uuid": "aa1384eb-b4e8-496a-8a76-1dd2f5fbad42", "comment": "Malware payload", "value": "7dcc98e4b24b0592ccb2e00dff95e66d1496aa25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687679016, "uuid": "f176d892-08ac-483a-ab13-c26d141b890d", "comment": "Malware payload", "value": "97bf237532390ea344fe26288defc28e87836c934c8397e7438bb91a63088849763293e7d0ec029cacda827b07487a59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687679016, "uuid": "eb9814b3-d189-4619-b33e-6648cb100e65", "value": "T167E4F797A89540F8C1FED174C626A217B9713099073437E77BA146F10B66FF8AA7C328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687679016, "uuid": "267f9aea-c899-486e-a7a7-3eeaf3e61f7e", "value": "6144:myukfSgiGICT5CE0yB/rjFbQFh0XKqJmuslWL/W3/GKHZlpHEsGYvYvXHiQjE37w:n6giGIKfZFO0aq7skL+H5nHQYvQYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687679016, "uuid": "52ea206d-3ec7-4ba9-8dc0-4d741394bcdd", "value": 681355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687679016, "uuid": "4bc5c696-d103-4e79-a1eb-b9b0aa5fb9d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687679016, "uuid": "43046e7c-95c8-4ed1-af5b-f6765ea73be6", "value": "d3adfcba2456a4c47e6c2630345d9790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb83618-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PurpleFox)", "timestamp": 1687678508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678508, "uuid": "98e59b65-dead-485f-915f-8a480cff0a65", "comment": "Malware payload (PurpleFox)", "value": "1ba4c0146eda0f204a892338e8283521", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678508, "uuid": "4b0e4faf-6500-4f05-9231-031ccfa7043b", "comment": "Malware payload (PurpleFox)", "value": "6bf1f5cd684bad9dd43b022e2789e388a36c72d5a87965c644cab01a51249e1e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678508, "uuid": "0ac64f6b-7578-4d33-a4f7-88e10d84cc5b", "comment": "Malware payload (PurpleFox)", "value": "179c033972853250cbf6eedb7b51dadb75936fcb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678508, "uuid": "90fb5e02-d591-4ab5-b089-901ed962a3d6", "comment": "Malware payload (PurpleFox)", "value": "5ea244399e3ed9433b9c6ce8806d1b0923d7df79e0bf5bcc5d4501f8f34f5c3875088cbf86c1825a70acd2b0c2e0119d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678508, "uuid": "68027494-c6c5-4796-a9c1-f1af25df8baf", "value": "T1B7D5F12076D6C936E57E05B0656CDB9E40297EB00BB9A8DB63D81F7F09F09C20671E27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678508, "uuid": "501811ae-42ef-416b-bafb-616fb28c9fbd", "value": "49152:bBvlrXVVdWX59GUrSLzeaVtFUkQfqZ2jQbfcOQHeCG02NAUt6v6xXdKFV0hpRoGj:JlQFrEaY7cGd/y6/bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678508, "uuid": "3d52e8da-9619-4784-9e26-d3577597ed46", "value": 2983936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678508, "uuid": "dccbda4f-8094-4392-8312-a27f0d2c4f4d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678508, "uuid": "213b721d-216c-4ac4-941a-1127c7944310", "value": "1ba4c0146eda0f204a892338e8283521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef851af5-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687717646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717646, "uuid": "17e8ee97-65f4-401e-b8e1-4c128725f8ee", "comment": "Malware payload", "value": "03f336e62909cebddc6a5ab34ab279b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717646, "uuid": "8e5cbf1b-daf9-4bae-a825-58477f5cadee", "comment": "Malware payload", "value": "6d23359c00ea8ea4443ae21facce2de6dd4402cf581310223778a7d937b41f5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717646, "uuid": "e9781d25-689f-4df9-992c-455ec958a97d", "comment": "Malware payload", "value": "e89b8836dd90066908b070d326218668083c136c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717646, "uuid": "70df8f17-a6d5-497c-bbc2-3a363aef6708", "comment": "Malware payload", "value": "f694d049adbb05189bb15f41eefbb3e55da071d3ee3d99684011ba858c5f46f2bf948fe1cdd0c85eb640e754a31f3036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717646, "uuid": "9556c8c4-900d-4819-9899-402e57e81e60", "value": "T15475F185F984123BE45167707B3B60BDFE9F9BE0353EE0340392970E63241BAA57B45A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717646, "uuid": "b73af254-832a-4971-a458-e307e647b14b", "value": "aa3d745697d69b3440b3bb580badbd95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717646, "uuid": "f7820758-75c9-427a-9195-9bc7c43953c9", "value": "49152:cPSsfiDjFZeBdwEYYE4WQEJqmsEs2SDEW:cPSsvdrm4WQEJqm/sjDEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717646, "uuid": "f4e51433-d1be-4b0b-bce2-69d6a2acc9c9", "value": 1596416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717646, "uuid": "fa770952-88d4-4b2e-a3c6-958f0e1585de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717646, "uuid": "d20e1c4c-3715-408e-9e41-226c9e73d24a", "value": "SecuriteInfo.com.FileRepMalware.28280.24277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0698aaeb-1353-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687695780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695780, "uuid": "0b9d0786-bb96-4d20-8761-659cb7a7e2fd", "comment": "Malware payload (Mirai)", "value": "a455fcf6baa8c186dbf38031e624c530", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695780, "uuid": "ca5afd9a-2cd3-44ea-9697-6b59d022c7fc", "comment": "Malware payload (Mirai)", "value": "6dedcea7f66e983e3822b4965b10947cdacee716fb516f821ac93da311603dfe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695780, "uuid": "934a004a-3210-47b4-a26a-48441c83d6c3", "comment": "Malware payload (Mirai)", "value": "65d35b8bd7e217819bb7141f110f9a81cfafbf62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695780, "uuid": "0e2c96b2-9290-4a68-8211-b34b5330c933", "comment": "Malware payload (Mirai)", "value": "baf709a154be3bb922dba0bafabdf748f24bb44d9e45de9b2c1b41b1cc3a5468fadff97294be8f360f5d0bfbdffdc84e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695780, "uuid": "aba8a019-f39b-45c5-9152-c15f9649718b", "value": "T13FB3BE66D4A1ADE0C151477070F2AE3D0763B81956072FB76488C7AE504BDECB29F3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695780, "uuid": "49ae1a04-09b1-4cb0-8df5-e64209e9f3ad", "value": "3072:7HmqMnPdlGjtk5am57ljwCHe+HVM1GV5ZPmCjqOG:7Gq6jT8yuCHmI5miqOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687695780, "uuid": "23f745ca-9e4f-4795-a9b9-3958c0da2314", "value": 116308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687695780, "uuid": "eff03e21-0e0c-4632-bfe1-9c46e5ae6de8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695780, "uuid": "2583a4e0-3ff7-4241-b1d1-f672a30f4d84", "value": "a455fcf6baa8c186dbf38031e624c530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff779688-1324-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687676012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676012, "uuid": "7714c918-a196-474b-8315-4f93b7269c86", "comment": "Malware payload (ArkeiStealer)", "value": "2f9a480c0bebe20b22a523fc0dc589e2", "object_relation": "md5", "Tag": [ { "name": "2f9a480c0bebe20b22a523fc0dc589e2", "colour": "#7AF525", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676012, "uuid": "49d8bfe4-e39f-43c5-b282-4c8b2c06a58a", "comment": "Malware payload (ArkeiStealer)", "value": "6e54ed1a2e63174a158e2fc6141ae0abfbba6463489b86b4d3c7c44fa1f80c84", "object_relation": "sha256", "Tag": [ { "name": "2f9a480c0bebe20b22a523fc0dc589e2", "colour": "#7AF525", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676012, "uuid": "c2a48874-037d-442f-a1c7-b45ab54edf6b", "comment": "Malware payload (ArkeiStealer)", "value": "43b3c13ec03067d72c7bde9430024cfd342a8b33", "object_relation": "sha1", "Tag": [ { "name": "2f9a480c0bebe20b22a523fc0dc589e2", "colour": "#7AF525", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676012, "uuid": "69f9b098-c4be-45ba-bdb1-0b62f5d0a02d", "comment": "Malware payload (ArkeiStealer)", "value": "f0302c04fcdc05c099195dc9694c6c90d0a455b680c009449c803a0a0b2a8ee8182b42cc4728001619891143363084bf", "object_relation": "sha3-384", "Tag": [ { "name": "2f9a480c0bebe20b22a523fc0dc589e2", "colour": "#7AF525", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676012, "uuid": "c621d625-c4bb-4516-a74e-6a7e9fec2b0b", "value": "T17A74CF027293B831DD255A338D6DC6ECAA1EFE514F18669623187E6F1DB13E1C67230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676012, "uuid": "b6eb8a2b-8d29-4183-b733-c23d43fa3f6f", "value": "8577a8bca69eb3cc886ffba8fc991a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676012, "uuid": "adf757ce-b506-48c2-ba12-a161c9a7303d", "value": "6144:bEjYsCeh+7GL6XOYqPehMIgOl4suEMIaUuYUS94KbzHQ:bhReh+7s+S+dSsuaQC4Kbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676012, "uuid": "a79b2d1d-b1f0-489d-bfc3-d2193dc944c8", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676012, "uuid": "36171957-d3d5-4c0a-9fe7-1f9562e47164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676012, "uuid": "2cd855f2-51eb-46d6-b46b-04b37c0f1189", "value": "2f9a480c0bebe20b22a523fc0dc589e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39c0d12-138d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687720955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687720955, "uuid": "344f71c7-b233-4dc7-a48b-860d8a158d87", "comment": "Malware payload (CoinMiner)", "value": "22ff1473db378dc84b7994db3d6dc778", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687720955, "uuid": "37770568-9f69-4b25-93ee-ceff2ff0237d", "comment": "Malware payload (CoinMiner)", "value": "6fdca0731e0caed266b154e06c49a2abc7224fd273a47c8d6529f86310afdefb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687720955, "uuid": "833a071d-e054-4e20-93ba-1f0216d6e01e", "comment": "Malware payload (CoinMiner)", "value": "9eba992bd708cc2758795bc6c32ca53aed77e4a1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687720955, "uuid": "7e8e0970-691f-44b2-8d34-1e4b0b4766de", "comment": "Malware payload (CoinMiner)", "value": "a62488a6d916c8c67f5f0ea33928409575dc59b9c11e0467762346d31217a4ba98e7449fa308f0583cce5cae5b7113af", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687720955, "uuid": "07e113a8-cb79-4784-b7bf-4f22e96e289b", "value": "T1DA46D0CDD57CFFAAD53C617F9CB2041118D43628737019C2B8239D1D6A86E4CAABB279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687720955, "uuid": "bee2718d-43fa-4f44-b1d2-13a184cbce43", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687720955, "uuid": "06e6f06f-e59a-416f-ab89-e489acb8ad51", "value": "98304:Hnp/fY03y3uHn43zh1u5C7p4vE/I9XecrPqm31+J:HBfbC3oupSpX7r9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687720955, "uuid": "f02584bd-81cb-49a2-8009-616deee46df0", "value": 5827072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687720955, "uuid": "a84c569a-4c87-4994-a53f-f7132f23a537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687720955, "uuid": "2e229ce0-d1c5-41a1-938f-b3ae5b577ca1", "value": "mine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b74d7f-136c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687706840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706840, "uuid": "115892a7-cdd4-48d6-8c27-1b2e0323fd8c", "comment": "Malware payload (RedLineStealer)", "value": "037738aaa13ccb34248b8263931193a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706840, "uuid": "79ffa0dc-e68d-4b06-ba50-b6fe2a1cdb3c", "comment": "Malware payload (RedLineStealer)", "value": "721686ac207b2bd85f425e2294585b9273a557b505474ff9bc7c567dfdc2453f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706840, "uuid": "3f4ff1b0-ebff-4b3f-848f-2f98b0440d5a", "comment": "Malware payload (RedLineStealer)", "value": "bc0767817d4b2d2d265f400da0e75edfbaf439fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687706840, "uuid": "2b32286b-b3fa-4efa-bd97-c116266247a3", "comment": "Malware payload (RedLineStealer)", "value": "53d18569e5bf47a133ad88c21e86f7cd3bef4123ac9d82b2f75eb505c4795ee1fc0b2eb8f25e447d4c6d0e5050b5f752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706840, "uuid": "1be05f58-dd95-4561-99d8-f864ce2453d3", "value": "T1BD06013A5A25C072E3D7DB32C743C42D5D2865B832AF754A2B954CCAB96F9BCD133A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706840, "uuid": "f6967bed-e89a-452e-a57c-6500885bc84c", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706840, "uuid": "2fa1f664-7e79-4c27-9856-723441c47885", "value": "98304:/jeu1D3IG56IjgmMmNM3Fb6iQVRRGZMKDSk+nUQvlsqVRIV6XWELaejT+/566Tev:iu1D3a6EIRGZXDLhYsqVRIV6XWAjS56p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687706840, "uuid": "cf158ef0-3503-4507-8b57-c16d85683f4c", "value": 3845120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687706840, "uuid": "99e004c7-d4da-4b43-99bf-30c9acd3643d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687706840, "uuid": "ce695246-74eb-43f3-abfe-de07f7886038", "value": "SecuriteInfo.com.Variant.Lazy.355257.8258.16145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3ab78a-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1687676333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676333, "uuid": "86d3c7c2-f0f8-43c2-984c-affcf38e42fe", "comment": "Malware payload (DCRat)", "value": "c5614fbc4bd9b74c39f22f502c237db7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676333, "uuid": "e4046a8a-2d4c-49e3-be18-7dcef8e1da3a", "comment": "Malware payload (DCRat)", "value": "721ee1e1ea86b6474a493499b07bc96fa889b45d333b8ec072d190a3e88bd6cf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676333, "uuid": "5753530d-6724-4c28-b220-8d6877feeef9", "comment": "Malware payload (DCRat)", "value": "58ae4eda670e3aafd965e8ec3ff23558004355f2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676333, "uuid": "e238d966-6fd9-46da-ba2a-8a0bdde7632b", "comment": "Malware payload (DCRat)", "value": "98c9a0ed06b7d5ef93f7c29e892beae16adccf907256aee87770a877372c06d96b1c8b9a1f4dd1538a32b94044d5a1de", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676333, "uuid": "5578e10d-f42c-40a7-befb-dcd1d38c1844", "value": "T199235C4037988136F6BD4BB4ADF2A2418779D2676903CA5D6CC814EA2F13FC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676333, "uuid": "cb02589f-5990-4559-ab64-93d9407bbe09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676333, "uuid": "1673b3b1-6d80-4c9b-8edd-a0ec59b4c864", "value": "768:d6T3ILNCKi+DiBtelDSN+iV08YbygedYVFsQ4vEgK/J9lZVc6KN:d6YmBtKDs4zb1IYMQ4nkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676333, "uuid": "b0a24f3f-0795-4344-8ef7-97ce73bd9838", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676333, "uuid": "22662179-5505-40f2-96db-869124e071d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676333, "uuid": "a9e7b7ab-6c17-443c-8b75-27a1a8e155b1", "value": "c5614fbc4bd9b74c39f22f502c237db7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12be0a6-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676337, "uuid": "063c7b61-9870-4b37-b334-70fb03abbead", "comment": "Malware payload", "value": "b35816bf48e2a64e6c932927696233db", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676337, "uuid": "9e800619-44a6-4e68-91d0-70adb4da965e", "comment": "Malware payload", "value": "7295a4b862328cc94573861f6a1f30fa111ca996fe8c19c498fb5b842abadcb7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676337, "uuid": "60720852-08ec-4a4d-8b2f-37c7b0dee664", "comment": "Malware payload", "value": "7b8103791e3e707126328dfb28d37bbc8abd8a70", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676337, "uuid": "f4b3d0a7-c3b1-4171-a0f8-4dcd75f4785b", "comment": "Malware payload", "value": "82c1f4efb38daf2db081ff03ddff11127f298c16506f17c99e2e6b519a680728259cf18468f5a982b2dd474c62a62792", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676337, "uuid": "213e0a0e-c397-45f0-9a90-1494be97a8e9", "value": "T15B74E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676337, "uuid": "2ed73aff-e1e1-48c9-8c3b-1c7f68d76c56", "value": "6144:Nkzpkc86ueZHV56NwBAG7QuImtCoGRmd+BUKCP5LtuEulM:686uNNwBRCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676337, "uuid": "7b7a5366-05c2-4bc6-a174-0d37593f69de", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676337, "uuid": "9c593e99-5779-4517-93b2-655a7d477bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676337, "uuid": "a04ac006-3c14-426b-ba8c-608e941a4205", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1def47-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687676165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676165, "uuid": "146bb13c-f056-4883-9df9-673111e9dd65", "comment": "Malware payload (SnakeKeylogger)", "value": "c33fb8b3a43d61e9fefebe403921b060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676165, "uuid": "4e8d0dc3-f593-4f22-9e37-fff3a259ba59", "comment": "Malware payload (SnakeKeylogger)", "value": "7407456644027661b7428bd9660b5a3bd50d6fdf11b711848c5e11497b74f0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676165, "uuid": "ae6f9fd9-86eb-4778-ab03-6fe7959f104d", "comment": "Malware payload (SnakeKeylogger)", "value": "67dbdbb8cb7037e8c13be8effca1408eef4ebd31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676165, "uuid": "fed180b2-2602-46c3-86d9-a64e478e0a3b", "comment": "Malware payload (SnakeKeylogger)", "value": "eaf99cf2e67e48c5be96e6adbc5b8fafc5b8200dfd0f2c583fce120e5ba3df42497db4e09bc67488d5a319202dd91b66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676165, "uuid": "ee9dc98f-6feb-4b6f-916a-eab1628c62bd", "value": "T12C357ED1B1608E96E87B07F16C2AA53016E76E5D6478C10C5EDAB6DB26B3341209FF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676165, "uuid": "a04031ce-464f-45e1-a474-621707c0a9b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676165, "uuid": "a7780856-f0c7-4dcb-9eff-1a3d16e36635", "value": "12288:kNcCpYtYq7J3At5iHOq+ZQtml2tRAiQNdRhtW42crKsHoaWpqNBUd:0QYqtm8OqKOmlsIX0jsHoa5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676165, "uuid": "e90a66b1-a27d-4d1d-be9a-ee2c1b12b6bb", "value": 1139200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676165, "uuid": "ba1d9105-064e-4094-9b57-7b2bc32250e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676165, "uuid": "086a1be2-ce6d-460a-be02-53dc03408c80", "value": "c33fb8b3a43d61e9fefebe403921b060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc716b9-139b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687727090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727090, "uuid": "72377b68-8c45-42e7-aba8-1a864383d1b3", "comment": "Malware payload", "value": "bfabce83cee13bb8b8d72f5c38e2af65", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727090, "uuid": "9d66c84d-cd99-4b9b-aea3-436cc2eb5767", "comment": "Malware payload", "value": "746f5d251c0d3883fd7a4d5775acdf6c12417f1365fc9db57a549f528ccd91dc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727090, "uuid": "9f897b64-3ea6-4618-b7de-3a6125942adc", "comment": "Malware payload", "value": "53131b7e90cb0891bd5cd43721a0207c0903ea51", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727090, "uuid": "7ffce559-8589-4b19-94f9-000a2b4fe884", "comment": "Malware payload", "value": "e6477debb68e1959c208a33993e8dc5c028f36b91f20b54b85af314f7c5fa60a5ab4e698bfbaf676313a0ad865ac6e47", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727090, "uuid": "89ee925b-af00-4f65-8346-eaf37867e433", "value": "T1B8F4026433881F12C6AF47B4E4A1974497BAD74FA58FA3BF988054E57883BF09D21363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727090, "uuid": "4a6914fd-84ab-407c-ab0a-430d165b7bcf", "value": "12288:CrN1NPZhO1obm3aZa/T6ioQ2+6XTNbJy7FF53D6HeHoASstzTTdR62sSwBz8zI2:ozIGO2Uv6jJJ03GBstzTTa6zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687727090, "uuid": "09c7f1ab-59e3-43ab-afe2-cf380cd50d8f", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687727090, "uuid": "bb15c795-b3de-40ce-9df5-31a0c40a1c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727090, "uuid": "8146e4b9-e4e8-431e-8f74-ff7d2f53dc91", "value": "bfabce83cee13bb8b8d72f5c38e2af65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a944202e-1326-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687676726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676726, "uuid": "bd6915dc-ed63-416c-8032-47abd931cac9", "comment": "Malware payload (Quakbot)", "value": "6efa100489ad468ad769610bca860ad7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676726, "uuid": "fe2549ab-3a74-4f7c-8519-d426f132e4e1", "comment": "Malware payload (Quakbot)", "value": "7619db1cbeef2ec38d180fdd9fecb8dd8776c90b6c1941e4f685c0a9b03b1343", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676726, "uuid": "6af38b3d-a276-4b92-851a-cffd14c861e6", "comment": "Malware payload (Quakbot)", "value": "fbc792d8de0acd342cb5732381427061bd02c8f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676726, "uuid": "30fdf175-5571-42f0-9775-de176abf3931", "comment": "Malware payload (Quakbot)", "value": "0df521b371f73fe6b54b8d552aad8deadf3199decc1b8674b221b2886971a40fefb6866bac51ca8986a01c92adbfcc44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676726, "uuid": "609c8b65-0049-42d2-bf48-e70a133ccd5d", "value": "T1F7558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676726, "uuid": "fde6ca54-cf62-454b-bf7d-6c416e8614e1", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676726, "uuid": "3287941b-1a60-40ef-a84b-249e81e0e66b", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4y7Q:QbkS7XB1EsOSNPSp0EAt2bUeM4y7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676726, "uuid": "43902ebc-8fc0-477c-93a8-6cbceadbf406", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676726, "uuid": "1fa0754c-0d26-4e1c-987b-7c81f24b7794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676726, "uuid": "21befa0a-8442-4703-8f6b-4aa066d3c57d", "value": "098qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ceff66-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687676019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676019, "uuid": "b12250df-9f11-449d-8551-4785b1c378fc", "comment": "Malware payload (RedLineStealer)", "value": "d97c79f495cbf93603988923e6745e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676019, "uuid": "e0959014-5bc6-433c-b0f4-4820aa7249ae", "comment": "Malware payload (RedLineStealer)", "value": "775f34d6140bb1a2cf210d422230e511d0af52c7d5c96ff8198d74387f2b3815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676019, "uuid": "846bf45f-2bd8-4b44-8f1b-11bfe3fc11e5", "comment": "Malware payload (RedLineStealer)", "value": "5af932ec9c340ece313aad8e7eb0ce9987ed504e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676019, "uuid": "00a0ecfb-95a6-4dc4-808d-118ff27c1a60", "comment": "Malware payload (RedLineStealer)", "value": "e570d5bc3f7ac93e20d9ac07f59af24dc97291acb7e726cc5aa0759ab508a1027927620668825a3a0657e65d51346fe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676019, "uuid": "0e2baf1c-2e9a-4da5-aa47-fa4b316eee99", "value": "T1F3559D132985B522D8D3B8B2462F83212B68F7B1AD5F74D9EFAC3934943798D6CB7041", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676019, "uuid": "a640fd27-53e1-4ae4-b0fc-543e8f6a8ebe", "value": "587a23ee0bccf95906f888e2a3c1c6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676019, "uuid": "a51d0add-cc61-4bdc-a8ff-68dfe86fdd55", "value": "24576:6jBLjaIaGjQgF4VPrOHhhMYHbmP1dqGAQ3YxhCVw/KacdsWiFGjJh6JVKY5cE2+C:6FLjlaGjjF4sHhihP1D+hSw/8zNJwJV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676019, "uuid": "602530f2-4bf4-41d2-9181-6440a78f2abb", "value": 