{ "Event": { "published": true, "date": "2021-08-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-01", "timestamp": 1627862582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d88810ad-6551-4cd8-93de-3cd9fe0d43e7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3579bdb9-f313-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627854939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854939, "uuid": "f040afb5-4623-450f-8016-afebe42d074b", "comment": "Malware payload (Mirai)", "value": "4780d3511aa52f7518c50e26d7e39d3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854939, "uuid": "1521cb6b-e13f-4316-9512-dcb346d8ff8c", "comment": "Malware payload (Mirai)", "value": "012fe70c71ffca3a7fd4f4a2a2a1eee3d8c37a05d9b725f8372338fd8faf9b42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854939, "uuid": "f277eda3-41ac-47de-8b3a-cfec0e7b1274", "comment": "Malware payload (Mirai)", "value": "e1d302cd679a0c48186ce2f7e881f06c60705b53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854939, "uuid": "f4b340c2-6a3d-4d63-9371-7fb03cd0e015", "comment": "Malware payload (Mirai)", "value": "e9d518eab6ba7376c46df32068950f645ad62d16c4e6793f612d40f060aa18ab39abbdbadc1c1959090842e448072ecc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854939, "uuid": "3cf94363-02a4-442d-ad77-bffcf027f9ef", "value": "T154238E77C8A91EC4D7958574A12CCA3A1733D418A29B1EFA1A47C57AA00BFECF1093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854939, "uuid": "2aff2d03-edc0-4de6-980b-0c303247338d", "value": "768:Sa6Z21e8mofzVh/9VPHLLCWuWo3BOlzMCYAuaL/:Sa6ghXzVh/9VHop38wCYBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854939, "uuid": "53970a8a-ca42-4969-9217-4645ecc9a7a2", "value": 46116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854939, "uuid": "bb110a41-193a-46e2-a4a8-9a618e5abe6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854939, "uuid": "c58d3c31-358b-434a-a799-2f238e99f0f5", "value": "4780d3511aa52f7518c50e26d7e39d3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b24689-f296-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1627801324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801324, "uuid": "f57e63e1-2bd8-4f80-813c-06cff51bfa11", "comment": "Malware payload (Smoke Loader)", "value": "9e5fea777637a2a611c00c482da0ed6a", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801324, "uuid": "33b1af80-19ac-46ee-8f0d-1cce27dbace1", "comment": "Malware payload (Smoke Loader)", "value": "028fe7d08ab916d5239ccd8bcfdcd885ddffdf3821abc01958490daeba45dbec", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801324, "uuid": "e799f65a-61ae-47f7-b70d-0977597d3787", "comment": "Malware payload (Smoke Loader)", "value": "3bdca1bca18a556fac1702b1a84a1a716bc34add", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801324, "uuid": "4b80ea98-cbd1-4fcd-b603-670b8a3bc484", "comment": "Malware payload (Smoke Loader)", "value": "4ffd24451ae014ff7dbb75a35952f1cb716c3b88b5c218fa2dde373be57b36a470a275601679907239d4a4c92247495c", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801324, "uuid": "2713b757-2d02-4351-8ccf-e810b7ca95b7", "value": "T1F774AE30A6A0C035F4FB12F445BA93BCB92D3EA0976460CB92D566FE56346E8DC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801324, "uuid": "10fb0985-6488-4ac9-be14-ef0234566f3c", "value": "f1a12d7f969c04eff5705d2d791fa891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801324, "uuid": "b6275f05-a871-41e3-9f6c-57887f860355", "value": "6144:EKCn7oaUvHnWGBDVc0JexaX29trK9mlit:4n7oJWGBDV2gX8zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801324, "uuid": "48520769-1847-483c-a87e-ab8da97637e8", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801324, "uuid": "7c11d99f-de1c-4c1f-8210-2bd61c608daf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801324, "uuid": "efd33a01-b599-4372-9ca2-704e97eaceb3", "value": "9e5fea777637a2a611c00c482da0ed6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052a1369-f2e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RevengeRAT)", "timestamp": 