1358336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676019, "uuid": "f65626a4-b4ad-4f36-9335-a3ab29d524f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676019, "uuid": "cb22e137-3140-4b4a-8aea-7f725f505d2b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525fc3da-131e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687673144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673144, "uuid": "08fbb707-a628-4fc2-b1d7-9c12e33b5baa", "comment": "Malware payload (RedLineStealer)", "value": "e4a79d8cccd65de74de649c555ff3352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673144, "uuid": "b8a60640-8c4e-4e91-b150-321defb6d0e5", "comment": "Malware payload (RedLineStealer)", "value": "7d8ff2d25293b5af85b0ccb3cc22b0a3073c80bd2605c634d1d12b6d6369c286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673144, "uuid": "7e507cf5-befc-4280-ae79-348b45103435", "comment": "Malware payload (RedLineStealer)", "value": "e21b601f4ef5c585d9d982aaf6aad81500ff73c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673144, "uuid": "b31f504b-1316-4fd1-99d2-db89e881fb25", "comment": "Malware payload (RedLineStealer)", "value": "87d040466c714e0ea4e2c0da1db99873d880bc606b0cccf7a13ddaeaed70c48123d59163483b157e219ab8b81db5764f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673144, "uuid": "67898c0d-fc1c-4f7c-8939-0a07ed7e9544", "value": "T122158D007454CB15E5EF02F884B34A24FBE1D757D22391A8BAAC53FB0FB296D876750A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673144, "uuid": "f1483199-e169-4f42-a7b7-5f378458103b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673144, "uuid": "cd3079d9-86f1-419d-a8cc-1d73ccfbb7b3", "value": "12288:IojD4c7snCSWhvYvZWhWuuHzIPRr+7kSrm/dOtdbyM:IiMLnISMWpzIPRy7kSrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687673144, "uuid": "df34fa1d-ceb2-40b8-a065-3a6b5d888c89", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687673144, "uuid": "b5a43710-1724-428b-baf4-c5e0385fe933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673144, "uuid": "32610716-ce19-4b28-b146-7ce9cce91750", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5929d3ae-133f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687687329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687687329, "uuid": "ab6b8341-d57e-423d-9664-770b857f9c44", "comment": "Malware payload (RedLineStealer)", "value": "2d065d64c8f9c94ce104f7310a57caa3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687687329, "uuid": "2055f766-fe71-476e-adcd-1f2ffc75a885", "comment": "Malware payload (RedLineStealer)", "value": "800baed2a2422853e0fe86f22612151b984c82f1fb69e63d953647ae06c360a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687687329, "uuid": "ecd33e9d-69ad-4ffc-b64d-b35dab4616dd", "comment": "Malware payload (RedLineStealer)", "value": "f080d5d8a526d32d8251e394f76a96ff2fd80ee2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687687329, "uuid": "954a03c4-0a61-4b4a-8f6f-45c1fcf87134", "comment": "Malware payload (RedLineStealer)", "value": "5917c85f370423e2620b428d09cccf9efb39d36cf92f0f2662e2e2bd80498056c845d38e85c04061e1fe48ae94c094cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687687329, "uuid": "5c5eae69-0f8b-4c45-bfc1-d7806a3d5c59", "value": "T1DF1611365140D6B5E3C3CBBBD703D42D1EA824793A9F34492B968DCA1CA727CE633859", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687687329, "uuid": "a391bd50-25b3-4dbd-945e-84c57f0919c2", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687687329, "uuid": "1536c17d-82cd-47c1-8923-1b713894d477", "value": "98304:BoIsu/+SSBvosz4lb/SQD/GQ7rus7+RtLWr8wgRZR2LHhXGpgabpyuUgEhrG8Yru:WTu/+SSBvos0SQzx7+RZRGygabpyumYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687687329, "uuid": "472d4036-fd29-4768-ab81-810f7be27ba3", "value": 4132352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687687329, "uuid": "2178d431-182b-4e7d-aa94-683bb42684fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687687329, "uuid": "f5361243-27d8-42c8-bac2-89d9d87862f4", "value": "2d065d64c8f9c94ce104f7310a57caa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac647bc5-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676302, "uuid": "aaf1ce47-b813-436e-9f8a-27dffcc4cee9", "comment": "Malware payload", "value": "00f744f15b8fff3055b48e7efd96f80b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676302, "uuid": "84eca8b4-73dc-43ab-8722-781d9e95687a", "comment": "Malware payload", "value": "853784d6a31b68f18fc376970ca0ccc5799e0025f4066ad0d2f93cea7bd048c8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676302, "uuid": "120020ea-5638-4f85-b1b8-4c07410f5850", "comment": "Malware payload", "value": "2dab5a5de96601b1a516da30f0f57c91f5e5e453", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676302, "uuid": "f95677c3-4b44-4f80-a5c1-3d5ee7f83af9", "comment": "Malware payload", "value": "e4d1a5156e89897749bd60724c4fac90434ca01d6259b23be2dbacead9649856829b50a2fdf87a41373d38ad8a540519", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676302, "uuid": "3cbfbd02-c562-4d44-873e-d2eab433517f", "value": "T16474E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676302, "uuid": "2a22e003-b73a-490a-a134-4f079f202756", "value": "6144:Nkzpkc86ueZHV56NwBAGTQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBZCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676302, "uuid": "4d18152f-b705-44c3-81eb-9071cd2d54a9", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676302, "uuid": "adcd74bd-2940-4075-9b90-c906bae983e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676302, "uuid": "4c4e9059-e662-433a-8b18-d73055956c87", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffcf7b9-12ff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687660121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660121, "uuid": "edbeefed-ffb4-4146-8d7e-17e354f43fa9", "comment": "Malware payload (CoinMiner)", "value": "e09d43db211141218dd1948dd2e1d3f4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660121, "uuid": "2ba2732c-11e6-427e-a631-8ce5585da9b8", "comment": "Malware payload (CoinMiner)", "value": "86ce5dbf891bc87662ed81618a1f7a4c57f2dd19624d0279db3aff49de83af12", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660121, "uuid": "62231183-0a0a-48d9-808f-01061e0e793c", "comment": "Malware payload (CoinMiner)", "value": "0d2a04e62715024e4d9a23ae2984a0e79a890664", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660121, "uuid": "8c733c92-a225-4b48-922f-314a5f882bfa", "comment": "Malware payload (CoinMiner)", "value": "21e365e8b31e25eabdd3b41dffd180b33d441f66c59db9f7f92fc940619818902af399ab1d0d88fd051faa8d4caa54cc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660121, "uuid": "c8907c31-9185-424f-b3c2-42373730554c", "value": "T1C8C32840B2E191A2D5A135F10861E0BA5125BE185B1099D7B3FD3F0F7D72AC3DE362AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660121, "uuid": "c46ee6dd-bf3a-4977-b6a3-e108390c4687", "value": "2adb28da7b9fece4b360fc7188d2f05c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660121, "uuid": "f1abb056-cb96-482f-8a5f-04fac47408e6", "value": "3072:MwqhFkv93CSk5DJkXTSNTBfCkRY8kYDHA:MOv9DkXyeNTBakRlkYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687660121, "uuid": "d2155d26-07d6-4943-9f8b-bbbb613fddc4", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687660121, "uuid": "e773d544-19a2-40a1-b0d3-f77695abb692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660121, "uuid": "371d0fdd-13a3-46ba-91a4-92893cb2e6fc", "value": "420 v0.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341ceb28-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678247, "uuid": "e3320b06-316c-4971-aaf7-afc690461407", "comment": "Malware payload", "value": "d854295f5572ef5b08ecd1f9d53e4b05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678247, "uuid": "b46e8de0-2d99-480d-9a72-9584f767af38", "comment": "Malware payload", "value": "8868862d704985cba3844bfd123b674487132dccfbce744b80d1528b4b6a64b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678247, "uuid": "8fe4c2f9-408c-41e1-a495-33a5e76ab447", "comment": "Malware payload", "value": "a2d533f01b3bbc11617551c7825f9ce7fca6502d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678247, "uuid": "bf336fea-3b86-4970-b8e5-7a12f8ea82e6", "comment": "Malware payload", "value": "95e8775fc858fded7b7e525fd239fe51b8e6e461a6e69f14c6277ddfe3185aa54c5efea65e43bd0d7d33797b7a546b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678247, "uuid": "43d3f48d-5f27-471b-b91c-b90f5e6ce39d", "value": "T1FA65F06B3658D53BD5581172E4AFC3230D6D7AB1021FF08EAB631A77CE639AD863D480", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678247, "uuid": "36ea20a6-d38d-4543-abe6-5ff7477fca05", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678247, "uuid": "06661c97-7885-4660-b592-42588b9adb40", "value": "24576:EeMwVVKryNrRfbzRh7cTWjrTXaBxuvR943fyw4e5/SAoicLJ9+lGuWkuLYzf6eHX:EpQzbjoarTX7y5/zcLJglLZzSenB9naS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678247, "uuid": "b8628449-7ae1-4a2a-a468-e18ab0cbd95d", "value": 1421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678247, "uuid": "d657921a-2fc1-4d47-8708-fbbd5599a22c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678247, "uuid": "ac2f622d-26bc-4b39-ae5b-f4e27aa00787", "value": "d854295f5572ef5b08ecd1f9d53e4b05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b98669-13a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687731607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687731607, "uuid": "e1b76c87-0388-4058-a63b-56c73070f44c", "comment": "Malware payload (Fabookie)", "value": "8ad25c3f9afe964316793e21422c7cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687731607, "uuid": "f3717367-c0a6-4470-9219-45fefbce6d4c", "comment": "Malware payload (Fabookie)", "value": "8b86217f459ed9cf84163cde1e053475537fba54fff6797cb000a3f806c7ec8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687731607, "uuid": "b7b1126e-95d4-4ec7-a8d8-15007349b133", "comment": "Malware payload (Fabookie)", "value": "9c4c59332306264880171b1beb026e9c49f467c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687731607, "uuid": "aa1688e7-7548-4d16-a882-bd52fe7af8d9", "comment": "Malware payload (Fabookie)", "value": "5b4d98d3580892a3a03d0de4674d17dab3386445f1fa03fd19600738a924b8a547f802ad782a75fcbbd89e00171e00c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687731607, "uuid": "256e61d5-ec3f-441d-8c61-1c76b9846e13", "value": "T192444C1362A3BC62E5254A329E3EC6F8361EF7944F1B776622185ABF0DB12E1C173351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687731607, "uuid": "a9020011-3d1f-442b-bd3d-191b6acd7bec", "value": "38df306a4aff689a6d61e6a070d38649", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687731607, "uuid": "c113c201-ee06-4d99-98ed-65e6875cdb39", "value": "3072:WtMe+Ku+H6sDz4JreQqpkxFCrldehFAaWCt5f2IGtJ0f:W4KEsDz4JjqpGYdctzG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687731607, "uuid": "688fc26c-e9dd-43c7-bd7e-b9097fd1bfc0", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687731607, "uuid": "8499e892-8ee4-438b-81a7-089892dab212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687731607, "uuid": "6959ba31-b775-4c10-9c56-3443dfea5d13", "value": "8ad25c3f9afe964316793e21422c7cdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301e9db4-1344-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687689408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687689408, "uuid": "1ca5599d-1d6c-4d24-b6d2-3ca0b7305eef", "comment": "Malware payload (RedLineStealer)", "value": "0b3a35794a097bf0983c166f1b72799e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687689408, "uuid": "07d247f9-03f5-41fe-83e2-312018904114", "comment": "Malware payload (RedLineStealer)", "value": "8cd342b21ae54ddf97b4099a760134cdf2334d0cb850e9bd3c965f75c4fa89d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687689408, "uuid": "00642653-f4d9-4099-9e44-9e93b00f46f3", "comment": "Malware payload (RedLineStealer)", "value": "102f3e4ce739c36004b75b1acbcd603b7c17b437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687689408, "uuid": "5fd944a7-2c93-44c9-ab1c-94e7e16f95a7", "comment": "Malware payload (RedLineStealer)", "value": "407328644882111ec734103a6271ac509ebd50d513d1f8315d6a6e715f40bac238b51697ea6c86fbe39978d8242671a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687689408, "uuid": "d95a500b-fc95-41dc-ab93-bfbee1fd37bd", "value": "T18FA4AE12BA9D9076CD6220310A558A729D7DE9300F6315DB97E039EA7B2F5C2B332F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687689408, "uuid": "da0cda52-720b-4ffb-8f5e-2e4019c3ed34", "value": "c597bb4cddbc48e6f4ca4b69c474c1ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687689408, "uuid": "f3c1e720-279c-4935-abc5-de9481f9aa14", "value": "12288:KQLeoEhekTAE1rEv+MgxhUjJGrfa5+cDCSxkB5yVB1/:KQLeoEBAE1rEv+hIJGwiukDyVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687689408, "uuid": "8b7a6ddf-dc4f-414d-bf63-781a17025375", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687689408, "uuid": "59548b1f-2fec-470c-ab7a-031349a1e31b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687689408, "uuid": "4d8be5f2-7bc4-4cee-a5ff-5a644c2bdef3", "value": "f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5347bb1-1324-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687675968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675968, "uuid": "be41011e-d2a3-4993-8d8b-f400a2ea562d", "comment": "Malware payload", "value": "7383126affe04875b08fbd92fabea715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675968, "uuid": "d505eea2-870e-4612-9d04-4754da26a8c0", "comment": "Malware payload", "value": "8e0cc20d2e2034876c1cd63e36673296b2978435b6f07b653775693a38d4926c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675968, "uuid": "071f688a-5c08-44f8-b7ae-e2c06413b437", "comment": "Malware payload", "value": "b9ce3669f6743da3b971177cc237273de7e9bb14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675968, "uuid": "d3ba05e7-1d8e-4635-a7b3-dfd867d485d5", "comment": "Malware payload", "value": "7aba130d80320076bf58181bd81aba89229fc6ae1aeb2073615f1443383ea97adb23376e25d41adfa7c31c5b33304b54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675968, "uuid": "90da9fac-ff2b-4035-9010-115d737cdaf7", "value": "T1B4043A01B291D172E46210F225E0D2B759383A7107AF88E7F3C1AF6D6B755F2A621F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675968, "uuid": "fa087bb7-3c24-4b11-97cb-4fb503f3d985", "value": "f8334f7cad1e707e2f791ec25b5af9f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675968, "uuid": "004b9d64-0e98-409c-8ee6-9e9c931c26aa", "value": "3072:Ik6xiOTZ+FCqAet1YBzWI5VELYnRkHGfqvwmOJottKCynqbHF5lXb2B:I7d+pbYNWI5VELMRcGfPmiGtKVK12B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687675968, "uuid": "4b6802a5-f25c-4419-b410-b312ca81b6bc", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687675968, "uuid": "3fb6b256-d003-4da3-a4d1-a3f38cc9882a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675968, "uuid": "c2113e7c-fca4-4344-8ccb-6da517bf4d3d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b50f9b-1392-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1687722914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687722914, "uuid": "8220332d-2111-439a-98d6-5baee739f75a", "comment": "Malware payload (DCRat)", "value": "6c8c36b4cadb09dbdf863c1a4109c99a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687722914, "uuid": "e1d53a1e-6e92-49f4-b41f-acc8e8dbdd49", "comment": "Malware payload (DCRat)", "value": "8e6d8d43b27c595577df64ac072385ccf270ec2e73412e4f51b87091de276b25", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687722914, "uuid": "cf291cf3-c1b3-4eeb-ae50-e2dd84306034", "comment": "Malware payload (DCRat)", "value": "b8bfce45aafcfee52b1c58107455a9e1ef1b014e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687722914, "uuid": "a388b529-cdb8-4a6c-9ea8-1e9705b82b52", "comment": "Malware payload (DCRat)", "value": "41e6dd6ee7d90e568d58bc17f56993449a386b5ef20b14c6941d5a1982a33cf2468f910c8fc0b927c52fd6bff99c6c2d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687722914, "uuid": "f750abce-b6ec-47ab-be7d-d9638baa71c5", "value": "T1A4654AA27E46DD12C169163BC9DF892407B8FE016BA6CB1B7E9F335D64123A31D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687722914, "uuid": "857a2d96-b705-4737-a9c4-0fb29ece4529", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687722914, "uuid": "435de269-8b6f-4da3-971c-50d55c854e9f", "value": "24576:U2G/nvxW3Ww0tdH3URXMFVPFRooGW1heMMnQkPo/6+4i:UbA302RcFVPFRouuPo/tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687722914, "uuid": "50a4de25-522b-4295-ba31-a2e07ec612ee", "value": 1455328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687722914, "uuid": "fefd6a68-581e-490c-b7ea-f570e56d1e6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687722914, "uuid": "6811870c-f229-4350-bd81-0fa208ef6b8b", "value": "HEUR-Backdoor.MSIL.LightStone.gen-8e6d8d43b27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb69b14-135c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687699794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699794, "uuid": "3525c81e-2d0b-42cd-9f43-eee6b7122073", "comment": "Malware payload (RedLineStealer)", "value": "b1b530691ab766055025e4ae262547b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699794, "uuid": "f2503414-a88f-478b-bd76-badc425da2e8", "comment": "Malware payload (RedLineStealer)", "value": "921d990dae1f50abb0681b75f02c9c4774f76176431a4822b682fffac7807665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699794, "uuid": "8f5df7eb-9800-4433-a628-f14e36adf88b", "comment": "Malware payload (RedLineStealer)", "value": "dac1a79c9d5380b628ab5b2cc0f25c1acb42fe6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687699794, "uuid": "157849f1-8855-41cb-a433-bba22d840aa5", "comment": "Malware payload (RedLineStealer)", "value": "c4fde263a90a76e23ce0fe7ef76ae4e725fc18bfb30021b273250e93588293d3adc6fd43ae3078a5ccf07d0d6e59317a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699794, "uuid": "bafaf654-1ce8-45e9-97e8-e3811c9754e5", "value": "T1361612721251D9B1E3C3CBB7E303E42D2E6924BA369F74951B968CC62CA727CD133858", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699794, "uuid": "a45cc125-2c3e-4f89-a331-fad11e2fa100", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699794, "uuid": "0e209bb4-18a8-48ee-ac33-8eb6603c7003", "value": "98304:yb85ULsTM/XItQIBFPF3pCiSPlSjqZ8bkO81hK6Yh+PZiUIwuI7x0V/NzoFpwVvD:gGUIgQtBT9SPlkk17oUIwuISFoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687699794, "uuid": "abba6e48-7ce7-447c-91cf-e066871087e3", "value": 4118016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687699794, "uuid": "4fe07709-745a-44a3-a2f8-487896be1d18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687699794, "uuid": "83d689f3-4981-44f8-8585-16300081bf20", "value": "SecuriteInfo.com.Variant.Lazy.355257.2327.27808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72348a4-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676320, "uuid": "b85b2662-9197-4272-bb49-93e668d75069", "comment": "Malware payload", "value": "85b2a0de01407f06fa06dc551caf50a3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676320, "uuid": "c1eaf0e7-f79b-45d2-8b56-ee5b59c8db11", "comment": "Malware payload", "value": "92ed02913df5ca6ecf7a4be5f7c1edb9fff4bc88e5bf8c27765812ab91a45512", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676320, "uuid": "0b5e1e1a-f425-47e7-a891-5d55847839a5", "comment": "Malware payload", "value": "18b249423403a6df06953c0f3aa420125adc4a30", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676320, "uuid": "a0e68cb7-cc78-49e2-82cb-9d2f94f19e9d", "comment": "Malware payload", "value": "f1668127f76ab82c9ccd6d88769541026a86ca4a61ed4151d6f7171b8568ee31f65d0f82634bb61cfd9811b07b3e4cac", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676320, "uuid": "ac023f93-09c3-4565-b104-e5a3e162513c", "value": "T1D874E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676320, "uuid": "26893138-0880-4405-ae09-1526fad06da9", "value": "6144:Nkzpkc86ueZHV56NwBAGBQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBbCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676320, "uuid": "5b0191db-dfaa-49fe-a934-53a60580c3be", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676320, "uuid": "9f76388c-70b1-447f-835a-b5ce3098edc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676320, "uuid": "f6e2b395-f8ef-4682-a2e8-ddd4fdff3f8d", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22b6a7c-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687678942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678942, "uuid": "5202a67f-819b-47ef-85b4-3219c94efe27", "comment": "Malware payload (RedLineStealer)", "value": "302b13223db8c63367c43b004b9395d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678942, "uuid": "df6de680-1cea-4fce-b58c-ee21bc43ee16", "comment": "Malware payload (RedLineStealer)", "value": "9802c511f650d5eb611d309889655ac2f8daab5f87c30463b2505da99076192b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678942, "uuid": "0e7055ef-d88f-43e4-b522-7461a8311e6e", "comment": "Malware payload (RedLineStealer)", "value": "2fda947fb80d0089f41fef46137b52bab9b9845e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678942, "uuid": "19f2753a-c913-4032-9c64-080e223ed65d", "comment": "Malware payload (RedLineStealer)", "value": "fac4c08b330d373dac94c53d05fc8aaa8f66e1e478d82f904c36d47c3d6b2430010b2f970e56e2ba533bcdeebf50147f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678942, "uuid": "6c82aa34-6f4d-4f8b-8d98-7bf5f5522376", "value": "T173541D770EAE6CACD8AECEF026A601265D9ACF16BCB0C25B1D51B08145FC940779ECD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678942, "uuid": "b7c34223-4b67-4e66-b9c4-cae1151decca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678942, "uuid": "80c13b3f-1506-4ff3-a0b4-40c9a672d0cf", "value": "6144:Srbm6QnkktV535ZLLnvv2+EBEFMAA55555A5555555A5555555555ti:5nkktV535ZLLnvGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678942, "uuid": "42cc6bcf-ba3e-4e17-ad7f-7ee0d9ccfbdc", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678942, "uuid": "76cfe9dc-a42b-47e3-9a58-76fd854870c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678942, "uuid": "62652af9-172e-45c1-a585-31b9d81c36d2", "value": "302b13223db8c63367c43b004b9395d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2263d9-137d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687714047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687714047, "uuid": "7bb8bce1-21d5-47c5-b375-c65f3e32427b", "comment": "Malware payload (RedLineStealer)", "value": "bd4cef1e386839ca8cd9316650df0f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687714047, "uuid": "83368015-c9da-499b-acc4-59980466cf2b", "comment": "Malware payload (RedLineStealer)", "value": "98b22e05a733c85973dae71739d73f171c1c11e1c83db39d5d9f55c73754f2ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687714047, "uuid": "a63af8c2-e7e5-428f-bd2e-0ef51d06ea2b", "comment": "Malware payload (RedLineStealer)", "value": "62c298f337381f43efba36330e5dabc0daa9d60c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687714047, "uuid": "66e10c33-8622-4e1d-be3d-185474a3c703", "comment": "Malware payload (RedLineStealer)", "value": "76e0d10328c61bd9a1974ead5b066e3a249cbd8e6a1a96f1ef2958750f3e42ce1975a21aaba75e10755bcf5ee4d21046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687714047, "uuid": "900f5517-4ec2-4a06-bfa2-02acdf4b9205", "value": "T1511612761154D9B5E3C3CBB7D703E42C2EA9247A36AF74952B824CD62CA72BCC133859", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687714047, "uuid": "80522232-0c25-460b-b121-85a404d2d263", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687714047, "uuid": "272b7010-57d3-4258-958f-a7864a46e4cb", "value": "98304:J2gXuftxgE1NtqysMNB1MmA6rPJdsD7AE708/ZBQ0N0cEZBULli/m4xqVjDhxt9k:RXuftxgE1XPDMIJd27LvCZBUouMAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687714047, "uuid": "f5ddf133-aa53-4d35-9f2d-56a6033badd9", "value": 4118016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687714047, "uuid": "27afdd3b-7ac9-445d-98bc-97f7ab2e4e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687714047, "uuid": "77918e7c-916e-4346-96a9-245d77d93ed6", "value": "SecuriteInfo.com.Variant.Lazy.355257.22661.13259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de516c4-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1687676143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676143, "uuid": "9e0322ff-749a-4782-98d8-4ae48d926768", "comment": "Malware payload (SystemBC)", "value": "be86ac4e00830934b636abedf639f9e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676143, "uuid": "0ee29f38-757d-4f45-ad3b-3434cb45bd11", "comment": "Malware payload (SystemBC)", "value": "98e0d98ce2fdbe02482ac0a443de40943ff064ab17180d448f691a046647edf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676143, "uuid": "324ee902-4217-478f-b3ea-c918d827847b", "comment": "Malware payload (SystemBC)", "value": "7a05a17ea713f7b211ba1828a3b047f099d02f70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676143, "uuid": "bf81c589-e723-4464-b90a-16cdbbb3759d", "comment": "Malware payload (SystemBC)", "value": "85330dd41605e42c94fd2b4898f30961c9986615c93b080f50182a255e4743c42d4e0814da0a0adcd964be44e38393de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676143, "uuid": "07247d7e-c4a8-49cd-9461-7ce38a1ac27c", "value": "T12B34AFD272A0EC70D12116315D3EE6F86A5DFD518FA4279BE2187A2F097C2A1E973343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676143, "uuid": "8eb61973-022f-440e-9744-f4f314f22137", "value": "e22f6bb2be4e12044608fc1a03b29b46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676143, "uuid": "95abd10e-35b1-48b4-a001-8aaa628b24e0", "value": "3072:+y0428BfdROFe+qJkoTmNeok0Xt2S0rJQRxL8LTO7OEMW2oAYwj5:O4LFdROFTqJPUBk0XUHrJQRpKO7mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676143, "uuid": "8486b8f1-2c68-4afb-a30d-8cac62dd60a2", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676143, "uuid": "7497360a-d94e-442a-9c93-1e7847234797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676143, "uuid": "b57c2391-2d6d-425b-b4ae-d070b58941ae", "value": "be86ac4e00830934b636abedf639f9e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d083772-1353-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687695791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695791, "uuid": "c21cab68-9068-4208-8a1c-355bc49e3d04", "comment": "Malware payload (Mirai)", "value": "55b5ee1990382e689f0958d09a7f3cc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695791, "uuid": "99092bc1-8ca6-47ac-9eee-36783fb9569d", "comment": "Malware payload (Mirai)", "value": "98fcfb41c4cf34faf163ad35c936bbd086caf84c3308de5aa26b5908efaf5956", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695791, "uuid": "aecadf4f-87fb-47da-be84-c05f0ed1d4f6", "comment": "Malware payload (Mirai)", "value": "04bb167a1f245baaef7cfb19e4f93a1ac079200b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695791, "uuid": "a75a80d5-6e18-4394-9987-085ab3a7b299", "comment": "Malware payload (Mirai)", "value": "61612a0467f1a85e93eb2c3bf81f19e1b3d6c51edb1f55929376a547109ea435bd579bbe2ffdc2077640e37ea02177d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695791, "uuid": "8e675aec-eba1-4671-aa66-2352cdd59e0f", "value": "T19F630230CA76A590A2F72E55787D00472C656BECB0EBDA767388773CF53744A02B648E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695791, "uuid": "e27c74ca-0e0b-4192-b73b-a3bb2c027f2a", "value": "1536:LQc8XChjmpBs/E3/CfiNf3PezTLY0RDRbELHaqjOdx46pcBbr/s6AZ3r:LxiChjmpBsyaqN+/LY0b4Lsx46pcb/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687695791, "uuid": "8d99e63e-1bab-4015-ba02-901d5bbeb8e0", "value": 71592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687695791, "uuid": "16b1db51-e039-41bf-a92a-2a4f3d03abd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695791, "uuid": "3fb4e857-0d57-4f74-96b5-504d6a41d27d", "value": "55b5ee1990382e689f0958d09a7f3cc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b659b7-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687678995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678995, "uuid": "6b529635-0178-4db0-85ad-865c871fdafb", "comment": "Malware payload (AgentTesla)", "value": "f6651c64f1a6a54a6c5f7205c3c8139e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678995, "uuid": "b7073a84-f6d8-4af8-8fba-65ca3cc24f01", "comment": "Malware payload (AgentTesla)", "value": "9e778ed10d6543b0b16f50bbb021181e2cd1d6e9ab230f28492eeb45838c3893", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678995, "uuid": "c182f662-6daa-4a88-a78d-23a5978268ab", "comment": "Malware payload (AgentTesla)", "value": "2d3e7e8720051a2e83ef4b9915dbcb1f8bf9591a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678995, "uuid": "a6ec8f65-3f5a-4acc-b081-e78bb6ccfaf0", "comment": "Malware payload (AgentTesla)", "value": "349d740e1065c0053939feca56f92a19d2f9ebc7a81f3222904a333c122e2dad9d6c6674ff5b0809a3a8d0c568586b69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678995, "uuid": "e3328b90-913a-4459-8066-b3a0bd7c7f0e", "value": "T167E4121A05B48A71E57D1FF6A6B14060CBF9A952F213F38A4F9430F60DA3B815B53B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678995, "uuid": "694cde86-c0fa-4576-8719-1059abc42134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678995, "uuid": "4c293eff-aaf5-462c-9f50-25897dfa0a7b", "value": "12288:rCM2iNh4/mNUA6vFzeFRAcgHpA3k4eChcaSGHEtovmuR0U:eM1D4/QU9qSJg0m7mc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678995, "uuid": "11f5a499-177d-41d4-8513-5cfecea08c1c", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678995, "uuid": "7668e9c6-3909-47bc-8fed-3e94c2be9efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678995, "uuid": "138b65aa-0f6c-4163-8774-ec544e36c5b7", "value": "f6651c64f1a6a54a6c5f7205c3c8139e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dca597f-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687678666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678666, "uuid": "f424ea35-f448-4b28-8997-6a6eafae4aa6", "comment": "Malware payload (RedLineStealer)", "value": "559b167a4f2e62a6c57f42177a114a86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678666, "uuid": "e0d9ecad-6a36-43b2-aec3-0adac4f7d256", "comment": "Malware payload (RedLineStealer)", "value": "a04c914bd23e32949eeb69c1c1b5f083a95935a53c75d2509e302207dffb0528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678666, "uuid": "93f61f0a-c33c-4e68-bf75-ddabae2dedad", "comment": "Malware payload (RedLineStealer)", "value": "6c1a29d37698c9e04e91a9792ab5652ecfa60b1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678666, "uuid": "c68e728c-4986-403d-b11c-e8489bb4c6dc", "comment": "Malware payload (RedLineStealer)", "value": "0e08a2b4ecfd903a8438eccdfae77b89a5dd6baf238f7a5727f409587894d5a98bce7d70bb5308dd08c12e9db052d644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678666, "uuid": "04347641-e54d-49e6-8021-d6566581f779", "value": "T1973601F22040E074EBD7B739C92B831F281A643112EFB19D9F6A9EE90A3397CD655C15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678666, "uuid": "0c43ccc8-9d9a-446a-984d-0c74149cb620", "value": "587a23ee0bccf95906f888e2a3c1c6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678666, "uuid": "8ef808a2-5eb2-4000-8dbd-29aa3807572a", "value": "98304:T7n3jaLXmQ1HS4XYgw8TR/4XIXppdlxEMyV1xHR5nFFUj1WsJf3rT6GYLAyLN2Pg:3r0hoMa1h781vJf3QLAyLN0ynMOfGET8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678666, "uuid": "bfa90461-141c-4d69-8615-69a736e9fd6b", "value": 5203456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678666, "uuid": "6adef77a-e7f1-4aae-9cb2-edcc7e6cb63e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678666, "uuid": "d1088a29-af48-44dc-b285-3e3e1f1c3997", "value": "559b167a4f2e62a6c57f42177a114a86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cda0859-13ac-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687734016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687734016, "uuid": "c8133498-927d-4a7c-9687-cd132a20fe32", "comment": "Malware payload (RedLineStealer)", "value": "dabf9d76781534549d9d382ceb71b854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687734016, "uuid": "2d664d1d-4d7a-4a57-8135-f6b4dbcac867", "comment": "Malware payload (RedLineStealer)", "value": "a09f32df2ebb726fa5a65d1117b29095ca58ff8ed16926fca96cf4e003e9df4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687734016, "uuid": "d8261fea-d330-4dc7-8554-5d9c8392b42e", "comment": "Malware payload (RedLineStealer)", "value": "11bcbe87d2b68f4be2c219713dbb197511faf4ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687734016, "uuid": "3621714c-35b2-4081-a581-2fccd07f2a73", "comment": "Malware payload (RedLineStealer)", "value": "86d95037b3e2f4415a4113744d9a7d6c5cf61172e84a283ae0361c53df0b623cc2822fd88585d789a7202f025be80fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687734016, "uuid": "2b85ea16-88fd-40e7-8336-8e343e18d4e0", "value": "T1C5559D83EF4919B3EA412473E92F77932882A4F1139FB0B9B35F0A96D65383D0574B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687734016, "uuid": "842d18cb-8571-43a7-92d0-c759f573e5c3", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687734016, "uuid": "7b618b30-67a8-45ed-a01b-d9814fb526e0", "value": "24576:6BPHWho9EwFexxwww18XSdkMcJuJlO5VQIiO/uXBq8rjYoys+AdVqNw4WyOh8eGl:V+ckeMcJuJo5SIiO/uXBq8vYoys+C6wK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687734016, "uuid": "076b679c-713d-4cd6-acbd-e888b057a896", "value": 1358336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687734016, "uuid": "ebf244c0-7e45-47fc-a361-7e71d98240c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687734016, "uuid": "7049bd87-2de6-4e94-b55e-32690354082a", "value": "dabf9d76781534549d9d382ceb71b854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0797cd4e-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678173, "uuid": "28c8d4e6-c82b-402e-9c9f-582c5c78d5f8", "comment": "Malware payload", "value": "ed8bf8d2a88d79fff48e25244842261a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678173, "uuid": "f0579163-021d-4ef2-ad94-24e0974244b8", "comment": "Malware payload", "value": "a0c22a70b4624a853bcd2421323b3141332c96d8e6b40ca275fb0c8c592e2b08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678173, "uuid": "3a397540-fa7d-4ed7-a426-122c7baa685c", "comment": "Malware payload", "value": "53e1599342634a6b38009b2cda85ee5549744fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678173, "uuid": "863df035-3953-4417-934f-c56c24d96939", "comment": "Malware payload", "value": "9bb153babb4c8411e83a849cc10843f5b0ebd57525b7c97d021ed05f80d37569999fe92892bbf0950a47c453a4c14c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678173, "uuid": "3b0dfac8-e229-4b0d-9c6a-96717edfa6ec", "value": "T18914498077C8AEF7E152253601E0CC324D6DB8B22E2F48DBBF931F5B8564AC15A78B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678173, "uuid": "d68cd31b-0949-486d-a564-7543849654e0", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678173, "uuid": "d07ff5f2-ace9-40c4-b0a6-3ee41a29d2e7", "value": "3072:38b9USV5XPJ0X6W6pdx5ALCIMoRe1rHXnjOFNWkx3D4Q9gR:MpTV5R0X6W6pdxSLC/pHXn6FDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678173, "uuid": "60687acc-a611-47f7-ac9d-c58e6a0ce4d5", "value": 200194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678173, "uuid": "dd5810ec-201d-426f-b61c-0e104f4989f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678173, "uuid": "e4eba6c9-da40-4777-bfee-bfff8d5b5fb2", "value": "ed8bf8d2a88d79fff48e25244842261a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f176c9c8-134b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687692738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692738, "uuid": "2c67f644-a9ce-4513-89b1-10dd05fedcbf", "comment": "Malware payload (Mirai)", "value": "273c0bcb0ebe43c137e0324575b79437", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692738, "uuid": "4d5ef05d-6a86-4eb9-982a-f75444c3d05e", "comment": "Malware payload (Mirai)", "value": "a0fae870a047266cc4470351ae1c28a83f4f24f95f0356179311bcda706bfb94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692738, "uuid": "9d53025d-bc37-45e7-85e2-3ec338afeae2", "comment": "Malware payload (Mirai)", "value": "2d2aa6e13dda53efee38711b32e6cdd1abff2044", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692738, "uuid": "033e219f-1166-47ec-8985-931e71895bf0", "comment": "Malware payload (Mirai)", "value": "0f13ddaa004009342836cf6863e821d2654ab512fb4687d09842e838b7fecd2b68a83d8cfc6790ef8ea13837191e94cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692738, "uuid": "585dbe7b-72e9-4fc3-99d7-4881ff062a90", "value": "T17DE2E142D688DC32D8B11937E45BC109939FAE5A37E734F12BB85214EDE74840AFD9A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692738, "uuid": "b54ce3e2-c741-4e0f-93d8-0318acb0f8fe", "value": "768:5k/NRnmYxKOXmNJI+q3PmNSNOxUPnENN0qQbF+33UOv:qN9Jr3PSvgn4N0Z+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687692738, "uuid": "ba62f1f3-80bc-4971-b4bf-d7c383f2a2bf", "value": 32628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687692738, "uuid": "734e0827-22f4-4a99-bbc0-1fd461e858f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692738, "uuid": "0ed7a1a9-ca59-4168-8885-768cf31221b8", "value": "273c0bcb0ebe43c137e0324575b79437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a83ecf-12ff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687660077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660077, "uuid": "7eb3b144-c428-422e-900d-690d981061f6", "comment": "Malware payload (CoinMiner)", "value": "8d1ade37f234ff7b7f9ee693aca13b6c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660077, "uuid": "5183c01f-ef20-44cc-b348-14c15351460d", "comment": "Malware payload (CoinMiner)", "value": "a168d71fb15b5c044abe597c46e67d29c5bd712ca1b6f7db3df13843291b0446", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660077, "uuid": "c94d08c2-0326-429e-addc-871ad9736232", "comment": "Malware payload (CoinMiner)", "value": "9c807033621cb9b766461bcd69cff14d7873efea", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687660077, "uuid": "38ff004e-18b4-4465-b973-f6f98db99b6a", "comment": "Malware payload (CoinMiner)", "value": "97127b5c18e452c56339b43ef2c51744b32030abc7bdd2ec32ec4e37371f4edbc6b82a13dced4e444261491c29d85fb8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660077, "uuid": "a63a2f3e-8f3c-4fd9-b5ed-d5cbb29ca205", "value": "T11CC31740B2E196A2D5A135F108A1E0BA5125BE185B1099D7B3FD3F0F7D326C3DE362AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660077, "uuid": "3774da2d-117b-4d72-9169-421e9a851785", "value": "2adb28da7b9fece4b360fc7188d2f05c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660077, "uuid": "eac5d0c7-2e8e-4647-96ea-1e0ccfe3821a", "value": "1536:27fTsqBbFkvQ21/ipICdckP+o1Ll5PlNg1qkXTcIOlnToIfcvQ+NzI/8kRAg+O:MwqhFkv93CSk5DJkXTSNTBfcIOY8kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687660077, "uuid": "93fcb091-eceb-4329-ad39-a863f3e017c3", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687660077, "uuid": "bc912916-5c78-4375-80b2-1fce1f4cf6e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687660077, "uuid": "6685b892-b104-4c2f-8a0e-5df50bfe52ea", "value": "ggggggggggg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f01ed9-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687717652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717652, "uuid": "54056c5a-906b-40a9-ba00-c94baf7c29cf", "comment": "Malware payload", "value": "4ff71c9a2298528c7f8edcbd6c7eca35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717652, "uuid": "97529a82-8c61-4c60-b872-4cb0d30566f1", "comment": "Malware payload", "value": "a1b16d8f9272db6e2be413ae5a29e848da653cf76b6909417275cb63641741ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717652, "uuid": "942f7bf5-3094-4c6e-9c20-47417bee2ca2", "comment": "Malware payload", "value": "e1ba062455b8f71382cd8d53c2fac888257c6789", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717652, "uuid": "ce176734-7e2b-4871-a520-5fcd5aea48de", "comment": "Malware payload", "value": "1a6492320ec9d2cfa48bde49916480954f98f6ab691f903b07ed23c7b90e228d0df78f411e12df41d90ee9608fde7030", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717652, "uuid": "ec2cd1b2-1aaf-45e0-b316-5bfa504b3bef", "value": "T1D6F43382013C50A7F1E6EDFD6AD6F35E2C69E414E3BE1709E2CE5BA8DD02A345631472", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717652, "uuid": "f2f30bdf-41fd-4ae4-a8b0-d35af5770f40", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717652, "uuid": "969b1a76-4480-4384-968b-adbd3b4b32cd", "value": "12288:vKFCLbLO8prrdZ5hw99dkb52PWKuW7RpxPCyHJktcJ71SnUIXtuz9F7UL/AjfCl:CFqLfdf69nkb52PWmqyp2Y78jXwz9tUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717652, "uuid": "cc4895d3-6f27-43dc-9aa2-c41ebac835ae", "value": 774678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717652, "uuid": "29f1372f-03a2-490e-8cee-4afe31f54150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717652, "uuid": "125ff3f8-45d5-45a9-8da9-f23ac0990458", "value": "SecuriteInfo.com.HEUR.727.5869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c40a796-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678261, "uuid": "de9c66fb-d32f-4e5c-8716-4cd6e1031725", "comment": "Malware payload", "value": "30b1deb3a5af601ce43ec30e8fd3ba49", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678261, "uuid": "a27b445a-f344-48e5-87d8-01b2c8a267de", "comment": "Malware payload", "value": "a2921aa91c547eedfb59d581f91c4f177ae9477806567a1ed558441ef7a82e0c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678261, "uuid": "b1dd9526-d6ec-4b4b-b5ac-b1cb245a75c5", "comment": "Malware payload", "value": "e0598ed20f00b2c5421942bcb1ddf4c19fe0c2d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678261, "uuid": "fcc242f0-5e50-40d0-8231-8c165c635736", "comment": "Malware payload", "value": "3f20343eeec1b0b3584586044bd2d7af02d55322e246891fe3d6c03885f40533129557717d7f52c3f385e552b8119f3d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678261, "uuid": "79b19613-c19a-4328-8472-bac370861910", "value": "T182644B1EF5A7B8BCC6D3E4B4D6BE87B1B934744D05B42A336780EA701252BE45338E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678261, "uuid": "1fcdb007-9295-457f-86d5-a6decbd0923b", "value": "233f3d50f8ad1fa8b6c33359ee5261c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678261, "uuid": "9ffa7b82-0fc3-4ff3-a9b0-3a3f01eeb434", "value": "6144:rqYMp1whyZAJfpTGfltYyMpfmA3a8yqgf2bMUD3:rqYMp1HaJfpfJmA3rg+bHD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678261, "uuid": "18381aae-412b-47e4-a835-7f17c148bc49", "value": 321548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678261, "uuid": "6586479b-a1ea-4f56-b0b5-b5d733d6eb3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678261, "uuid": "312ad6a5-c09d-40af-922e-2452d6d47a49", "value": "30b1deb3a5af601ce43ec30e8fd3ba49.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed35df46-1334-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687682853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687682853, "uuid": "0404accf-9aff-4fef-bd23-f84e4aa474ab", "comment": "Malware payload (Mirai)", "value": "44ef5f2c834791987cd8ec92c2569d3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687682853, "uuid": "1eef662e-abff-458c-b69a-c175d983f54e", "comment": "Malware payload (Mirai)", "value": "a56acdbd57108a2577beac5445fd57a4ad77f04878be8062562b1ade70eeed2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687682853, "uuid": "6a2ba676-ef3f-4d9c-a105-5131be79891a", "comment": "Malware payload (Mirai)", "value": "936eb6dbadcd640542a0d92b030c74b43e09807a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687682853, "uuid": "3d9548a0-ba65-43b3-a6da-9ed861247130", "comment": "Malware payload (Mirai)", "value": "a621f93df55f6654cf8f5151a0f7ae9cd904ac1618970f18181a227e6f4993740b3f223d19a2a5bbb5f7511bc6e9762d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687682853, "uuid": "80213381-03d7-43d5-bf35-757c859dbce3", "value": "T17643A6196E229FEDF76C873047B78A21A75823D227E1C6C5D65CD9106E3024E742FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687682853, "uuid": "10c9fd64-b915-4181-af3f-ce2e771e31f3", "value": "1536:XxzsJiM0oiHffAT7gVaj4vZux7/ADiBcCt3cZ+:sf7gVaj4vZuOuBc8sZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687682853, "uuid": "b67eae31-3b28-42b9-ba6e-934625731a5c", "value": 60540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687682853, "uuid": "aa0c204f-41d6-49de-9266-deefc519ec31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687682853, "uuid": "234f6ee3-7ca9-4f28-813c-2e84ade7f97f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c00bcd-1394-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687724104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687724104, "uuid": "c4ca67c5-168e-4c5e-acc3-b37d49ab9d2c", "comment": "Malware payload", "value": "f72680b026ebf1cf175897c0ec669341", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687724104, "uuid": "1a122bad-4814-4e68-91a7-73d95b86729c", "comment": "Malware payload", "value": "a5ff470309ffbf1a057b60eaf91883b56f0b11a4e76249d71ce2ab41896fb55a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687724104, "uuid": "dc9b5bed-9280-4762-92fe-4638928e5cfe", "comment": "Malware payload", "value": "9b5301aaa364a201bc24c528392232a143730bcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687724104, "uuid": "2a9dfbca-7f99-4152-b49b-dd0424ada1e9", "comment": "Malware payload", "value": "7db9db0d37eed2c0b4169db322f64c7ea37b57eb9ac41e5ae6b5d4fe429345d7c327e68f195c9982ca46d5540cc1aa3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687724104, "uuid": "d5cb18c1-57a5-4177-b7ac-2617b65bfa7e", "value": "T15C35D000B4D28072D572253205E4EBB65A7EB9314BA58AEF67D00F7E5F307C19731AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687724104, "uuid": "5a21d7f1-030e-46ec-b76e-1fd5becf64ff", "value": "1e5efd483892326cc4eeb97bc14a6266", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687724104, "uuid": "68537296-f962-44d0-a16e-11763171be10", "value": "6144:LFemHLrfcF4e48Fzo6DHH/AOAvh7PargxvCH1/OwtFvM+PUoSd/icr++aUNi:LsmzcF4X8fyIKvuOwtR9PXSd/iybNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687724104, "uuid": "6dfbb046-d8c1-4fde-b0b5-f170d544f55a", "value": 