1627833383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627833383, "uuid": "de12ffa7-3d14-4d2a-b727-da45d27b6f5d", "comment": "Malware payload (RevengeRAT)", "value": "e45a161ea707e05ead92d304c63566d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627833383, "uuid": "9a049360-86d2-49df-bf47-6bb432c01a13", "comment": "Malware payload (RevengeRAT)", "value": "040024c107a93d0156b82ecc489b20ee0fdc6a8c7dc5c1c15830b8caad36cd9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627833383, "uuid": "1eae9f9c-641b-40a0-89bb-0c2b1208f239", "comment": "Malware payload (RevengeRAT)", "value": "56feb8b5402769992799ee1d8310efcec132940c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627833383, "uuid": "6eadd115-d8ed-4bfa-8cbf-3e30081da9af", "comment": "Malware payload (RevengeRAT)", "value": "5736468205e1ff99dc64c17256bb18c29dbc530bcd01b2501c170715c649836b8560ec26c957e0768e32045c119d3f39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627833383, "uuid": "9f511ce5-36a8-4ecf-bdec-0d0dbfc1a746", "value": "T11A82F89A77B99A02C1BC237D05A6222147B2CB4F9515C76F2DC490EFB3733D1AA447E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627833383, "uuid": "a08019db-2522-4307-87da-17147fcfa3aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627833383, "uuid": "1b118b03-0c86-43c4-89bf-700fa3ff24e7", "value": "384:xfJoGj4nouq2Y+gGoiwH7ab9sVKfcyYC+2c:/oGj4nouq/KoieMEF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627833383, "uuid": "8c7961e3-d388-4ef4-b8a5-ba9bfa0518d1", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627833383, "uuid": "873c9165-f6e5-44e5-bbe4-6c379c3a8722", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627833383, "uuid": "97661e10-fc98-4952-a0c1-25957ec1ec84", "value": "sBPMSpHW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b81766-f305-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627848839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848839, "uuid": "9fcfd79a-a1b1-40e5-bb66-3c7b82b47392", "comment": "Malware payload", "value": "ffd0b4c129d0a51d61ff63f891198bb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848839, "uuid": "96318972-d458-4351-af57-3b7d0e96ca48", "comment": "Malware payload", "value": "047bfda0c6e053bc3fd0a85ac4414a86de6abd88f50694da4b9e1f2a3fa8debe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848839, "uuid": "dec5a403-cad2-42f8-8e78-e115d9709ba0", "comment": "Malware payload", "value": "03fe8c0731c02a3d1e7c2ff3d3d0b8b221d0a44c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848839, "uuid": "4d944873-c8b5-4886-ba8a-27f6b47e11e2", "comment": "Malware payload", "value": "f007d2aaef7427d81e748b3a79a90f79c4f9d384793e9114042884a586629af99fe74c4109326ada7b2f0c572948f8b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848839, "uuid": "23033d73-9ce3-4ebb-9246-0fce81a0b1a3", "value": "T1FDB5E09A9792B055C9251F356A9BFC72CAA39D1CD500C3DA90F0BF0335B9AC3B95C60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848839, "uuid": "92f0eba6-eec6-4f7c-a091-13782e333f51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848839, "uuid": "f2773040-a335-4d16-a080-78d7aa13efe0", "value": "49152:x41iMNWai+WAo6xaPr1FhCv6WAajg5IgAzxcw:x3sWWj4The6WAaFgA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627848839, "uuid": "6ff1efcb-8c26-4495-b2d2-6173779cee1b", "value": 2312704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627848839, "uuid": "d2998df2-cebc-49ab-811e-8776d4c7b8ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848839, "uuid": "586b148b-271e-403c-86b2-2c4df5cbcdee", "value": "ffd0b4c129d0a51d61ff63f891198bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6f