1108480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687724104, "uuid": "9107724c-df5a-41a9-ac4d-1406ba1f6fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687724104, "uuid": "f1c969fa-aab2-4923-b146-19c9c5832747", "value": "f72680b026ebf1cf175897c0ec669341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b87feb0-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678770, "uuid": "c78b87c5-b930-4c1e-a7a6-232fed6ab775", "comment": "Malware payload", "value": "84c9aff3def393001920b3fef66f3e80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678770, "uuid": "1c7036dd-e229-4998-ab77-a2d524bbb6c4", "comment": "Malware payload", "value": "a7cc83ed15ec456788b60419e06bcc92e18f0a42a88239ede8b94cb754d3dc94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678770, "uuid": "c8b3cb8a-df9b-451e-ae74-61cc6c473273", "comment": "Malware payload", "value": "1c30ff7115e35d52d1d33116ebece92740eeb479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678770, "uuid": "5bc8f132-05d8-4fe5-83ea-e18c2adf8169", "comment": "Malware payload", "value": "5489e75ad239398db78a4521816658516c13a5ace1223f623a8aba011f0079f42c15578ffeddbfeb630df110f7bba9b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678770, "uuid": "568a18c4-9841-46a4-aad6-2a2d9545969f", "value": "T1FAF5127A3658CD73EBCB7790D2E4516FC9112601EAEF589CA9331CEE39B8DB1C055A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678770, "uuid": "4586860a-3a87-4218-af83-5319d51afe1f", "value": "98304:Tw8ZfLrBksE1c+czPq4ut29pNztunFF7LmZZSF1:TwwfLrBks+SP3p9tunFF7ic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678770, "uuid": "79da21e8-e02f-489b-a1e2-d4b3ef988a83", "value": 3342640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678770, "uuid": "49cc9ed5-81bb-4ed7-b0dd-ee5838810e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678770, "uuid": "d146a4c3-acf9-4016-b4e6-c7f755226e77", "value": "84c9aff3def393001920b3fef66f3e80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff342a5b-1364-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687703499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703499, "uuid": "8900f0b1-bd4d-4f37-b7d9-c1ad8c48b97e", "comment": "Malware payload (RedLineStealer)", "value": "0a8dda5c8e9a46c11b53f30c317d9abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703499, "uuid": "f4f3ed92-b122-4e1a-a9b7-54b7d3c0195c", "comment": "Malware payload (RedLineStealer)", "value": "a821582e2c537914b2f0dc4098e2e602bd8f8c7c8e42924104db6d6399f10865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703499, "uuid": "d9e5ef03-f1d6-4858-bd20-a6627c30ad48", "comment": "Malware payload (RedLineStealer)", "value": "095e0dd12d6e5380af76c85db433c695d7298043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703499, "uuid": "4699a9e9-16f6-473e-9b02-34dc157189bd", "comment": "Malware payload (RedLineStealer)", "value": "e544add811bf5665bc4cd4b4a6356bd7e102a5310e85af64632f24523ee0a9446ab3da9d06107748e6ba1c6a6bae6cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703499, "uuid": "07f799f7-2c74-44b9-afce-0f1f2f2250d4", "value": "T1021612361154E5B6E3D7CB77C703E82C5E6920BA399F344A2B950DDA2C672BCE533809", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703499, "uuid": "e7211611-2b76-4b84-88a6-6e8d258e76dd", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703499, "uuid": "25edf92b-f013-416f-84a2-b145186c77aa", "value": "98304:IfglrRZXrEsmqkm4ClOMsgGx6KSmuihOBGHIvjLxMKdhHK2bDRIq0dqL:FhRZXrNm5Fg06KiBGHIvjLxM+KsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687703499, "uuid": "af2e1793-fad0-4cbc-b7d7-35ff0f3758a5", "value": 4128768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687703499, "uuid": "097d7f63-0476-47c0-b2ce-9eaa88a23e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703499, "uuid": "ef787791-ef5e-485b-aa22-c2606876092e", "value": "SecuriteInfo.com.Variant.Lazy.355257.21226.17658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c432f972-139b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687727022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727022, "uuid": "4c59ac51-353d-4eee-988a-e344e012c39c", "comment": "Malware payload", "value": "59acb21b05a16c08ade1ec50571ba5d4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xhelper", "colour": "#81FBE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727022, "uuid": "b9d0f8ce-1442-4546-afd2-47ad1504b511", "comment": "Malware payload", "value": "a860621ca11cd660118a4127c12e91b64f3dca7caea137b2a15b39001184b203", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xhelper", "colour": "#81FBE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727022, "uuid": "2823c567-3ffe-48d4-849b-70d29fdc9d1d", "comment": "Malware payload", "value": "f699d868943fda3bbf989c97d5fb0fb35e6b7020", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xhelper", "colour": "#81FBE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727022, "uuid": "e073e05a-694b-4c61-9e93-c51c468adcfc", "comment": "Malware payload", "value": "323db74bf3ad3dc04d5a7f2543e149cd17386c559cb92012d5359da5dc66714fe1cf9949e1e48c8d4c490dff18bb9e6b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xhelper", "colour": "#81FBE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727022, "uuid": "0490c5b9-e0cd-4e3b-8320-9d3c044f0f1b", "value": "T18695F182F758A82FC4B7C4364EB6073A51568C4ACA42E7134569B32CBCBBAD04F95FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727022, "uuid": "0a7e993b-90da-4606-a13d-acf1cc4b5dda", "value": "49152:TgvGeDUhVJjA6iHupKfDTv1JdKIuLRhO4:BeDUPJcdZ8c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687727022, "uuid": "77193af7-8fc3-46aa-b41c-5a51e73cc1b9", "value": 2057931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687727022, "uuid": "42c287b8-c321-42e4-8d23-5a4e76e1378e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727022, "uuid": "39fe0d7c-5fc1-4c45-ae14-e23842ac7605", "value": "Firewey.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b558c97c-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678464, "uuid": "0d1322d6-9ec6-40d5-a4c4-6bb59bb477ab", "comment": "Malware payload", "value": "8517233f5a806a16aae2269118209f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678464, "uuid": "a8e08bc5-5f26-458c-9824-973562bb3c06", "comment": "Malware payload", "value": "a9a4c3e4188fd0c6c1c9190edcc6261f9646d72160ab92a973f72f6565571933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678464, "uuid": "074b8b7f-0a70-477e-bba6-76e21103e978", "comment": "Malware payload", "value": "24cd5d5fc904910312708488220c7debbedb0959", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678464, "uuid": "3f471a88-c8a3-485f-8e9c-a9d0a05bdbf9", "comment": "Malware payload", "value": "abfde4b0675903fcceca8b01870ec176d484ce0960ff89b7baa6b20f717fb86b0c76cf6c24ba4ae5b75a3f2344133eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678464, "uuid": "798d3894-5f96-45d1-b7a4-4b1ab97a5c8a", "value": "T17E263349E84ED045E10453B6C163B7BBE02CFDAC1C1AFAB2A5D93CCCB367AD1A64C549", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678464, "uuid": "8b86b48d-b290-4812-bd27-1010f1c233f7", "value": "63d926bab4649641f492888f61234125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678464, "uuid": "afcad61a-9de2-4a8a-951b-6fd484e5bbd1", "value": "98304:AFehg/MMbKe+xZ0t6TiamCe2VhmmtPTf1rxDxwq7kuFNoCEiZ:OCgJX+8PC7VEm1DzhAuFNoCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678464, "uuid": "ae9f2c46-1d37-4952-aa85-3089f1e51d82", "value": 4783642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678464, "uuid": "781e52db-ec04-4354-822f-3cd25f89ec2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678464, "uuid": "f8f17ab0-31a2-4302-ad54-1fc27869157f", "value": "8517233f5a806a16aae2269118209f0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1ae268-131a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687671550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687671550, "uuid": "8e2148b3-4fa2-4c73-a88f-75e1fae826b6", "comment": "Malware payload (GCleaner)", "value": "eba9531805b1577ae2a8911bcc6d2b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687671550, "uuid": "1cb3099d-afb5-453e-b1c9-9162a27aa7ec", "comment": "Malware payload (GCleaner)", "value": "a9d91b57e0d37b08b87d1f616b937ee756c6e006e3e8a0de21c8eab981e921d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687671550, "uuid": "207897bc-cbc2-47e0-ac99-bff49f748888", "comment": "Malware payload (GCleaner)", "value": "ab354a9b2b09f18e7b40f4f47025256148d9f788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687671550, "uuid": "c5f287da-aaa6-4836-9354-852ee995f993", "comment": "Malware payload (GCleaner)", "value": "28addce10f95c5578420df34a93fd8f117ad88760ba3ff8be6b7b818b06dacefa1ac66f9ac6cc82c99bcff678c6b630e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687671550, "uuid": "34e11d26-fc0c-4fb7-b5bf-1f10f0e414da", "value": "T1F1A512118B7CFA10C6D84CF6AF9154CDF134DA742BAF41AAACFBE50BE4B95503D2A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687671550, "uuid": "76661f68-674c-43ce-a3f8-833b74ac0890", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687671550, "uuid": "f0fb9a09-1a85-4afd-84f7-367be3e24191", "value": "49152:7GYPVIfenY4Y5Kqmoz3iAOUpqi6EGfBJZtgQS6fN6O:CYKb4YkdsstE0BJQwYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687671550, "uuid": "3ca140c4-f695-4389-a87d-a0ef2b68b12f", "value": 2132213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687671550, "uuid": "181bc209-cd97-4f2c-81a5-b27670fd9c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687671550, "uuid": "86eb5839-66dd-4adb-a4f1-40d49c98c560", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5198ec6-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676289, "uuid": "4bd13537-0dcb-42e1-9621-32a6455dbf69", "comment": "Malware payload", "value": "c81ef523de007ece62c23225867ff7df", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676289, "uuid": "0f49385f-3864-4146-8dbd-a1267e5ac217", "comment": "Malware payload", "value": "abcc4dab4e168ac53ed4855beb460142453ccef3cad74c1c7394bc90f258f7a3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676289, "uuid": "ac2f68e0-9545-4d21-b795-e5761c25448d", "comment": "Malware payload", "value": "aaf56c64f2bdd47f104d272e2599687d16512979", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676289, "uuid": "8b87330a-8392-486c-b8f4-de7e98c9ed22", "comment": "Malware payload", "value": "c3453f9887f6c25fcc0775cc6961b4405b7728399cffb93a19f0bfe8f5d828fdb75d0415113355f17b38925c8371bdc1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676289, "uuid": "d69c24f2-956c-46d9-aca8-4ffdbb500a65", "value": "T12674E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676289, "uuid": "b3f42d03-da62-4cd6-8c42-c9c7c0f70c0a", "value": "6144:Nkzpkc86ueZHV56NwBAGhQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBrCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676289, "uuid": "e5010af8-6f61-490c-b645-7e41050a1c57", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676289, "uuid": "492f5bfc-e02f-4801-ba62-74a79cae94f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676289, "uuid": "aef8e9f5-450f-4612-aaf2-63175adb0f2d", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce75ad2e-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678506, "uuid": "3cac7cd9-6cb8-4d8b-897e-b870c41c134f", "comment": "Malware payload", "value": "91ce7e8d4d67f69273534cf8366b736b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678506, "uuid": "35da99ca-f5dd-4ffd-a11d-4bd924884bd6", "comment": "Malware payload", "value": "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678506, "uuid": "308b1df9-3747-4747-bc29-f4e6fa737365", "comment": "Malware payload", "value": "3c8d3dd4ddf2525a8c18e7210aface9040240f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678506, "uuid": "9dd60f03-a7aa-4303-8ae5-a4c989dd6039", "comment": "Malware payload", "value": "057c5771ae8b8ba1fa5072f4c8e8d4da657b75acf57dc436d940f5c54958ebe8404f3769b93407defd39ef75105d9c35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678506, "uuid": "8890b662-cf1d-412c-938b-019344f3e30d", "value": "T1C0F53329EAAA0EE7EE7B687C434314FD3173A9C00046DD32331D1DA48D2B59BD49CDA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678506, "uuid": "549cbc4b-f251-4823-b7a3-6ea31c699739", "value": "98304:XRbj92scwqfy6aBXjDtqFSRfBl0GoNjgwDY7SICUFjl:V92sc3fyjagcVuNHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678506, "uuid": "9e80b4c3-6eb2-4468-8377-665a32c08bc3", "value": 3538433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678506, "uuid": "5a13daee-c4c0-4722-a80b-b90478b6da49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678506, "uuid": "3eaee1be-61fe-4360-82d1-39c65108572f", "value": "91ce7e8d4d67f69273534cf8366b736b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f065290-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678346, "uuid": "fd29394f-7072-4848-b7bb-f2c2916f2506", "comment": "Malware payload", "value": "a6b535149ded669d4fa4cd8632708a8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678346, "uuid": "d6013e46-03b9-4f5e-aa65-d3ea1c57730f", "comment": "Malware payload", "value": "ae188a4379fc8fa9e3be9bdc167f927de4473c89136be68892e18b23aba8ff0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678346, "uuid": "35975370-6a50-42f6-98d4-76f8e29a4be2", "comment": "Malware payload", "value": "42d97eeeed5afed2035294b198d534f2ab7034e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678346, "uuid": "54f7c217-dd20-4cee-829d-44f63520161b", "comment": "Malware payload", "value": "7e8ee61f7112fe996bcd144d3eb499e4b380f564b3c678b5cc48e7e030be2b7de69c444a87e3d10efda218b13059abdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678346, "uuid": "9d15bd16-22eb-4a4f-bb4a-2ae11f159bfe", "value": "T12AB512BD62480D73D90B7790E4D1826FCD113A82EAE3985C9A375CEF38BCDB1D565A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678346, "uuid": "95a2874e-52e4-4be0-a8f1-2436652b69f3", "value": "24576:ch3suMFbaSN340uRsmcqpNngQGWB4BPcT4JHvr/ITawih08BZJquaUZSDg1n/Fi5:BNecq3YOs4jxT0hYHfiuGO/Z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678346, "uuid": "7d4251d7-6cf7-432e-89db-3b5df0634b78", "value": 2308776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678346, "uuid": "9a7d66da-947f-4d70-9a98-c55773d9fb7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678346, "uuid": "4d4b3b74-cbe4-484f-b79b-a0f49d1dbe0b", "value": "a6b535149ded669d4fa4cd8632708a8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9c5ead-134c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687692920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692920, "uuid": "f152000d-37cd-4239-bef0-02798b5cf18c", "comment": "Malware payload (RedLineStealer)", "value": "3a4d241ee599d7b89962825189d49e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692920, "uuid": "d085354c-c86e-440a-b3a1-cbb6742047d2", "comment": "Malware payload (RedLineStealer)", "value": "ae7d582d47040a7f4c5f54b2a6968e15ff6f32d09a68ec79d3c99201c8758260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692920, "uuid": "08fb001a-c841-44d9-ab5a-5654d6d09135", "comment": "Malware payload (RedLineStealer)", "value": "d143e2c9757b35b9bca877e293729c395cbc5a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692920, "uuid": "9c1217d0-76aa-4b87-a3e9-80215a79d47f", "comment": "Malware payload (RedLineStealer)", "value": "740875c86c5a9bf064542f7c036a5e1df95776302c82f86ac99629650cccdfe27714e2d85a7c708ef70db22251322322", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692920, "uuid": "83171a7a-b745-4daf-92e6-6d0aee675265", "value": "T1D70611361E66C1B5E3C3CB34DB93C46D4E6825BD3AAFB4842B9A0C85756F52CD233A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692920, "uuid": "6db81d4c-9075-4726-aae7-71fa5f6da263", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692920, "uuid": "1b091def-b089-4616-81e6-54bfd206de38", "value": "98304:qT0aarD2XBqe7bhhSFdcDdI9VNCq6xuAb+XHBtjTa0O1ElG8sYm5:w0VDUfyWBI9VBXzTN7lG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687692920, "uuid": "896f60a4-b5c9-4dc4-82e1-2c38ce053e41", "value": 3791872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687692920, "uuid": "28b6f602-39c1-4077-ad3a-2a4083b6acd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692920, "uuid": "97cfe1d1-8537-4b79-8484-4a7aee58ca7b", "value": "SecuriteInfo.com.Variant.Lazy.355257.2789.11511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f022a821-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687717647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717647, "uuid": "5870e7a3-ba83-4f8e-98ba-eb4896f8ff0a", "comment": "Malware payload", "value": "4995d2312abda72cd95f3833f6f3da78", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717647, "uuid": "a5496c1b-0ff7-4a1d-a172-dfb638e32539", "comment": "Malware payload", "value": "af07690d2b96e869fe625ddbaa6f62535ef4e5df4a7176c18e004b3971a11916", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717647, "uuid": "886ad765-df27-4ea1-a6f0-2e9861116ced", "comment": "Malware payload", "value": "6c06dda908f113f152b4f737ccf9d1f88b3196d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717647, "uuid": "d8547c6b-88da-4bfa-becf-e8e739d1ac21", "comment": "Malware payload", "value": "0d6f23eb9f26bb0fc9d21bb754d05641fa536356a09025451c1c02a0a2213968b8b8d34b151604a0d66524057f266d63", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717647, "uuid": "d40086c4-c95e-4f2f-a0ab-fb4d5d85d88b", "value": "T139E3AED333C4CD66D23A21BA2C57C66692317D9AE5B2871B7BC1B70F4D32B844D216CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717647, "uuid": "2c19384e-427c-49d3-9d03-9ff2231f2623", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717647, "uuid": "a776cb11-1a3b-409c-9b90-b046eecd4a76", "value": "3072:DlGajUsmdaicl+5gX53r3p2F/TXIm2CMqUTxur/f619:3jUJx5m3r5WUqUTxum19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717647, "uuid": "7e8ab8f9-b050-4551-a019-d16e80dc9f0f", "value": 143382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717647, "uuid": "eae0e892-6bca-4709-9a6c-99b2b88f7c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717647, "uuid": "cfef1484-60d5-4e10-a736-4978344abf80", "value": "SecuriteInfo.com.Trojan.MSIL.MPRESS.24941.4330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74dbb5c-1375-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687710653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687710653, "uuid": "11822aa4-618b-454d-86a8-50d31595afa4", "comment": "Malware payload (RedLineStealer)", "value": "952137968e363a9c398d16d2ace41b1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687710653, "uuid": "9241ad7b-3dd9-4359-b134-e3fe6c2e1200", "comment": "Malware payload (RedLineStealer)", "value": "b258407b7af95088da27c5f2894b25349069e673f44e78f923d6bfbf061e31df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687710653, "uuid": "ca1acd0b-ce46-4f55-934b-1e475f2863a2", "comment": "Malware payload (RedLineStealer)", "value": "fad7d64861489593f960153623bae3346b1652ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687710653, "uuid": "c978ae9d-30eb-43ac-8247-2663b73fae6a", "comment": "Malware payload (RedLineStealer)", "value": "50e71bab8d84c8b421f5076b029cbc81eb3f811b827c603876775af7735850868aae066b4dbcdc064b21f61fbf8b0103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687710653, "uuid": "7a95e825-8232-4c30-8cac-c22d829148d3", "value": "T1571612321564D2B4E3D3CB7BD303E42D4EA924B9399F78862B914CD52CA72BDD17381A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687710653, "uuid": "54971099-058e-4676-96c2-dc9248fd83e4", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687710653, "uuid": "fc77d080-3b60-40f1-9a2b-9c047067b71e", "value": "98304:oULk5jYVa6qrUFvvQDxSXExsKozMg8koWnqcsIntI0/xEAY0+VCq3W/RKdkBabdp:Q5MVa6nvQE0C8koWnqcFdqAY0+0q3W/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687710653, "uuid": "58b5c51a-07ec-4fc0-9346-a5e30e231d32", "value": 4107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687710653, "uuid": "3442e85e-6fa3-40ff-b900-277f433c2485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687710653, "uuid": "78d3ea6a-9cd0-4097-9bb4-ea89d909a8b6", "value": "SecuriteInfo.com.Variant.Lazy.355257.508.21448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be43765-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678609, "uuid": "22ab4dd4-6bf7-4417-aa23-56e7720caed9", "comment": "Malware payload", "value": "6fd3cb85d6c89e2e432e079d012d3178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678609, "uuid": "6e8d947e-35a3-434b-9a1a-6b6b9bce8ec6", "comment": "Malware payload", "value": "b2bbe1c640d142a5a7f4e84e6a733dc268b58c90eaf1306ce734865b4713d3ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678609, "uuid": "0aca60f8-b7f1-4805-8b0e-f9efda98690a", "comment": "Malware payload", "value": "1ffcc04131c26ac8b04b0bd303a2618b9461d335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678609, "uuid": "b85e447b-3c83-4c54-84bf-2da32c317429", "comment": "Malware payload", "value": "de8e0b89365636d999eb29f30b01a794c615f35ef238517081279f76627e1a1ab9187e4b3dc0d849ae6de5cf1be5b990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678609, "uuid": "b0dd52f8-7a75-4656-89c1-338234bfdafa", "value": "T1506612320532BDFE876C389494052B492CED5C235359DFACFA4414EF29A1738AA7F9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678609, "uuid": "006c62df-46b4-4c69-a93e-481989c1f76e", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6b:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678609, "uuid": "5b9d76f5-251e-401b-93e3-b55957aea785", "value": 6750031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678609, "uuid": "2b0992e6-88ac-405c-aeee-68453aadcb16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678609, "uuid": "2007ccee-273f-4363-9e5f-21cd2255eedf", "value": "6fd3cb85d6c89e2e432e079d012d3178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b400c3f9-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678891, "uuid": "67435b64-c480-4c6f-87e2-bef5073008c2", "comment": "Malware payload", "value": "a184207c11735d200b92dab190bcfdfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678891, "uuid": "a1e6df04-a76c-4337-80de-ecb00d8f97be", "comment": "Malware payload", "value": "b36d52d06cadfa7a2a60e56e783bc6ca26a30b3769762ec0659c016b0f52dd57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678891, "uuid": "bbfc11e3-8d96-4cd9-a28e-9f87c11ae3a1", "comment": "Malware payload", "value": "7b2cbc85b53f063151890f2784dd72e27b379a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678891, "uuid": "20bad5bf-a9b9-426c-96ac-e109f59cacb9", "comment": "Malware payload", "value": "a4ef51398033e8c25f92b24c0a6175b3886d65d5f6291a8eabe88296a5367a41d2ad1964e22c31ab9ed57cd656d954f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678891, "uuid": "4c7437a8-65d8-4fdb-85b5-5bcbcb59db0c", "value": "T1D265F19B3988C177D9641531E1EFC3235E197AB1061FB88FAB270A3BDA635ACD43E444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678891, "uuid": "2b4fbd6b-cb6e-449e-ba21-de2d5460cf2a", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678891, "uuid": "d7da8e8b-f6df-4b65-858f-e80eef1ea7a8", "value": "24576:yHJI4g+aH/hY1wfvW6asX/LrI4+Z241F+CwWp3LbtzyhOVoPQ8ImxXyOczK+ibF1:yHi4bafRFDsxX+CRLp2hOgNJ4qPP/C+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678891, "uuid": "57ccc7c4-a7bf-4dd1-a7e8-e0c3b2ebe36b", "value": 1447936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678891, "uuid": "e49108fa-4ed0-4476-851a-57f2afa4a2e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678891, "uuid": "94da4f0e-a2c6-449b-8420-3f455416d933", "value": "a184207c11735d200b92dab190bcfdfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8b6e8d-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687717643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717643, "uuid": "06de6133-8b33-4855-8bcf-9cda85b3a628", "comment": "Malware payload", "value": "5b5d503651bab28a3e399b04541871d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717643, "uuid": "97c6c7a2-567e-49f5-aeb0-4a309922a5a8", "comment": "Malware payload", "value": "b55fd455a36e3c190604f5b06b9045cb411400a04902a50bf833490352ac3567", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717643, "uuid": "2f1b5f2e-bf99-4bec-a4e0-75131a63c51c", "comment": "Malware payload", "value": "9ac379966e583f59bdca817cc9cdcb9e972b0927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717643, "uuid": "9ec3f88d-de34-4cdd-bba5-a198998aa53f", "comment": "Malware payload", "value": "2b78a56017cac968ebe4ccc6b36d47377aa4936d58c46655270116acada3934e0cd52904af141ce2d3888eb4a2640d95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717643, "uuid": "87d996f8-006e-4847-9d7d-9ee9ce478560", "value": "T1E6C1F0E753085DB4D1F0057154C7AB07BDB9AC206B7372028F61BD4EAC397487828AAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717643, "uuid": "85e39743-4e83-412b-a3bf-52c08b3a9031", "value": "ae34c05cd079a5f0bd4cc8743d72dbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717643, "uuid": "3979a62a-3a8a-4d4e-b29f-766770f1fd26", "value": "24:OEhu70Uc9/PGoatR2kpqAmTBcRvv87xpMpZZN2lJ10YsEiJS6ySUnUTLp:OEPXG7tcdBgvv8NUvCJ10YgTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717643, "uuid": "5f9ac179-b201-43aa-857b-437b056e1815", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717643, "uuid": "6bc07c67-1f72-4469-b4fb-45ddda9bdba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717643, "uuid": "3e17b11c-ca42-4e19-a58f-edf83c8c5195", "value": "SecuriteInfo.com.Trojan.Wacatac.32149.16388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b8c2be-139b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687727075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727075, "uuid": "9d196dbd-c07c-42c5-9793-b7bf297ab0c2", "comment": "Malware payload", "value": "4ee88295d65b7a6e566d200a1c842801", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727075, "uuid": "54b22e3b-9a70-4d7e-bbc1-421a395c37ee", "comment": "Malware payload", "value": "b93b9b4b0168407f63a6c2c16a96e4a4b41d5d715bdb9f46254a214570ba1b6b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727075, "uuid": "1c2113b6-5864-4a3d-962a-39bc07973522", "comment": "Malware payload", "value": "5dfb320e933425cea8188f8f7dab346796c3b090", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727075, "uuid": "40fd61c3-03ce-45e0-a46c-641b1d28e512", "comment": "Malware payload", "value": "deae0ac5d32f864bc9b9543b115be4e45a617ad44e7b3a8161114f1a161595b685e10fe09990455b7a406553d6bea996", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727075, "uuid": "2e6c7728-aa8f-4120-8dfe-d7d28bb164bc", "value": "T13265E033BA8A5DB0E38F2736D4AB04416FB4E582725BD70FB54A139A2C0376E951335B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727075, "uuid": "9d00fc04-2e93-4082-8f81-6d27ba212acb", "value": "24576:ZzwYWydodaTT0DGLxDoNEop5N+cEzJz2KBTDL+jfloYhbhi:6FydodaTT0SxcXp5KzQkWj9oEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687727075, "uuid": "ad3d3a5e-2f12-487f-8aac-38993b5e0314", "value": 1464832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687727075, "uuid": "87a9678b-fede-4ef2-b21f-e7a7067c755a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727075, "uuid": "7b52d167-e539-4641-a7d0-25fbc5a1d93a", "value": "4ee88295d65b7a6e566d200a1c842801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09a7607-1324-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687675987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675987, "uuid": "a182004e-1917-4160-b5fd-54d0d4b8149c", "comment": "Malware payload (Amadey)", "value": "835c29165e9dce36a4c7ec3afbe27e45", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675987, "uuid": "46c2e2ee-b485-4a56-94c3-6a0a83f007ec", "comment": "Malware payload (Amadey)", "value": "ba20a6ca3a2520503fa1f80b41505febc4fbbb72082f0fcbe4fe36796dccca50", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675987, "uuid": "6f19f486-9f74-4252-9e76-7f567aa9c05d", "comment": "Malware payload (Amadey)", "value": "3dd208940c4e7c7dcb1cb94155e93cc621cd8542", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687675987, "uuid": "d6ae1a25-f0e2-47b9-81d0-919750c05224", "comment": "Malware payload (Amadey)", "value": "84cad7898198e6e0c73fb8b4d88311ba3bc1f950b40f37d64ce359d7fb105254309d6f64164ece53d8a35a53e8a674b8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675987, "uuid": "93dab707-b926-4d3a-8613-f20de56e8a8c", "value": "T1F946338ED4F5539165B7718FD1BFC2BC31006A6DB81061919382981379FB5BA3923ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675987, "uuid": "be83c699-ca22-46bf-a4d9-5cede4a33aea", "value": "98304:zrw58VHk1vmpj2U6VetgcSIEHm/wdCFUIEdS1LaqpjKqR+n6pcEH:I58VHk1vgj2U6VoM7HzkFUIZLxKas6iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687675987, "uuid": "7da17bfb-7a1c-40e0-8a6b-36a604744e22", "value": 5397331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687675987, "uuid": "da0b6ea8-8651-4ee4-8319-c7d9df7ef3d4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687675987, "uuid": "5ba9da20-170e-4979-9f86-97cd7f5486b2", "value": "835c29165e9dce36a4c7ec3afbe27e45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64aab7c3-1345-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687689925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687689925, "uuid": "cc72493a-0644-462a-9610-30f04359af83", "comment": "Malware payload (RedLineStealer)", "value": "d0ffd6d9d7374cf811db5297268918ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687689925, "uuid": "ef646365-1499-4b22-9798-55057109c9ed", "comment": "Malware payload (RedLineStealer)", "value": "ba57d356a1d70060f8bbaee2c4db56ef7ac1fa016da80b5ef370b9e4ed6a8f22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687689925, "uuid": "83d3dee3-1bfb-49c2-85ec-0d85d2e601e1", "comment": "Malware payload (RedLineStealer)", "value": "b5cffb439a92bcf0e86a96d02d02809b3a6f76be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687689925, "uuid": "7c41e097-c851-4e05-bdb2-a23c7c19d7eb", "comment": "Malware payload (RedLineStealer)", "value": "cd29e74f2227ba76b6aca82810b79b393ba54aa5699599f055d8da63d761f689f4872262ff511506e117bf0e3cdac200", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687689925, "uuid": "f44c15ce-865e-4e43-aae3-54f06f5bca14", "value": "T1BE0612366E2AD5B5E3C3DB34CB93C02D1E2856B8359FB5802B554D8A756F8ACC233D24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687689925, "uuid": "250e0ade-e375-4347-bacb-9bc2e5919033", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687689925, "uuid": "d75a9316-9cb7-435c-9b15-c9407d68643c", "value": "98304:3ECqxvcq4E/uTWrlReOJsDrYFVj5CJvdoFUBBvZazBS94uB6zJWr95YcyrtUJYzc:3ECqxCTQliYbMJ9QlSmu0JCPitI3AkZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687689925, "uuid": "d28d8ae8-1a41-43e4-950f-50e3856626a7", "value": 3752960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687689925, "uuid": "92994c73-152e-41a0-ace5-adfcc48e06d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687689925, "uuid": "ea717d6f-db1c-44e0-90cd-a2acbd9ffabe", "value": "d0ffd6d9d7374cf811db5297268918ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f127da-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678980, "uuid": "f5c6e28b-1003-400b-a5b6-71188ea60597", "comment": "Malware payload", "value": "f2e8c09276c3eb00c0b9bf31d7ac7e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678980, "uuid": "4e28ffea-776b-471d-a0da-5f6b8522937b", "comment": "Malware payload", "value": "bdad8d84805cb5eb3dab2fea02cc74d4bdf8748e43331f80f23a7ce38b49df60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678980, "uuid": "da3dccdf-e1ac-4fd3-99fb-c0f22e1d63a4", "comment": "Malware payload", "value": "0b570bc503c5c01eeeb688ceb92e4f78204ddbf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678980, "uuid": "9abeb2d9-a234-406b-bb4c-3f7cb818a77d", "comment": "Malware payload", "value": "cd34e55ab11707f4aa16d4359ce84adc3d49ec0ddec4af094eefd6caf01aa9b6ec95954419b88b9bc46ccf55f20072d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678980, "uuid": "331f460b-9a2c-495f-b1b1-367fb4caba3a", "value": "T15FC522B82611E6BB53C32472E490211F0C153992FBEF899879C3CDEB64646B8C8F5BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678980, "uuid": "537b058e-fc9d-4fac-95e5-3ccdfc00518e", "value": "49152:grYmvVAX3WVIUZvEU5Av0DfVRTP0B8RjjMBIBYRk:iYm90mVIUZvEU5U0DfVRTsyRjjMBI6Rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678980, "uuid": "801405a4-aba4-40f8-b05e-430562ea0e2b", "value": 2549729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678980, "uuid": "9f62363b-eda5-4f50-89f9-a9555a1e79de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678980, "uuid": "14019708-1180-4f16-b923-372533049d32", "value": "f2e8c09276c3eb00c0b9bf31d7ac7e16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5876c88f-1361-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687701931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687701931, "uuid": "fdb56e16-f374-4edc-bdd4-63567980f027", "comment": "Malware payload (RedLineStealer)", "value": "27aa37038417968bfb25e885cc3b6033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687701931, "uuid": "6b49e70f-70bc-47f0-9b44-42477a8589ba", "comment": "Malware payload (RedLineStealer)", "value": "bdde994fe587b44726e44161dcd292e5f7b95602f097603a2f390bb3e201c3a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687701931, "uuid": "3a025537-3131-4690-af4f-fee28538738f", "comment": "Malware payload (RedLineStealer)", "value": "19d909f5b1b7fbcb3dc6d648119c4e47af81f915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687701931, "uuid": "67e91de6-85b5-4fe9-9afc-9ed5a2e8b5b6", "comment": "Malware payload (RedLineStealer)", "value": "def1d0474ab759fba83a9b2640bb4935469fcc9eda80941f40ea7b9ea6eb812a9b405320886a3559a468845ceb0c5370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687701931, "uuid": "144b6479-05c1-4aa8-9ff6-e5e7dca6a54f", "value": "T16C85230134E1E6F3C4B21434C9F88AE4577971155B728EEFBB2E5AA26F913E0B2351C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687701931, "uuid": "24e50210-d919-40a1-933b-61617671fff5", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687701931, "uuid": "8ea4ea20-b3fb-4cdf-9de6-91c629fec1a0", "value": "49152:/kQTAXz5TYiJMFpOZ+neyqtik4fFNbY1TyZ3pWUDT6:/ajrJMFK+eRMnYFyBpWiT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687701931, "uuid": "053da573-b516-40b3-a943-2d7654e92208", "value": 1860064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687701931, "uuid": "a742984a-4af5-4c8d-a45e-ac31ceb427f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687701931, "uuid": "43414ddc-15f2-4924-8ac7-14573ccf9263", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629c3a1d-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687676178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676178, "uuid": "fb4a7760-36e4-4fc5-85e2-22730aba0fa6", "comment": "Malware payload (GCleaner)", "value": "6459c785ebaa89f9800ee8de5d510409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676178, "uuid": "136ad99f-3df6-4adb-a7d3-8183bded7b29", "comment": "Malware payload (GCleaner)", "value": "bff71d788c2cbc2f3c34e15b809ee5fb0aa42db5bdb03dfef10e2a290eca645a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676178, "uuid": "bab27b68-e9e4-426c-a7f0-fff4d7f50580", "comment": "Malware payload (GCleaner)", "value": "1fb8281996188c8f4efb105d518f066eb5e2c8fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676178, "uuid": "34eaa6b7-53cd-44ea-bbcf-7ef153a8904b", "comment": "Malware payload (GCleaner)", "value": "1efb4ad57ccb67ef18b208df83e88482786c690b46a5dcd412926d067c2d8f47b44fc513154d82ff8222951a818cad52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676178, "uuid": "888b5cda-f63b-418f-85c4-92db9d461481", "value": "T10254C0D27290B831D9670931BD26CAE57E6FB8204F6937B737582A3F1EB12D19A31341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676178, "uuid": "c6447055-af72-45a3-b405-f339318f317c", "value": "9a21fb86d7cb757e687d836e62cdc05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676178, "uuid": "7e318b19-12b6-4144-be1b-9fe6e5c50179", "value": "6144:K8hCaO26KHyGWpJ/T8t/XTc7jIlUnBZACwGjSLa:KnaO26HGO1QXTKkUBHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676178, "uuid": "a6bb7a29-e7df-4275-8ffc-d5da41d7cb03", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676178, "uuid": "cdb20837-6f3f-41bf-b9e6-70054e4e4168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676178, "uuid": "fe22202d-2891-4512-9d7d-e8e50153d75d", "value": "6459c785ebaa89f9800ee8de5d510409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6195d5-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687678687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678687, "uuid": "7cbe80b3-64e7-416c-b4b9-fdcee0192b1c", "comment": "Malware payload (Smoke Loader)", "value": "803b575609dcf243197d6aca0d43dc15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678687, "uuid": "4e27279e-65d8-4783-b616-f7209882cce2", "comment": "Malware payload (Smoke Loader)", "value": "c413d22d35cdb7d3f9dce3f99d4ec11ac07af420ac33a235acbb13344e56297e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678687, "uuid": "6f655981-f3d4-46fa-9e94-3f5854f4c94f", "comment": "Malware payload (Smoke Loader)", "value": "ca98e29c73c277c28b7984cf3a58bd50f4ddbba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678687, "uuid": "8fc72dc9-ddbf-4faa-8fbd-7cdde56b147a", "comment": "Malware payload (Smoke Loader)", "value": "824a709701d6e66bd1e0e49ded4b21e735b3acec2d858276258b5837b25fe5b400461e912042ad727eda9eb73231805f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678687, "uuid": "56bd60d3-2e80-42f1-af0f-2fb521540e24", "value": "T1A2249DD275D0B471D8630A31BD29CEE43A2EBC214F2826BB27542A2F5EB12E1D57135F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678687, "uuid": "adffff72-30bd-4c0b-9f56-4ef067b431fa", "value": "9a21fb86d7cb757e687d836e62cdc05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678687, "uuid": "6df23d19-973c-4b59-ae5e-f0612ee07f71", "value": "3072:re83fy3NQC7rIOFwTQJryOdAY/0pZnnESqHOZPsPZdiR:J33C7rIOaQJpd50jnE/OZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678687, "uuid": "6bb3da0d-3e3e-4a19-9798-2bd4d2e050c8", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678687, "uuid": "a685e7ff-1478-48ea-abc8-0a9f60c11eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678687, "uuid": "29acd5fb-b984-4841-84de-e7d33d7f484f", "value": "803b575609dcf243197d6aca0d43dc15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7628fab-1348-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687691406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687691406, "uuid": "feabb093-a292-450b-a19c-4e172dd8a8e3", "comment": "Malware payload (Fabookie)", "value": "d76a9b8e3f5c64f27e81543c218327bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687691406, "uuid": "ed0fbb20-cea9-409e-8030-f14f90768dcb", "comment": "Malware payload (Fabookie)", "value": "c8d9d36cfd174f400bca54c388092d3cd03e36d4e4c11368fca86b09bac5cbed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687691406, "uuid": "f1804371-d98b-4bbc-ac42-6590a0790c25", "comment": "Malware payload (Fabookie)", "value": "a1c7ca2caaeb2308639946f60cf500a13beeff4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687691406, "uuid": "fac40b35-ba39-4b1a-a67c-436d8e4aead6", "comment": "Malware payload (Fabookie)", "value": "bd422a04a797d516623c0eb9f0180efbf2ff909af82f1b48ee5b6668efb26ac9d2fe2364644eb9b360c15f9c612ef09f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687691406, "uuid": "2df4fd27-0d2a-4ad0-9ec0-bd386f268aa2", "value": "T158249E1331D3E473D5620631892AC6F43E2EBF254F2B668723182AAF1FB27D19575352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687691406, "uuid": "2f6689a9-96fc-47d4-8eb4-bd480989b99d", "value": "4527c8db200cf9545daac89557b3bc37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687691406, "uuid": "83a0276f-bfc7-437d-9b6c-1733b53ec6d8", "value": "3072:s0t8T8nKrRkTcT1x/oTjZCTiwf0t3dfC+8gOuiRv+nJ+08Mr:0TWTqx/oYzqZCSOD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687691406, "uuid": "99d79fa6-fab8-4cbe-a2ad-bf2f1e09864d", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687691406, "uuid": "514781fe-103d-4a1e-9d26-a1d91854f529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687691406, "uuid": "e59af7ed-bb0d-46b9-8862-325d5e2d5913", "value": "d76a9b8e3f5c64f27e81543c218327bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8edf45-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678562, "uuid": "22db9251-fcd9-48fc-8c65-32ba5a4a1af3", "comment": "Malware payload", "value": "1ab2f2b545a0fc62f9cce6e0e12da578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678562, "uuid": "43b28552-b988-4fd3-b40d-6e621633feda", "comment": "Malware payload", "value": "cb72552001ee910a20ce701f76df4b4e86471e76f633778c910e6ad85741bd33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678562, "uuid": "eb214187-eaef-40d8-b62a-0d9264d00a47", "comment": "Malware payload", "value": "4c360ef5bf902a1fced039ca6d587f94bc193ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678562, "uuid": "c3b23c43-94e2-4dac-92d6-87b68dcb65e6", "comment": "Malware payload", "value": "c570279339ae2cb8b8c0965c36d4d9d03c06f19cf5ebf25de2af9beb14af24a4f6f029847cbd4981759c6f786cef335f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678562, "uuid": "b499be46-56d6-49ea-8ba7-08d856ec2063", "value": "T17BD5123221D8D1B1EBC314B5ED5BB8605CA9F3722A2F70A95F8BDE0A387798CCD50915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678562, "uuid": "9d5460a2-8967-4fa6-9f7e-3ef7718a8c7b", "value": "587a23ee0bccf95906f888e2a3c1c6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678562, "uuid": "82549a71-bff2-4b82-897e-83a7297efc24", "value": "49152:SU1cNbIYB0K6i1j7K4Sj0cwWupBaUrda3bJtglG7WBpFVJc48slUC9RtjF3140U2:SUCNbIYBp6i1XK4Sj0cwWupBaUhSjgl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678562, "uuid": "da29fc65-d19e-4b6a-aa85-fe5090727667", "value": 2992128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678562, "uuid": "e88d5e0b-94f9-4745-9036-cafead00d0ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678562, "uuid": "9bafde67-6108-4345-8fd7-a07003e96f90", "value": "1ab2f2b545a0fc62f9cce6e0e12da578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43d335b-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687717654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717654, "uuid": "f0d236a1-c68b-421a-9e6f-8311a89398bd", "comment": "Malware payload", "value": "0a2b68197050b46639fb20a6e65dc12f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717654, "uuid": "fbb7ae4f-6050-4293-ab71-fa06cffbeeda", "comment": "Malware payload", "value": "cc1e66038225bb9148c3869090fb838f99b0b8bc3b91ae676333150d191b4739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717654, "uuid": "b6ed8b6f-3c53-40ca-a694-83aaf56dc3e9", "comment": "Malware payload", "value": "77c4251d6c2c65c8f2adecfa93d77256cf81cc4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717654, "uuid": "e7562acd-05a0-46bf-b6f8-fdbdc5f6bb5a", "comment": "Malware payload", "value": "6013db74c2d6be0a997ded0871002295a95841972e734c1ee03c115ab60c00a04f40a3e273858fade84a9b5c2fa72404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717654, "uuid": "8931e955-f3e9-4be2-9355-6516511213eb", "value": "T1D4B2C0F6F5480625CE2606715A5B4360BBADF8B53739072B91EB30AB8D54638BC9F0C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717654, "uuid": "221ba0ea-7493-4aef-ae06-43827127be85", "value": "3c0e70bfa5f73f1f1cef484e2bcb5bf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717654, "uuid": "2926f32d-d599-4064-b408-85539567afd3", "value": "384:k21sv2zS6pmIibwshBZjIuDnDF47nHIEXSCY6z2c3QJdRZgEouQa:LsuW6AbbwshBZjIuDqnr92cgHzhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717654, "uuid": "0e402704-e650-46f5-b017-cde6bd619692", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717654, "uuid": "28d90c99-7d1c-4f5c-843a-bfb96d2d9e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717654, "uuid": "e6a0ac3d-44ed-4a74-bfc6-466aa6e9e591", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.32004.30959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59e5e39-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676317, "uuid": "2953a024-57cb-4ac3-8872-7ea5801ad871", "comment": "Malware payload", "value": "a32b1c807a70d0f3203c1338268f73da", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676317, "uuid": "f98f6f02-dd61-429c-b574-d7777c71bfd0", "comment": "Malware payload", "value": "ce217375e5aa5e29ad9f94366eca235029ec471fecf16f126b6e66bc551a7522", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676317, "uuid": "4cf02adc-e00f-489d-b59c-af860f9bc690", "comment": "Malware payload", "value": "bef7cd61f76ea786f1164a12933ea362ed87a0c3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676317, "uuid": "eb594aa1-3f40-456f-8d68-f615801ea997", "comment": "Malware payload", "value": "61441bae9da2c52d4932d16366ad276885654cc096ad739795a56418d675cc985cab3bc79771f92744b60625bd5b8f9a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676317, "uuid": "98ff8655-e84e-4d24-8985-aa8863b0a7f9", "value": "T1F074E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676317, "uuid": "9475e81d-f156-4474-8d14-c9c28c537a2d", "value": "6144:Nkzpkc86ueZHV56NwBAGjQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBJCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676317, "uuid": "f364fc75-928b-4392-bb60-7c36065a4cea", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676317, "uuid": "b76768a7-bfb7-46ae-ab70-7619bbd2d96a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676317, "uuid": "c4ed8dfe-f1f8-48ba-ae04-85cc12797ff8", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67eefc9f-1329-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687677905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677905, "uuid": "e53230e1-e04d-4beb-81c7-81c0108f0410", "comment": "Malware payload (Amadey)", "value": "fe7c0e05742159b27b12f8b73c1aa601", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677905, "uuid": "c682f341-7641-4678-ac3d-7048d21fa33b", "comment": "Malware payload (Amadey)", "value": "cf76ac64d1038d54fa178a67712a4916e021b6b381241b44c2ceed7428ba4692", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677905, "uuid": "dd07b8d7-f3c6-4b08-881f-c7b9a510b0d2", "comment": "Malware payload (Amadey)", "value": "49cb572e3de90c216a7ddea15696fa25097e2b67", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677905, "uuid": "3cad86b8-1c82-4983-b62c-e617da5f3af3", "comment": "Malware payload (Amadey)", "value": "d220db2e2de58351363f9f236c7c3b6513961b0ae95703bb36d05a111a0426e8e9ea093d8e8dbcae3cb96df9dbf4426b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677905, "uuid": "b6eb9d94-8682-4168-8ee8-7c2eaca83917", "value": "T19C4612AD6140B398C01AC43CC133AD69F1B6661F99F9C9AA72CB7BD07B77311C685B48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677905, "uuid": "480fda29-4d26-46f1-9e0b-e7efc34a1bcf", "value": "ee26deb5354c4489ff0dc7547168b2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677905, "uuid": "bcc74ab8-c495-44b3-9ec2-5950f8b803b8", "value": "98304:J6QZWMIGzZAacjzajc7iE0ag8AmhH8Fex1Z+8vGyoC+pZAQ8+eh/sv64W:JJZWdGtXcjzajc7GYhHFZ+WGyX+pBq/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687677905, "uuid": "d9573e09-6ff9-4e6d-bff0-a9d94c3da049", "value": 5871616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687677905, "uuid": "d68bde92-e97e-43d9-ae90-b0f55dcbedc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677905, "uuid": "23c2322d-aa6d-4ad0-9c80-e14ae1bf2d3e", "value": "File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba9b322-13a0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetWire)", "timestamp": 1687728914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687728914, "uuid": "c86291ba-e126-4ded-93ec-4bd023bbfcca", "comment": "Malware payload (NetWire)", "value": "7a6a6b35d4bc575897a1420134afc96a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687728914, "uuid": "c9870836-2fdc-47d4-895c-2549dd0fdc0c", "comment": "Malware payload (NetWire)", "value": "d15f99dbd30bae6e896c52a810fbcba080ae3ba76f3fc0d9a7761c5736ec7c81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687728914, "uuid": "5b487719-d002-465c-b7a7-869964f8faa4", "comment": "Malware payload (NetWire)", "value": "9c5e87ce87b70a52f57097172c2babde2021454b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687728914, "uuid": "cad38f20-c68f-4501-843f-e8f06eb6c19f", "comment": "Malware payload (NetWire)", "value": "391d03f15c76e2a4322805928a77faca4597ec8e74bcdbfbf3c7261beb42d176f6ca447c29cf3edd50cc236ce6677b0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687728914, "uuid": "efeff5f4-c427-434b-8424-b24e52cf4648", "value": "T1BB04124DC3DA901DCE28817B79F2472D9EB2DF1338838653B2DECA431B94660E943A1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687728914, "uuid": "87231a72-5706-42b0-bdbd-51ce1597ac7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687728914, "uuid": "f8cf1b78-bbc3-45f2-a23b-8387fdfdb23f", "value": "3072:k/0CVy40hsbOeOyupBfOP8S6Uj9Av0fEdiFxFXwElgdEA/fLpujDqTrk3mjcqfZ:kswhwyJLjzfiib53W/fLpsDq/k7qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687728914, "uuid": "4af57521-8381-4445-be19-4526b29cd2a4", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687728914, "uuid": "f97678d4-f30c-4333-9f5a-6469f4fec67c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687728914, "uuid": "c16e2438-784a-4dc3-8a37-895cfdd76ac7", "value": "HEUR-Trojan.MSIL.Generic-d15f99dbd30bae6e896c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c00004-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676294, "uuid": "9d2b4835-5303-4f62-bcd8-3e232ba8ee7c", "comment": "Malware payload", "value": "fdea7a34b79d75e34096014fa663ac9c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676294, "uuid": "257bbd9d-bb2a-4905-baea-35b985bdbf1d", "comment": "Malware payload", "value": "d22dd77b191cfc9e4552c7e190dc9c636729e92b5b3bd0c078005110da657821", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676294, "uuid": "f5bbc441-f6c9-4404-9eef-5fcaa9ca0d6c", "comment": "Malware payload", "value": "94812c0f2de3181f36262215bd57a512320a3f4e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676294, "uuid": "9afa1a7c-883c-4f47-96ee-6ca8973960ba", "comment": "Malware payload", "value": "4a3019b032eb01e58d7d5017c55c8f21407fc90294093b3532149468dd355e01c8b01615e2798c0f747d0c4af2645b60", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676294, "uuid": "004e4871-7600-4305-a814-e8058dee5763", "value": "T15B74E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676294, "uuid": "07dcc42d-1752-4d9d-92e5-18945a5da2f5", "value": "6144:Nkzpkc86ueZHV56NwBAGyQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBYCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676294, "uuid": "e9555be0-5e1c-4e65-91e7-c39c661bdcd5", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676294, "uuid": "18aecde0-7fb5-4916-ad38-cc773fddc998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676294, "uuid": "e1e446e1-effb-40ef-814e-21bb6f1aa125", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a31a7c-131d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687672823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672823, "uuid": "eb2a6e19-ae18-425e-b6f8-53e4a419625a", "comment": "Malware payload (RedLineStealer)", "value": "d44082ada059ff3d7041469269403d15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672823, "uuid": "2c65d93c-cdfc-43a9-8bd5-2853880f2578", "comment": "Malware payload (RedLineStealer)", "value": "d45e8a61e82ddcb0680c33602933b24ab6a7507d1198f77c78b3afea7f7cdd44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672823, "uuid": "726bcc10-7dd8-4e79-9a97-09bbc4649fa4", "comment": "Malware payload (RedLineStealer)", "value": "a7372da2408e54e2418ee9e8f8ac073d57a200f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687672823, "uuid": "193bfe4b-2663-4de5-bf85-10e6815a3154", "comment": "Malware payload (RedLineStealer)", "value": "b3a595c5692a039f9eb709d75d1493e4f1d14108efb4963ef18c5793cd3e1989c4b638f4efc439e8b732d9ec77ac8c1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672823, "uuid": "0bfc2717-2fc1-48a4-b6ed-46cc4a0d43ff", "value": "T1C13611F22080C175D7DBBB34C15B931F681A653412EFB08E8F6A8EE54A3397CD669D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672823, "uuid": "48ebcc38-61b1-4d00-b1f2-9f3d26d33925", "value": "587a23ee0bccf95906f888e2a3c1c6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672823, "uuid": "ff157985-ab84-4803-92b7-998804a28b51", "value": "98304:kwwf8tBttSd7jj2KbHU063x2nTnm8uK75W5jkd7Xhtw4aJGdICFnuyDXugRc/AxW:kVHU0k0GjokgRc/A9MCHED0sVLz/m03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687672823, "uuid": "dd0f4611-2fe9-47af-968d-8c033dc006be", "value": 5193728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687672823, "uuid": "26e96dc6-a0ee-4218-9cc5-f28e4d3f55ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687672823, "uuid": "7177b05f-bf25-46c6-8c77-224d4e5d870b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f296574d-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678567, "uuid": "2e47f197-fb9f-48cf-97b2-6670e6c0e195", "comment": "Malware payload", "value": "84d885f3276ede3d7ae0795dd0850c80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678567, "uuid": "20590a62-f076-459a-987e-67e23649924e", "comment": "Malware payload", "value": "d5b7dbc1600edcd964394c04bdc4682cdb673943548402f70a876f3543868d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678567, "uuid": "f6c09ed5-7521-453d-8306-d6c52d9e7ef4", "comment": "Malware payload", "value": "c8b5397cbfc8ab309dd8e79584514df5713d159c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678567, "uuid": "d67e8da9-acaa-47f7-882a-4eb828420c50", "comment": "Malware payload", "value": "17798f86f5bdf854b03a59152475c5307816175667398eb94ec41c1c9b9c08d308d494ba9b6e8546c59560f7f8071115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678567, "uuid": "5e74b226-4212-4274-b477-7c195951ff3c", "value": "T16F0612B22258C076D3D74236C86F665C2415623F321FB6066FA74FE8BB37A7CE551A08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678567, "uuid": "c6bf2196-3c9e-47cb-9c2b-4b5d7543d5c8", "value": "587a23ee0bccf95906f888e2a3c1c6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678567, "uuid": "3f8b5764-9f8d-47df-b0c2-6ac2bc9ba5e5", "value": "98304:8OROTI6CJFESd9RRneQrxf0jkvnlkd/IcsMoklLrirLyYkbXfRw8CcQnn5U53jK:8SvtxrxsjkNkdj/l6fiXfi+QG53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678567, "uuid": "b7b40667-ff5b-492a-abb4-e06b95dcf2e3", "value": 3837440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678567, "uuid": "bea7462f-c9b4-4733-9e8f-1657afb648fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678567, "uuid": "da505033-5f16-4f64-9319-f3f27af6bc7d", "value": "84d885f3276ede3d7ae0795dd0850c80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eceb7637-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687717642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717642, "uuid": "e004f3a4-6966-46b4-80f9-d975059efc69", "comment": "Malware payload", "value": "9859533b14027b0b2a2a67a4a902ee6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717642, "uuid": "6b690a9f-852f-4355-887d-4a0f0ba664b2", "comment": "Malware payload", "value": "d78aee434ecf1fbd112e487774f2f5e22aab5b391835cd5585a3ddfa96191513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717642, "uuid": "efd84df9-1d96-4f06-9053-998934bd4364", "comment": "Malware payload", "value": "c9236c504be55b5777897ffc7d04aecbec8e384f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717642, "uuid": "3c53c786-79e2-49c5-8cff-a64478cba002", "comment": "Malware payload", "value": "0e53a8040e1c350a9c523a62f320fba4211caa3519ce9d0e6f2a44ae90c426d8fa2ba287b3601680075961a2b6af9e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717642, "uuid": "39a2c5eb-6437-437d-bf7c-b8a1ea589acf", "value": "T18D949DDBFB40F07FE99D16B31C894A446371BDA9D823EA2679C272AE4DB1F011E21513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717642, "uuid": "4149214a-23c9-4371-8d31-9e09cb86c9f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717642, "uuid": "c14093de-0c76-41f2-ae5f-a08fbe7a1998", "value": "3072:owXpTYl/yYDPFVA2HKDW+AgpzPIycWI7VggWfABlTspZ/ux1vXgMN9Ca9cfcxqQA:zYDFHgpEZx2gWmsZ2XZNwa9cUDejLi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717642, "uuid": "79a2447b-7722-4a17-8747-f78723a24652", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717642, "uuid": "87f14277-9867-4a4c-851b-abe105a5e0a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717642, "uuid": "be426338-7f4e-4f9b-a573-9b513e83700f", "value": "SecuriteInfo.com.W32.S-ee2ef6fa.Eldorado.19118.13081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3250a9c9-1326-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687676526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676526, "uuid": "7c9d23fc-c0fb-4888-914f-5512842a1810", "comment": "Malware payload (AgentTesla)", "value": "7bb251f9e867604d6a69b61c11826333", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676526, "uuid": "c91b89d3-7518-423c-9b9d-b5616f7a1ab1", "comment": "Malware payload (AgentTesla)", "value": "d864eb91e31dd606af3abb05b6fdb761d743369f228c725e49a1037736fcfb32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676526, "uuid": "074cc5df-7488-4cdb-95ff-a46e9b0f8e98", "comment": "Malware payload (AgentTesla)", "value": "ae256962920a1c0f28649430f22e8ca9f1cc5911", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676526, "uuid": "22396d54-4bc9-470f-9453-b729aaab86e9", "comment": "Malware payload (AgentTesla)", "value": "397c54bb65279873a7de303fd40d9dece4362498dc0bdb55e8718d682f29848c6d146f8aede193bc78c4aa3c467436bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676526, "uuid": "070ff808-ac6b-42c2-8adb-b4da0fb79c88", "value": "T1BDF32868929A8D03C3FD40B4C8B1310816B2E177925BE75FDDB1BCFA39167D3362A865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676526, "uuid": "83cd9f47-9a28-46ec-ac2b-04237946a131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676526, "uuid": "b5f8e79a-c5d7-45ad-9651-02806439f3f3", "value": "3072:z/PL1I5AXMEtPNnGbVhuIusIQG7wDskexfq9/P7M:ruALtPNnGbVkvsI+DeI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676526, "uuid": "3fdfdd3a-ae63-49b7-98e3-4ffe26b68fd5", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676526, "uuid": "5b58688a-36f6-4bd8-bb81-f8a7c7d49968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676526, "uuid": "5d90b9e2-18c2-4e18-adf4-0b3d3cf5a92f", "value": "1687676525cd90879d7f7ddf4e21052860c76cda9221382b1c9cd22e28b2dd37ec67e7e437575.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae02c2d2-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676304, "uuid": "0856ad2f-10d5-46d3-8280-d5066d1802d6", "comment": "Malware payload", "value": "c90be5fbcd0d03525b67b20b281db788", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676304, "uuid": "d4796846-1b24-444b-9052-c0a2df98ab54", "comment": "Malware payload", "value": "dbe4edd378c0f6a1483f2dcb28daba263c5fd72c38436b87762959976e52c660", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676304, "uuid": "d7016353-e6f1-49c8-a12d-24a7d18cfc57", "comment": "Malware payload", "value": "31aa4639573c121b0e0d6a11b0131fd2daa37d87", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676304, "uuid": "e581b91e-f675-4cf3-b833-c2544a5bc161", "comment": "Malware payload", "value": "a1493936e2ebfcd96e6ffc9ed4364773b9d28d765ae0cd5f791ec54d5d07a4a26ff45e5948bf2146a03cecd037611ebb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676304, "uuid": "b8eddbfc-e6eb-4da3-b167-64ed00ec6092", "value": "T1EF74E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676304, "uuid": "36855a82-4959-4d42-9155-cea84aa4790f", "value": "6144:Nkzpkc86ueZHV56NwBAGgQuImtCoGRmd+BUKCP5LtuEulM:686uNNwByCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676304, "uuid": "901fa5ec-fb9f-4cc5-856c-4f5acd4c7b3f", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676304, "uuid": "ca321cd2-88db-4221-b97b-ddb0c2b6d1bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676304, "uuid": "7fe29fed-3322-4fab-a0a9-6a19f716837c", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4ffd99-1364-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687703497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703497, "uuid": "7528395a-f703-43bc-8660-4b522c2d4447", "comment": "Malware payload (RedLineStealer)", "value": "2b8138bae7e64f2b7095350b6298d87e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703497, "uuid": "640d07a4-8ebf-4c8c-b276-f4ffaae83f89", "comment": "Malware payload (RedLineStealer)", "value": "dc7113c88a375406e74ba69be5f707aeb697612a10a207849774a03b025958fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703497, "uuid": "ec45917f-5836-4e3e-b3a1-802e80d63080", "comment": "Malware payload (RedLineStealer)", "value": "68f572d8b0725ac7e78aa4fb7ce34c9cc1c3d111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703497, "uuid": "e16a4c0f-b8dc-443c-bf5d-cb0ee832f9c3", "comment": "Malware payload (RedLineStealer)", "value": "18a79881cbb141f99052e85542d935d6a4a415a67fbf89510d7fa942ed1e3e6b5c6ada5005ce4ad32636576234c3d450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703497, "uuid": "ae15e307-3d58-4981-bc37-7f37706e084b", "value": "T1C80601321D26D275E3D3CB38CB83C42D1E2D12B9359FB0852B554C8A79AF5ACC277929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703497, "uuid": "3386256e-9d0c-49ab-9a21-ac8103db49f0", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703497, "uuid": "d98552c2-6990-4181-82eb-fc473fa64533", "value": "98304:6zBHNfWL36/gDoHP9sw5Mo9x4RwBRBZ6v02g1PZQapt5jkYv3lDoS9rCTu3JRTZR:6zBHNwovD99uRwBRO01f55jplDo5cxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687703497, "uuid": "419b4549-6929-4311-abda-210fa3a57f34", "value": 3770368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687703497, "uuid": "51524485-665e-446c-b4ca-28e2fab94ad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703497, "uuid": "db1893b7-ef88-4d84-9e32-eb9cffe24bd1", "value": "SecuriteInfo.com.Variant.Lazy.355257.26687.12411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3b21d2-134b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687692726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692726, "uuid": "dce3bf52-9f6d-49e5-8f75-f6df794094b0", "comment": "Malware payload (Mirai)", "value": "a17a51396c33b9a41e0dfb94110a1a78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692726, "uuid": "2b26973c-e96b-4fad-905a-be3198b8f7e9", "comment": "Malware payload (Mirai)", "value": "dd5ea9bd04c00a137452c7e91333a39834231b36babcda3e99b8ebdf0776f5b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692726, "uuid": "b0294830-20d1-42c4-8598-9bbecd98fd10", "comment": "Malware payload (Mirai)", "value": "28a66b0f16863f212c653489015071f16325d9b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692726, "uuid": "c88813a0-27bb-4e3d-925a-75e8c656c16e", "comment": "Malware payload (Mirai)", "value": "a2588e995faa52d2234696a0375967563049741e444e457f33c76c48cc786def14bbb5860f81f690cdc4336b7ba25135", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692726, "uuid": "0b0f7093-8fc2-496e-9539-264f6ec6a109", "value": "T1A613F127633C59F1C7742E36D2C6834A158697F5AD8BB03A0C3047ACADD74924BFD4AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692726, "uuid": "ec0dd349-2564-410c-9086-163e0028e302", "value": "768:77gfV8/671XNqNQhdsAC8nx/dcrFbSQQIM0oeNAux6hRb7JCwAD6dpaH3Ux:77yS/i1XNgOsA7UhSL0LAs6hRb7JCL6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687692726, "uuid": "6e464b47-ffeb-4a00-b3e3-9c16136c68a5", "value": 44384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687692726, "uuid": "52025195-b344-446c-a855-9e99474a8763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692726, "uuid": "238d8f2f-7c24-45a0-b2b8-91cee47eb722", "value": "a17a51396c33b9a41e0dfb94110a1a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b55bbb0-131f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687673616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673616, "uuid": "cbdbf263-ef4f-46ba-b0fc-20c38b733907", "comment": "Malware payload (RedLineStealer)", "value": "c600be872c88f2f8d288702acad8c49d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673616, "uuid": "7391e597-33a7-48b9-9955-93cc940f3166", "comment": "Malware payload (RedLineStealer)", "value": "de37e38d15933b163d7b104af7ac4392af4a5663f500f5567efc40c8c01e9968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673616, "uuid": "05854ae6-5b2c-4d59-85a1-41a7fd2fae6e", "comment": "Malware payload (RedLineStealer)", "value": "a3c40faaf28264598ed7faee7a475a6669b22ac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687673616, "uuid": "6f783b61-4e75-4dd9-9995-659cf97cfec0", "comment": "Malware payload (RedLineStealer)", "value": "cf28e3e04159f620b8526b0d680baf9ae365b3de244b45a04c6c838060357cd5eccc3d5d42e378619af61a4329dd9ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673616, "uuid": "b054f70d-3796-4003-973a-f6e8eb1a28bd", "value": "T1F404E568324BA97EC97F883D9C700CD4667CBC675242A7079D8EF4E8393A7819B151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673616, "uuid": "20014c6f-6de5-4334-9deb-1f29bb664866", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673616, "uuid": "d4be8a81-eb87-4140-8537-5f74c3775742", "value": "3072:APPg15JsR4NXxNVW+Vij+HUCepT8e8hT:+Uqg96+HUCepT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687673616, "uuid": "d7d6b46b-4303-4240-ada6-d04ebe1cb36c", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687673616, "uuid": "2ab240fb-ee33-46c5-9563-ecdda302ebdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687673616, "uuid": "979ccca9-40a2-4afb-b5c4-b73eaf508731", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af940732-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678455, "uuid": "2ade25a5-fb8b-4e03-8467-78769ffbdb4d", "comment": "Malware payload", "value": "377e8c04cfedb8485a92b8e14390bffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678455, "uuid": "8261df18-b561-4a3b-93c1-1867e26ea86b", "comment": "Malware payload", "value": "de719b11cb48a742e2a58fd60506a068311a328aae82f21c86e764de1d8981e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678455, "uuid": "a324896c-fc53-419e-a83d-36eb1f0143f7", "comment": "Malware payload", "value": "1ef19033e2ad8cec754cdd37ffd57b2e241308bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678455, "uuid": "da3e9931-da1f-4af5-b1bb-834e48f09c6e", "comment": "Malware payload", "value": "c0ed4915ad5464505e1bf992a57c107db3f4dd18fd09c84c669d7163dcd904a7c5a9c6f13154fb79b5def7364ab5c431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678455, "uuid": "1de9cd13-b965-4678-8147-540ea057d266", "value": "T15D94AE7D66811E67D90B73A6F5D193A39C0A1F841693ECDCA43B4C3339BCCBD94A8984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678455, "uuid": "e85b636f-a07a-456f-a668-e0b9ee4d1497", "value": "12288:mXda94m5MUBzvAyX+Q6lRH+B8J2fzfasCrllNfz:6494myMzoyX+Q6Ln0bert", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678455, "uuid": "bbf4dcbb-190f-4e11-af43-cb0bdda2aa05", "value": 447188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678455, "uuid": "8fdc57a3-7e98-44f4-bd65-38e80b4d4d67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678455, "uuid": "8cf14e79-f593-489d-a18c-86e38be02966", "value": "377e8c04cfedb8485a92b8e14390bffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddb4abf-134b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687692732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692732, "uuid": "ecea1852-c687-4d8e-acff-3380e69cdf6a", "comment": "Malware payload (Mirai)", "value": "af5eeba1eb97ce1c1102dc188e339570", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692732, "uuid": "de0c0636-4982-4607-b986-0c569cd612f6", "comment": "Malware payload (Mirai)", "value": "e03762bc528f07f35f230b9a8e244d6ec25e8c7e571ed575d1fc278a15aab075", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692732, "uuid": "bb7e0944-52a4-4fd6-9b02-a5a4acdaab82", "comment": "Malware payload (Mirai)", "value": "50fca6c980ae814e717ff728935625626ed61255", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692732, "uuid": "8937f201-cc13-4caf-835a-22dd0fec8705", "comment": "Malware payload (Mirai)", "value": "4642c1b367e9a370f35c349f99c61d17f3d837c4d70c7b0b41879e6dc841b2b2b52af8a443abe5c4df88bc618593d114", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692732, "uuid": "e7cbafc0-0951-4f42-b778-38f08ab2c849", "value": "T1A723026AC5921671A4A84132FEFE49E5B37A49B9CC393009B5015D65FCCF8C9A3E07E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692732, "uuid": "42cd4513-5d94-4add-8ddf-e712d65132c3", "value": "768:16jRCdfvtmQo8uorAaPJMOigqIVIH7bCn01u4llLxCfeYqq0rg9gHAl9AFq3UIwf:0kVIQo8uokgeOi/IVIHnCt4ll3Ygrdua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687692732, "uuid": "1d85dd23-b6ea-455a-aa40-d5a10e1bcf8e", "value": 48756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687692732, "uuid": "3a243d6d-30e3-4afa-8037-20ad8906c6f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692732, "uuid": "0085997d-252d-429d-877c-ceeda3a7de57", "value": "af5eeba1eb97ce1c1102dc188e339570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c737156c-1328-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687677635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677635, "uuid": "88b35400-2115-482b-817a-cfea3a812069", "comment": "Malware payload (RedLineStealer)", "value": "5bf468ddfc59df0f069e9468b3f6c0ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677635, "uuid": "d19449ee-68cb-4b7d-911a-79df4c1bf48f", "comment": "Malware payload (RedLineStealer)", "value": "e1692d9f064b288e38db0ed8ecab2f384840e80b0e849a37ccf55b72258af99d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677635, "uuid": "c5943abe-a64b-45fe-a121-628a5f0c1090", "comment": "Malware payload (RedLineStealer)", "value": "51f62d7f7de519093308e9e1d653bc6852744d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687677635, "uuid": "cdadb954-ec1c-40fb-adeb-98524dd1ae61", "comment": "Malware payload (RedLineStealer)", "value": "400cf39ec3667a872f9de7ffafa56b1915b8d31e3fa92469b1be8e728690293d04e02bc9bc6102649ff98b39ecb9ca9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677635, "uuid": "a5db82e5-3fba-4dd8-9b9f-8fce2696a0a5", "value": "T1963600F12880E075D7C7B732C527930F680A953012EFB89E5F99AEE90A3397CDA55D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677635, "uuid": "c950d861-ca6d-4ebd-8654-c642de462088", "value": "587a23ee0bccf95906f888e2a3c1c6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677635, "uuid": "bcb96778-5823-4254-99b6-5b52eee51ecb", "value": "98304:6VinsqktJS9q9eUCI0ALBsYEQnTaB8Uv/hEJKXUA/IY06QV3+HQYqt8gdNWSPbxO:Sqsa2nTaBf/hT/IY06QEhgHPbxujKqYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687677635, "uuid": "06302441-314b-4bba-b2c6-31f87c2b0d61", "value": 5217280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687677635, "uuid": "e6f4d5e2-f6a2-46a1-ae46-ee62e84e0b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687677635, "uuid": "bf9b95e1-3232-41a1-b032-8c6c0b16ae97", "value": "5bf468ddfc59df0f069e9468b3f6c0ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a4376e-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687678684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678684, "uuid": "80dfbb37-8abf-463a-9750-27fec7c50085", "comment": "Malware payload (GCleaner)", "value": "1d325ccbb06abc5f865890bb44f96529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678684, "uuid": "67fa0735-bbb7-4223-8f42-36838de421cf", "comment": "Malware payload (GCleaner)", "value": "e2e4d89f3bc9d20c9f71f84ee27223ceaeda22e3eb4e24c8089ba51495517f66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678684, "uuid": "162b8184-b4d8-4608-aa62-29a43d95207f", "comment": "Malware payload (GCleaner)", "value": "7ccbc4f1686eb8912c288b665dd6aa1d50ef5479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678684, "uuid": "d9b587f0-b2cd-4182-88df-45439668e842", "comment": "Malware payload (GCleaner)", "value": "f5835dc1ed3f4c21ecf0033b8bfc5a22f911c44321b512f1618888987a09eb20770dcaf108ca09e4f239b7460a5c3538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678684, "uuid": "974dfa49-9433-42a8-a0f6-c48bd644a95b", "value": "T1E054D0E171E0B431D86716317D29CAA43A6FFD215F283AFB27582A2F1EB12D1D671381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678684, "uuid": "d41b6305-4c30-4807-ba9e-2dccb3572889", "value": "9a21fb86d7cb757e687d836e62cdc05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678684, "uuid": "03f214c7-770c-4129-a9ca-6d6629b01bfc", "value": "6144:ZBeChoxkM87yDqAESyodTKeoz8rw1UMxqzn0CX:Z1hoxk1y8CRjw1Uo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678684, "uuid": "129b8088-3704-4fae-bef4-d084eec79411", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678684, "uuid": "9137fd55-8dae-450e-8e60-a3242ca07587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678684, "uuid": "2debc82f-32d3-442a-90cb-4c832f26a0b5", "value": "1d325ccbb06abc5f865890bb44f96529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a8907b-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687717650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717650, "uuid": "edee4b4f-d2ab-4913-9640-057a97f0307b", "comment": "Malware payload (RedLineStealer)", "value": "eb6e0280c44ebc5e3b1112c252ad6ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717650, "uuid": "042abccb-5c59-4c6c-945a-1683e6902f95", "comment": "Malware payload (RedLineStealer)", "value": "e32ca9773094dc5f38dbfd0ae05cc2f134b3de614336a56b9d6f7ed372d4e452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717650, "uuid": "dea59141-d2c5-45f8-86d9-08f9ba2bfd56", "comment": "Malware payload (RedLineStealer)", "value": "ac52ff0ad0108e29b5d1af724f3f9bf259ac4f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717650, "uuid": "d0dfe9c6-2e3b-46a8-98b2-78845e8103b6", "comment": "Malware payload (RedLineStealer)", "value": "d69fb2692939d8c357bcb01e250abb6d07f24b7b58b6803f652e0e39595a5df3e94d10ecc48770949b889176cc6845ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717650, "uuid": "052fda97-3776-454d-bf87-c14611f13bed", "value": "T121B412213E40F736DD497471DAE7C53ACDFFB8310FA381A7AA4871650B922C39A6D225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717650, "uuid": "a30df408-f7d3-4a38-83ac-b21b0d9e248a", "value": "89591827d8fa86937981d5b74d9dafb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717650, "uuid": "7ec5f040-1291-4580-ab7c-746f14b4ceae", "value": "6144:Pdg/70q6Zwh24HVvsrlnQgDtYMatAthz4lmFQTs59hyTstErlbu8wc2bZMK0GoA0:qT03zpGJt2z4lmY04Tsqr5wPMnfA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717650, "uuid": "8afce11d-edcf-464c-ad36-b7261fd78445", "value": 519440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717650, "uuid": "bc2548db-3a50-4ceb-bb05-1da09b8ea6c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717650, "uuid": "474ff5dc-1143-4b65-a0cd-00f15516486a", "value": "SecuriteInfo.com.Trojan-Spy.Agent.13364.19297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18825cc-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678968, "uuid": "eb2b6843-b90d-45c9-9d72-64c58f62f209", "comment": "Malware payload", "value": "e8c8e1abc1ef2c38de386db9b4c60ef0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678968, "uuid": "211800fd-815d-4a14-ba78-c955d1260df9", "comment": "Malware payload", "value": "e47abed9c4a2d76aa49f5ce9853a1521779b4e1eb8604fa2bec956cbaa23e343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678968, "uuid": "1f4fff3d-4361-4d09-be1d-750e465f01f7", "comment": "Malware payload", "value": "42ace43f166a1bf07129ff0039cf071dffa1e67f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678968, "uuid": "d27df768-90cf-4219-a441-ee784919b291", "comment": "Malware payload", "value": "bf43632859e0aa014372c4a7a03aad286ecd3cfc89e62af669a41a256103f9f705c4a8029387a49dbf7b6141a1b4b7ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678968, "uuid": "5a24b8c0-6232-4d63-b79c-795b585ae537", "value": "T19316331628D7FB92C6BF8233D15A1C8ED095C11C31B22656D386DF50FCFD14AB198BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678968, "uuid": "0df3b0d3-f2b5-4d57-8510-85b65c5b1a89", "value": "d5e0355f8764c235b38759b860077ceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678968, "uuid": "e5aeb2be-c9ff-40f1-bef1-16cd0c0f41b7", "value": "98304:LYBOQ7Ck1ixm2d7+bPiWlw+El74/XeSB9Zq0uCN4gd1:mXCk4s2sJwpSlACZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678968, "uuid": "28bfae7c-56a3-48cd-b5b0-9082e7981b4a", "value": 4068095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678968, "uuid": "1be56a4a-fd4d-4c93-a6f0-988af94ccc33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678968, "uuid": "f4f087af-7b22-4995-a834-36b365a84977", "value": "e8c8e1abc1ef2c38de386db9b4c60ef0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ab1559-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687678411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678411, "uuid": "eb004f29-4fb0-4a68-acf4-fe8ea2a8dd59", "comment": "Malware payload (GCleaner)", "value": "ae82e852e69375d3644ef1ba5158ce50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678411, "uuid": "45c3e292-415f-4ae3-87c5-613c1d3033a3", "comment": "Malware payload (GCleaner)", "value": "e4831adf2f6b16068e6a769569e405232822476f1e01c643cfc9bbb5411a071e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678411, "uuid": "45abfb86-2705-4e77-88e6-74ba24eeae63", "comment": "Malware payload (GCleaner)", "value": "a743f709a6ecb8c3320e171f69bab9520f5cd608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678411, "uuid": "aa0cf013-2281-408a-958b-c87da3800fae", "comment": "Malware payload (GCleaner)", "value": "a77744fe4dd62c818c40067c9111229083d8bc1347d6cb15c65eaa794effdc97cccf90996d96186f6f70d777b131efdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678411, "uuid": "ac483bc3-3b64-4e5b-b062-284ba57decc4", "value": "T10564CF1272E3BC30DD260A338D6DC6E4AA6EFE618F18679722587F6F1D702E19172351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678411, "uuid": "a7b05c86-2df6-4d2a-96a3-fc44b7b2976f", "value": "329453ddc461a51b7789ac2d751e2c20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678411, "uuid": "762a86ed-9817-4f6f-adc7-ddeaf0ed8526", "value": "3072:hL8wbDUhpNgCz4FDDOYAx/eSX+JcSYANh9Om7uATowscofWcWd3ydRUfGupLteIy:awbWsCz4FPSih4w+uCd+OupFA7dMQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678411, "uuid": "db2890bc-5eb0-4fe2-8cf2-54be8b1b2945", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678411, "uuid": "3aa98a3f-dd2a-49a8-a444-7cd335791fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678411, "uuid": "a406b862-c825-4cec-8c38-981465874dcc", "value": "ae82e852e69375d3644ef1ba5158ce50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed3bec0-1385-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687717645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717645, "uuid": "8c295574-7679-41bb-82df-e4952a14ad51", "comment": "Malware payload", "value": "d9e7dfc714495329bf09738d89da752f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717645, "uuid": "4a62f3ef-e025-4cc0-a5a1-40d39fb9727d", "comment": "Malware payload", "value": "e4d537e344eb4a4d35182760024d0956fb8580cca364213566c8b149b5dd57f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717645, "uuid": "113d4012-142b-4b1b-8d9f-24fe470a6cad", "comment": "Malware payload", "value": "a4ca9cf0f85241523d0d755dea5e1e01a17ce106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687717645, "uuid": "93eaab6c-e192-44d0-92e7-a575985b786b", "comment": "Malware payload", "value": "ca022400c912bd3b4b859aaf52c1348d850b1fe525c07fc6d758c181fde233fe893600aef41acba7dc1a36a0bea137a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717645, "uuid": "1ed2ae12-69fd-47fe-bfe9-050a9ca5ad2a", "value": "T139453375B0474126C337377CAEAB5CC84A8DDC60DB9416B884AC75B43A3B0BBED8252D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717645, "uuid": "57f50c76-8a5d-4df8-bdd0-5085182c7374", "value": "cbda4b628b054d334708d642fec2e924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717645, "uuid": "f80cf55e-69dc-4be4-8a9c-55f8ab36444d", "value": "24576:R+PeJPQB/qpXxjgPwWZotakkHrBwg5talx6ywm6:RQex4SphjqZTkkLBptS6ywX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687717645, "uuid": "29545b86-c875-430a-a5fa-5f99db46f30a", "value": 1267712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687717645, "uuid": "12517fa3-e557-4725-800a-aa302b53517c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687717645, "uuid": "7d69ce3c-c99a-4ffa-b221-72eb1a46aa76", "value": "SecuriteInfo.com.not-a-virus.HEUR.Monitor.Win32.Generic.4071.16558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a69228-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676284, "uuid": "b60fd193-230c-4662-a097-f8bb1cf7bc80", "comment": "Malware payload", "value": "25523b778609da316a51a18656e160f8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676284, "uuid": "d6d76d86-5978-4740-bc86-0bc9dd805831", "comment": "Malware payload", "value": "e515dffe99c02c1a2ba7c21ea58b5d7a2dd2581e462fa651181143f1401dca84", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676284, "uuid": "74a79312-146f-49ca-b42f-374a02d1eb2d", "comment": "Malware payload", "value": "8aaa1702a6e686a021f36d8aa5e95bc93f62c4e2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676284, "uuid": "545517eb-e11a-4ac4-b5dc-603436c85b4e", "comment": "Malware payload", "value": "8d2401ae9c029af3fa2e9cd318fc3dc6b73bdc784864133566324a9083df4ff812a9579e93f77cd7ed4989a2142a5525", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676284, "uuid": "ffb60e40-8790-41aa-9dac-51ee3b293fee", "value": "T12874E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED4C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676284, "uuid": "9f239112-6f40-4778-8cd1-305fdecb7212", "value": "6144:Nkzpkc86ueZHV56NwBkGXOuI6tCoGRmd+BUKCP5LtuEulM:686uNNwB5CTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676284, "uuid": "22fab6dd-9566-4961-8b66-ac3192d8e64a", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676284, "uuid": "d245c17f-493d-409c-bfbb-0fb37df51f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676284, "uuid": "17876ca9-f4b5-4984-9db8-6f3d38a6cd5a", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab1b7d8-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678795, "uuid": "36e92caa-ca68-4b84-9cf4-57c92bf6973a", "comment": "Malware payload", "value": "52d11459ef9ff83db22e0adc84498b27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678795, "uuid": "f0703007-48a8-418e-8257-a22fdf04b01f", "comment": "Malware payload", "value": "e69a25d7c176de56ba98ac3b16cb7911a75b503ff45370dc8ad61cf06c98576c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678795, "uuid": "6092f926-e24e-44ef-b4fb-1012e6a8f3a9", "comment": "Malware payload", "value": "ea719cfaebcc14e81ceca18c595579dd76c4bdd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678795, "uuid": "0b7f1f6b-5d21-434e-967a-24a67726f020", "comment": "Malware payload", "value": "221e226c134e7a62c3e84dfa6ae4bc702beeda79e9476840caa896d5897e7ea553dfd3812e2a657db5a85ed49b1c0bad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678795, "uuid": "33f3e2bf-bb67-400f-9fbe-143b96ed715f", "value": "T102D5123B6501C5B3C3E76532A593C3137C28E5F1127FF88A6F63292719136BF466A84A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678795, "uuid": "998dec75-5e89-4c84-97ee-b88cb64359e7", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678795, "uuid": "7287bfb4-223a-410d-aea0-a070f70c505d", "value": "49152:1xpiK34FbzvcBheKrdwEii9hWM9fNWzQfYfX8oS6X2kB7WeLhvHtMnycGqDcTOem:diKarc3eKrdUi9QM9fNWzQAfX8oVmkBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678795, "uuid": "520fb6b1-324c-46c4-8684-b89f3fbf8d3b", "value": 2811392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678795, "uuid": "9835f826-e179-4aee-b545-fc9ca941ba48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678795, "uuid": "9972dcbb-087c-472b-b9f0-28bcb1053652", "value": "52d11459ef9ff83db22e0adc84498b27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f580373a-134b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687692745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692745, "uuid": "fef9f2f0-161b-4ebe-8aa0-d789488d5305", "comment": "Malware payload (Mirai)", "value": "837be3baf508ef1756dd64b3ae4f579c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692745, "uuid": "55a64131-704a-4497-a145-5f60f3e462b1", "comment": "Malware payload (Mirai)", "value": "e790e7341d0a4d28234b5343276d66b8fccea525c91861bd559c55a613b11b6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692745, "uuid": "cc16479d-7a4e-4c5c-938a-6d3e94974fd1", "comment": "Malware payload (Mirai)", "value": "a016730f4d09a7a63e59ca853a18a282b4e4a08b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687692745, "uuid": "ecc14e88-bd79-4461-9105-dca410946146", "comment": "Malware payload (Mirai)", "value": "3d6244dea205104c67db60cfe4518525a1c1a3f2528225b919d1f02ac8ef7f9e0f6ecd4b4d020ed8b77c000633be6998", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692745, "uuid": "6dfb222a-b564-4885-8d2a-25cfccb1eeeb", "value": "T10C130270A2950BD385EA80BFD96F390F5F86EA0C48E026726FC67077C652E251F2539C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692745, "uuid": "ab8d60b4-34a3-4cc8-9b73-fe2e28ae7015", "value": "768:i+2i64l8rN9tHekWpOeu1njdRHoIhhgnYtpVRR1mT3ZDY1uOyDPabs369dJUrOxY:ZhvO7HognBRunYHVn0ucnebsK9dJUenC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687692745, "uuid": "972fb37f-c4e0-4369-91f0-4fbedef4ca8a", "value": 43404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687692745, "uuid": "de1108da-b6b9-4ce6-bb8b-748a6a49e3a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687692745, "uuid": "e3db34a2-d063-4ea7-9c9d-7d52d44bfbe0", "value": "837be3baf508ef1756dd64b3ae4f579c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa2c506-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676307, "uuid": "4f12218e-51e6-4194-9fba-c4fdba317d96", "comment": "Malware payload", "value": "7afb5f87e9caaae93faf76e33aac3c99", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676307, "uuid": "d4a87e4a-a8c1-42b7-93bf-a4f4007da676", "comment": "Malware payload", "value": "e7a4b2ee8fc083f574cebfc497ff4d9838c767018f708b180ec3d77b3e25852a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676307, "uuid": "bd9c2b04-c723-40cc-a334-8c981094e398", "comment": "Malware payload", "value": "2f5c6b664fcbb3e5f906222dd2db53cdd04d3c8d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676307, "uuid": "965d4ddc-a481-4553-aafb-9db8f7915b03", "comment": "Malware payload", "value": "499746040d5b68b20db8c2e1f993ae07e5bad3d9e7c395b21759cb3be6f6aa0e1f24138f89d7e096cbdb24778c410e24", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676307, "uuid": "a8598af3-6cd9-4935-a7b5-e357665d857e", "value": "T1A874E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676307, "uuid": "19f2693c-8eb8-417b-8472-42e7ea32eea8", "value": "6144:Nkzpkc86ueZHV56NwBAGLQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBxCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676307, "uuid": "32359237-b432-4988-b962-b52bdb7bc051", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676307, "uuid": "77d548de-d0f9-4ac3-8aa8-430a2fc45e17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676307, "uuid": "2e4a038b-a24b-4382-b9eb-3dc49a727f9d", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe62db4-1364-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687703500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703500, "uuid": "a4e4a294-d915-458d-bd75-fcc458b95761", "comment": "Malware payload", "value": "10e46a596f3a10a04cd0059691472f7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703500, "uuid": "acfc7770-553e-4e9b-a371-a4a40004b5b2", "comment": "Malware payload", "value": "e8a9d29b01c2dde67df8e2ea6aba968af3ff2a7a1adc151c8773615fd6dc9ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703500, "uuid": "6428e83d-6697-4455-9e34-06966d0d1188", "comment": "Malware payload", "value": "3fafebd8a27503751099d8a73bbd0fedc293a62d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687703500, "uuid": "b0d69816-01ec-4f75-b88b-586e69e39470", "comment": "Malware payload", "value": "e8d196aff90925e520c79e0eddaf19e534adc36727bc5f8beab8d4d4e74ff883c782fa85508c4303efed776a076be8c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703500, "uuid": "87dc8724-da28-4f1f-b2b2-271eadd3047f", "value": "T1DA256FA9394C6E96D435957E4DE1344BF22B6F1377128C582AD212B1C2E271E36ECC3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703500, "uuid": "364a93c6-e3e9-4c05-9062-55198645f36b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703500, "uuid": "aae2df6f-7925-4f6c-b1d8-bcb89839431e", "value": "12288:dIVC/Qhl8RTp9a1eoeeSje59lSYzDCfFX2CK3Vf+Wah:d4z8DoEySK59tzeNX2Co+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687703500, "uuid": "7ffa91a0-eb75-46d1-953c-16f5e53ddbbb", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687703500, "uuid": "37ea7f3d-8fee-4fb5-8eec-d066c5237791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687703500, "uuid": "1fa6f5ab-6602-499e-ad97-80afc7a8f5f2", "value": "SecuriteInfo.com.Win32.TrojanX-gen.4581.17102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f80709-139b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (BlackShades)", "timestamp": 1687727081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727081, "uuid": "fb2b9ede-eeca-4b7b-b46e-e5d08fa96517", "comment": "Malware payload (BlackShades)", "value": "072428ed08c736d6f81aea71741389b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727081, "uuid": "1ad62eff-f8f4-47fd-9c06-fc3831ec4b9d", "comment": "Malware payload (BlackShades)", "value": "e8eefab37fec532a017d60a2851ed8aff3f4589028e9ca6794d100ea758bddb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727081, "uuid": "b2654fdc-50d0-4f58-a770-a88fddd26507", "comment": "Malware payload (BlackShades)", "value": "6efa1a089267ce56b1962f2f93e5564256d38a1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727081, "uuid": "91ca1b75-010b-49aa-aaf4-c1cfa2ae81af", "comment": "Malware payload (BlackShades)", "value": "cab73e0f61fc1c3841b872d7587fd62e94124a21ec6cc00ac843dac5ed51d487f45bdcba9962c57e4aa65bf7fdf616b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727081, "uuid": "f9e96b77-7905-4286-be95-07d32a094e2c", "value": "T1D174231249EA2957C8E7A9FC5901B5C84C3B082F14DDC768EA817DFB714BAB045C4DF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727081, "uuid": "735e594c-6100-4001-ac83-6ec2339f7be2", "value": "a459954138cf2a762bc5e5f961bda8c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727081, "uuid": "a851477f-b82f-463a-97be-7bcfed3ae9db", "value": "6144:9L1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19N:9LdcfxaeM6fy/KaVUtgKkTZ73coNRJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687727081, "uuid": "f42ee6d3-88c7-4e97-a572-a6ec3431a154", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687727081, "uuid": "8f152391-bc83-4dfa-819a-8b9feab6b3fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727081, "uuid": "db5b4b44-94fc-4898-aa10-76bb59346ac3", "value": "072428ed08c736d6f81aea71741389b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c0c2ca-1369-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687705627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687705627, "uuid": "7d247d48-d004-43ef-aa45-645538737fc4", "comment": "Malware payload (RedLineStealer)", "value": "ee539424f2973dd2a45ab3b8f10128b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687705627, "uuid": "320cbb38-6dce-48e3-845b-793786ec0491", "comment": "Malware payload (RedLineStealer)", "value": "e9c59b97d4d0be711dc6a0f47d8b16fa6d4e0a8cbfab702ab9f0642d1825319b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687705627, "uuid": "fa167c3b-1e09-4f26-9407-a5c80bda2ee1", "comment": "Malware payload (RedLineStealer)", "value": "f477a79d335ab48a2f947cc1675eaeeea69cf33d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687705627, "uuid": "c1b5259d-76f1-4e4a-b74e-88aa04c0c9c1", "comment": "Malware payload (RedLineStealer)", "value": "f6432cf3f3c373ecec75700f4fa60abdf5e58ea0dc85242eb3fe4961655b09e7c2dd64a0113297c99ba2ed1f7c0a99ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687705627, "uuid": "29f24a76-e042-4f2e-b7cf-3b9e684e4c1c", "value": "T16B257D2179B49176EDE220BA45FFBD21C2EDE0B00B350BC75AC95BEED62C1D12E31586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687705627, "uuid": "e4dac3ae-016f-4c3a-9869-df004ec37900", "value": "031de5dc510e9e46afc18b1a5c0c3814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687705627, "uuid": "50bf4f4a-70e4-4eba-8ea9-c095698132bc", "value": "12288:RRRDg99w/4aRmKCOrWtLvvsdO66GlJh69KRNjpgcf0vBPJJeRIlIu45y8jyISQRb:R0bDaRmZOrWtLv0dO6DJEE0vBPJJfdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687705627, "uuid": "493150e7-94fe-4141-b383-2adeafc6e7ca", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687705627, "uuid": "0a5d3346-3757-4aa6-9ad1-e94769a4e18e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687705627, "uuid": "cdd9f21c-c162-43ac-8450-9262ec7e6490", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3995e2f8-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678257, "uuid": "4e660c20-48d1-412e-825c-225df01fd1d3", "comment": "Malware payload", "value": "5110b8c68ca704c432765cbce51bb759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678257, "uuid": "45fa2637-7083-4ba1-8cc4-3a0896863b53", "comment": "Malware payload", "value": "eb68ca6b9bbe6d0994bf6e09c47dcfd984e04a03b7a9ce3ac3abb2b4cfaa2b35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678257, "uuid": "fbbf63f5-f6d0-4a8a-beac-d4ad35ddcc62", "comment": "Malware payload", "value": "241e3e1f4daf6b55b927e2b3e7f1cab36e34d068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678257, "uuid": "c0a0bb2b-d000-4822-bb78-ff0220902d47", "comment": "Malware payload", "value": "db1cbe64f593a10e5d574f9c9e1b24cc8f1dda43d71bb66266e0ea035c151c76ab1110deca8cc0cdf311a8c96bdc9cf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678257, "uuid": "0424d977-de5e-4297-9fdb-0f57ef44f49d", "value": "T17206127A2A04D633E7DB2531D0A3869F085D66B00A4FBC467F7B1C2B9A235ACD8357C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678257, "uuid": "ece738ad-cc73-4d46-a69a-56c28c2b4234", "value": "98304:R4phsGwIhQn0V2nTzm7vIQhcnqC1ll993L/BKfNNMCU6XV70ajhD3fxuOlqYR34p:R4phrnQn0V2nTzm7fTC1JFbQfNbU6XVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678257, "uuid": "b6ea2355-924e-47a1-b80e-7afa95844fb9", "value": 3792384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678257, "uuid": "a3504fc3-ba13-43f6-839f-fd064a86bc6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678257, "uuid": "7553b5b3-e665-475b-aaa1-3db23de43b47", "value": "5110b8c68ca704c432765cbce51bb759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88cce00-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687679006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687679006, "uuid": "5111fc32-be57-4703-a5fd-dd101c553043", "comment": "Malware payload (AgentTesla)", "value": "ca8d7885ce82f5d2392650125fb2d333", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687679006, "uuid": "b045451e-8f97-49ae-b7f9-a34d0d76b7af", "comment": "Malware payload (AgentTesla)", "value": "eb9013c343ab4b99b91861620223802a978910ccc099ecabe8b3a00bb59c6309", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687679006, "uuid": "e30c09c1-ca1f-4371-9f05-dae1e085f68a", "comment": "Malware payload (AgentTesla)", "value": "518b0eed97c8d6c36d757c7bcfe129efb4f8811a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687679006, "uuid": "18403e2b-a8e9-4a03-8865-c7dafc89b6a0", "comment": "Malware payload (AgentTesla)", "value": "349dc0101a30d82f580b84951ac7547e743553345eb18ef4f3169cb849571fc392445ba961cb4e416f7c94e7070cb307", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687679006, "uuid": "9da8c757-3344-42fb-8904-7a6932cef238", "value": "T161E4121665F14A75E8795BFA92310160CBFCEA15F613EB4E1EE171F608A7B814E03E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687679006, "uuid": "479b216a-61af-4fe3-a0d9-3df9358ba08c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687679006, "uuid": "d028f6a0-5f6d-415d-94d8-2c3825a69a25", "value": "12288:70M2iNh4/mNUA9+0OB5JCrc/n4wl70BuJl9tiqvmqKTMWU:4M1D4/QUN0OzOk/GcYzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687679006, "uuid": "0c186028-8f30-4fa5-854c-2551e9cdeadc", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687679006, "uuid": "70491aa2-8373-45f3-9865-b66ed0e61aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687679006, "uuid": "2ad7949d-3303-4f3e-925b-173fa2cb1a78", "value": "ca8d7885ce82f5d2392650125fb2d333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91c4ea4-132a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678578, "uuid": "3518a4a8-b6bb-4d33-b871-cba0f0ac958a", "comment": "Malware payload", "value": "4163d9acbbc2efe8ca87d810a3795630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678578, "uuid": "445ffac5-a1f2-4748-ba02-345571a54cd8", "comment": "Malware payload", "value": "eba36a46a6dbe28723a05b69234e2c1c7e151a1767fb66391970ed100a30279b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678578, "uuid": "9888bc7a-2f77-4cba-a88c-111955cdaa79", "comment": "Malware payload", "value": "f3bb38464e4d5328e5c87853527ee5a8b44a2124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678578, "uuid": "00cdaede-f28f-4b6b-b757-c850ffc69328", "comment": "Malware payload", "value": "409da35ed2f2824ad11e7b3e04801a61eceda931dba262569831a3c547a9764dc3a42f9e4cf18bab5d98cc02edf1ca65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678578, "uuid": "961efee2-fe27-4694-8654-5e8768aadba2", "value": "T1E30612766150C23AE7CB0636C82B769C2409673F322FB65A9F6B8FB47B33A6DD144411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678578, "uuid": "93ed85ec-17c7-47d1-a251-1657a2e1edb7", "value": "587a23ee0bccf95906f888e2a3c1c6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678578, "uuid": "25a78c9e-2ad7-4d96-99a2-b669c19babad", "value": "98304:1QRUIl8dg54Ytt0B27tQ2gWimKRRRHOvQUnjmEX/My5FKEM5v36+RaB0x6cGeeem:yR5AUiVd8d/i5aB0x6bvhIRg7PUGZf0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678578, "uuid": "062a891a-3ed7-4188-bbe2-f9f406ed9afa", "value": 3799040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678578, "uuid": "a01808b6-b161-4c9c-83a1-7c6ea1dd73aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678578, "uuid": "628e8d57-512a-4f19-82bf-67be55eebe8e", "value": "4163d9acbbc2efe8ca87d810a3795630.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1a455c-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676300, "uuid": "ba988249-cc9f-4f77-b5fd-ab1ae210c869", "comment": "Malware payload", "value": "7085d07de6620ab2d56ca0c6fadde087", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676300, "uuid": "7394f637-79d2-4f01-ad42-caf6b751f6f3", "comment": "Malware payload", "value": "edf37e72ba24febc9819de10cf3844f5dd96a04bb4fe40dd683ea72abed486b5", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676300, "uuid": "ea3a1ef6-f170-4f2b-b6c3-30e55281d936", "comment": "Malware payload", "value": "a59fcc1d4166e1b47ebdcebb537d6b2664095ac7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676300, "uuid": "ec1ac75e-eaed-42e5-b790-5862fe917417", "comment": "Malware payload", "value": "ee70f0293815120ecb63e057e514914fe17df08c33d0911190a807a5cb47ff03aa24aaf863f4dc2dffa8efa347c7630e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676300, "uuid": "68d81010-fffb-4cb0-bedf-452da427b719", "value": "T1AA74E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676300, "uuid": "bc24bd90-5535-424e-b50d-2089b40fc4c8", "value": "6144:Nkzpkc86ueZHV56NwBAG9QuImtCoGRmd+BUKCP5LtuEulM:686uNNwBvCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676300, "uuid": "75473469-56dd-43d5-800d-9ca9e0ce511f", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676300, "uuid": "bf903208-cf9f-41f6-a0c4-f42a3877ecaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676300, "uuid": "c68c924c-a3b2-4f47-b540-51077cfe434b", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe77232f-1352-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687695767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695767, "uuid": "ab238150-d5e9-4849-b859-6f2ad2bbe206", "comment": "Malware payload (Mirai)", "value": "5d80fd19a9f7a7becb9f3576134e564a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695767, "uuid": "686470c8-7935-491e-9c7c-cb440f9c9dec", "comment": "Malware payload (Mirai)", "value": "ee870de28cf842759da6a8cb13680a5d15894ee943f119a135978ebd7769a0cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695767, "uuid": "d3d2b274-760e-4cc2-82af-910695c5a3e7", "comment": "Malware payload (Mirai)", "value": "56c56113e91301b8b12da412017593c183c4f786", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687695767, "uuid": "38e47757-d6ca-48a3-af6c-503a02f898eb", "comment": "Malware payload (Mirai)", "value": "f6dfaeec54eadc2373bb4a6834f64697a8502d6926b424952d805b07264c92453f52031320b9b4d0e939fd4863fee710", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695767, "uuid": "bd8eb2ab-8758-4601-b133-9a1f49deb1c5", "value": "T1E313F118C1C34235C3DDABF054E58F8263E66A9E73B4D8C0A3981FF51B91A0ADB2E1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695767, "uuid": "3f3ba0e7-a0af-4521-b110-f9569273eebe", "value": "768:TOlCdn7+w+yOkmCfkBiCZ70R3cR5OWJSn28gg7oUiszQ1KBaOruaY/yo4uVcqgwF:uWnaw+dkmCfkBJZQ36kuY283oUieQ1k2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687695767, "uuid": "502e9170-f4f7-4934-8d06-2307aaa94c4f", "value": 43448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687695767, "uuid": "e0db4bee-6d3e-4880-a743-ae470ccfea03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687695767, "uuid": "5d610e90-1647-4e79-a734-ab2cb3b4e4d2", "value": "5d80fd19a9f7a7becb9f3576134e564a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3ea562-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687678821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678821, "uuid": "6c47a438-6500-4c12-86c4-ffd6e5a2b5af", "comment": "Malware payload (Fabookie)", "value": "4343eb0044937539f285310dbe959bcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678821, "uuid": "185fc15f-360a-4fc2-bfad-eeac0bc0e54b", "comment": "Malware payload (Fabookie)", "value": "ee8dfab47a4dfa70826a72ca05c2c45872cc317c94e91c48e73cf2ef361718ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678821, "uuid": "e1196d27-0465-48db-bf52-a4d582cefb50", "comment": "Malware payload (Fabookie)", "value": "144108eabae8363b233a9ac18d94f51f05ab9067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678821, "uuid": "91a34105-a22e-4a86-896e-c3f67cabd03c", "comment": "Malware payload (Fabookie)", "value": "89dc9487309f4fb0de9a372bff3d88acbb6ab5cc3b69c623b991afe0475503837d465c0885a4367cdb0bfd83c7827af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678821, "uuid": "dafc457c-a773-4db7-94c7-d51d4e706865", "value": "T1DD949EE1E35040E5D477C2B982734B63E7F27C285B214ADF4659B6292F337D28936A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678821, "uuid": "35e68b57-81ea-4b6e-b69a-0cd3700da53c", "value": "d1884757532ce7b0014241f40262c929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678821, "uuid": "a9adc479-3d89-429c-a9ec-e1c3e0792cf9", "value": "6144:ul073J3XYf1K4tit9rVDWso3T+cbJ5JIJAbW0we3:z3JnYNKP7x5oCIJ5MZ0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678821, "uuid": "1e1aef61-39d0-4135-b191-1d74c261f04e", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678821, "uuid": "1dddc8f9-94bc-4be9-a617-740940976d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678821, "uuid": "c70c1878-9b45-4c3b-b933-7c58f25891a9", "value": "4343eb0044937539f285310dbe959bcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0355c9-1359-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687698477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687698477, "uuid": "2e30be3e-c133-4122-81c1-3b54386e4f22", "comment": "Malware payload", "value": "9ec8d5bc205fded2bf9508f7194f88f4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687698477, "uuid": "467cf4df-e529-4668-adca-0c7361febc83", "comment": "Malware payload", "value": "eebfd0a510f5cf27e40b16f9e74f23f50a24b43a8d370eb6244ace00b53e69e2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687698477, "uuid": "8f4bc748-bda7-48f9-91b3-a659791f99c5", "comment": "Malware payload", "value": "7009deb529f2d4355727f73bf586f02415c2f492", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687698477, "uuid": "5c606067-f2c9-4568-897c-4d344a9dc700", "comment": "Malware payload", "value": "6e1d35c80ff99bcbe30696bc0451a13b122e2298f32b0fbb6dc2a7d3d7cf63f31a750a5b3692675bccdd047cd0458eb4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687698477, "uuid": "4224de4d-6906-4ad8-b71d-b95503e53771", "value": "T1559382D6AB66DEB4DF11C2708DDD82A01361DC009A5E4BC37644B23A7FBE970EE815C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687698477, "uuid": "03dfc421-5644-4af2-9685-68db60428ea2", "value": "1536:YveZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA0VSNcd52CibTXVNpity5pgKejDzGYK:Y2Z+RwPONXoRjDhIcp0fDlaGGx+cL26G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687698477, "uuid": "f366a664-e986-45e1-a421-58468f666dde", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687698477, "uuid": "6277aeec-3c76-4988-b0cd-594c9b7d7aa4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687698477, "uuid": "da0a9502-7367-4d6d-b415-27233265e1f3", "value": "outfile", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3484962b-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678678, "uuid": "95095e52-2c90-48a5-933f-4fbb5020ba6a", "comment": "Malware payload", "value": "1c474525e6433f4b0f2c32dbc4a1366c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678678, "uuid": "24ebb327-5d11-4a00-b690-d5f1a88405d1", "comment": "Malware payload", "value": "f3d5179fc7d84b39baba500f7997f440c7544be0322ddbfa9d24db3df2aacb96", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678678, "uuid": "989e8ee6-6dc9-4df4-84bf-4df7cd3c8b86", "comment": "Malware payload", "value": "dd8742a98a09896f6195ec2b1e9b3f8f51586d5d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678678, "uuid": "aa74a297-8c27-426b-bde4-1ba1d4b28045", "comment": "Malware payload", "value": "cbc398de12437588caf35b0cf5509a6d2e3da8566b27160a4132cc49c88192c1e51bca37c9ffadfbc9e97acb21854934", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678678, "uuid": "7c424058-1f99-4a21-8765-2589a9246e28", "value": "T1242513975FBBA23C0AED1785103E12CE3998DEA44A8184F5D77601BFD857B5D30AFA08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678678, "uuid": "a09fd4f7-8465-4f50-9094-5c7c244e4031", "value": "24576:+2RInLUAY1l111D1W1/NxZWhhhhni9gi9Pi9ni9Pi96i9wi9Xi9Xi9Xi9ELK:+C0LVbxZWhhhhnlaoItRIIIvLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678678, "uuid": "32e18b0b-1720-4190-b3d7-e0217b6ecca0", "value": 1011586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678678, "uuid": "103cd71e-812c-4bb8-9a88-e38da4fa4ac7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678678, "uuid": "815e0452-d9f8-4eb6-90f4-c7c87f3dc694", "value": "1c474525e6433f4b0f2c32dbc4a1366c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d43c368-137d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687714045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687714045, "uuid": "1d8c189f-304b-4061-ace0-fe9ca26d5abe", "comment": "Malware payload (RedLineStealer)", "value": "25f1279e5679bab1dd15d8492102eb8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687714045, "uuid": "df9c4cab-ddb3-4145-9372-9b8f15fe66ec", "comment": "Malware payload (RedLineStealer)", "value": "f3e50b2a5c92c86f9d58ea59671533ce4499d1219517e377e198202c80ea6199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687714045, "uuid": "ac7e0ec3-4d1e-4e92-8512-e76a1fb53599", "comment": "Malware payload (RedLineStealer)", "value": "54c2e5818ae2a166a5cff466ad7335bdd8484be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687714045, "uuid": "22a8e94e-61d2-48d3-8c5a-f29f83fc3bd1", "comment": "Malware payload (RedLineStealer)", "value": "41138ce383d504f9b4db44b599f05805de1e8132da242e0bd90df7c48d1c67e991587a275966989b62c24b0be56d364c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687714045, "uuid": "5fcdaba5-3d0e-4621-99bc-2fef96375abe", "value": "T15C0601366E25C1B5E3C3DB3AC753C06D5E282A7C35AFB4842B690D86396B57CD1B3A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687714045, "uuid": "2d6e0d66-7fe1-4afa-b2be-ebfa2a9223ac", "value": "2f75d5eb7b5044ea933e68f9c1b1f664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687714045, "uuid": "4d4e277e-7073-46a6-9b75-3ff576a862e7", "value": "98304:4l0f8sI0Zucw68nHEk/X5zScd7GBvQO3oTHvQzLNku13P217tqxznK2DPbxWNPie:Lfpul614zSc45hzLNkPeFnK2zoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687714045, "uuid": "464e9d88-fbc4-4241-ac9f-38d61c59f4c9", "value": 3806720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687714045, "uuid": "32a9b76e-64e4-4301-9e86-2098d1fa549a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687714045, "uuid": "fa315858-6c6a-4191-977b-a6d05490b054", "value": "SecuriteInfo.com.Variant.Lazy.355257.181.17189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1507d36e-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687678625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678625, "uuid": "f1ac15a4-a3bd-40f2-af4a-a9c690faccf4", "comment": "Malware payload", "value": "0f0b5f229d0c9e6f5320d16fdc5ab4ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678625, "uuid": "42d45f00-45ff-4957-ad7d-5d60beda67d4", "comment": "Malware payload", "value": "fa42f0a31fa3ef42460b614e1ff9d23a7cd9ecec22d873df41022d4ffec248e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678625, "uuid": "06b741db-7f2f-4428-bc2f-054a1ec451d2", "comment": "Malware payload", "value": "364475f2dd682e39b2fbec9828401cd87186ca0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678625, "uuid": "e4794db7-7055-4adc-b2dc-fb7628839d4f", "comment": "Malware payload", "value": "e13f90d3f511e494a3944da600059b2f8ed33ae953b2a67558f28beff2023553b85b22efadb6792645538ca8a2cbf491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678625, "uuid": "4298fffa-2bef-495d-b1b1-63e64294fc70", "value": "T171D5113952A9E8B157CB89B8DB5F447C78026A9F3A6F011C9D2F9FCA333097CD941A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678625, "uuid": "978f5431-2b46-41df-bed0-5888d0b396d3", "value": "49152:8OF4jhwJX8YCYu8AULhCVvtPMuh7q2ripvCd1KACzz21TwDPCvvnwEfup:8OF4jqJX8YCWAULhCVvtPMuhO2ripvCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678625, "uuid": "16b7f37b-410b-4a71-8975-4f22c851779d", "value": 2791371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678625, "uuid": "9533d3d3-5437-4102-a531-e274014dce2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678625, "uuid": "99661ba0-05fd-43e7-a26e-559aca4c61f0", "value": "0f0b5f229d0c9e6f5320d16fdc5ab4ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99ef26a-139b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687727085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727085, "uuid": "2aa5eda6-ea19-4987-8eae-4b59bf9a5ca6", "comment": "Malware payload", "value": "131b8279f1ee7a282d8ae1dcf2d51e1b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727085, "uuid": "eafc177e-7fb9-4f37-88ea-0f147aa02859", "comment": "Malware payload", "value": "fa7698a9fb7c0ef1e599d018b0c2e7712028f4a0e8ff917e1ef7926f3d3f0ab2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727085, "uuid": "bc1a93bf-f163-4283-aca3-09cce76fa3b1", "comment": "Malware payload", "value": "88f3337f12ecdc4f7017407e2b4d9054f9c4801b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687727085, "uuid": "6fc98875-701d-4f91-af4e-a042ed3c6b4e", "comment": "Malware payload", "value": "aaf7f40bac01a72afe27478540b08fed6a41577d41c58ebc2d697cbf82a6cdd18c8af8d7e6a88718e698f968a61086dd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727085, "uuid": "dc25b16f-cda0-4a1c-8ca1-41c6ebe442cf", "value": "T18255122C6BAC5E73EFEF03B4F456610C47F08A96E6F6975A1A8561F99D03B60E4001B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727085, "uuid": "65e8357f-e5b1-4a36-adf0-5941999942bb", "value": "12288:z5WpCeoGOxczAUtoj3MjmDQfh2wbzPqdpcUWDHv8B4UXDbSWsoZ2QWZGLPKcMJpj:knXzA7N84wHQp5JXSWaWqJpqUGe1ZeGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687727085, "uuid": "94494093-6fb1-432f-8d38-e708d03d0995", "value": 1282560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687727085, "uuid": "d5604974-2f53-480d-8c1e-4792cd0dc391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687727085, "uuid": "d846b18b-980c-489e-ae5c-6ef36a06a772", "value": "131b8279f1ee7a282d8ae1dcf2d51e1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ff2ee2-1325-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687676323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676323, "uuid": "79541c39-d164-409b-93f2-fc7c2562fd4c", "comment": "Malware payload", "value": "485652c996ace2a6da40036d0b76cf89", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676323, "uuid": "fb1dfc9e-7eb1-412b-bafc-9acec1450393", "comment": "Malware payload", "value": "fb714858d8e54150ed04ef535ba39f929e17e239569a6a87a5ff1de1874d22aa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676323, "uuid": "109ab590-3707-4b5c-aec0-34e0510512fe", "comment": "Malware payload", "value": "0838acc2a46a13c58f75c39877a9528e4abbad2f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687676323, "uuid": "6d7fd884-1ebc-4fb9-9175-f9e3958d23ed", "comment": "Malware payload", "value": "29bcd29a0216b5d4c6d5ad6fe9f1620920e461e49a3149ccae7f074ce8c3a361c5a1ea25e048d47d26978a06753aa8d3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676323, "uuid": "e98d5da1-581c-492e-bf09-eb8b54b0c5f3", "value": "T1B174E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676323, "uuid": "d4c146e7-4fe9-4e39-bdba-7a2c994578fe", "value": "6144:Nkzpkc86ueZHV56NwBAGgQuImtCoGRmd+BUKCP5LtuEulM:686uNNwBCCTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687676323, "uuid": "a108f498-b071-4752-8fa9-84948c45a30b", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687676323, "uuid": "b4274ee0-0551-4eeb-b759-48e5686610e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687676323, "uuid": "caef4b7c-620b-4a62-aca2-d0afe2f5339c", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22666676-132b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687678647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678647, "uuid": "c170d8ad-244b-480a-a914-9d9f7c67def1", "comment": "Malware payload (Rhadamanthys)", "value": "69773ff9cddbe895d0c1a7c381e15d81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678647, "uuid": "860df2e7-d770-48c4-a691-6d00c7acde67", "comment": "Malware payload (Rhadamanthys)", "value": "fc6ddb1f7644597b84d14e3efa4cd1a1d1ad0083141b3fa2a613cd3c092f6505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678647, "uuid": "6e537e62-27c4-4421-af43-1568e223c838", "comment": "Malware payload (Rhadamanthys)", "value": "15a2796b6b77bd1f03eb0a30cfeb7e3c2f0a0631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687678647, "uuid": "084b1679-0bc6-48e4-a6b1-a18fb7824ffb", "comment": "Malware payload (Rhadamanthys)", "value": "d2dfceda69a12bb98e06e4ca7ed4c0f4e17bcaa2acb14ac72f66e812975b7e899c8bc7178a008f196ef3229e3a4184b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678647, "uuid": "b6e45289-ba6c-4983-9faf-a01b1293f373", "value": "T186A5233413588F72EDEF0374B05693064BF6C89B7A8AE7BF543996882853F71CC125A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678647, "uuid": "0c72b00d-d107-4b9b-948a-a51ac312f8f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678647, "uuid": "d03b47d1-d8c0-44b3-b267-65961f594b00", "value": "49152:NZVlrVqLTyYBYTKiJHZ+guvLN09WIfw8eZrjwMmPK:7hIGKiJk7LN09WKOdMMmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687678647, "uuid": "a174fd50-411e-4114-af66-b8eb46f1e251", "value": 2116096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687678647, "uuid": "bc0f90da-333e-480e-a3a2-78da1d554968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687678647, "uuid": "f20520b1-9ef7-479a-b119-37c625dbcb6b", "value": "69773ff9cddbe895d0c1a7c381e15d81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }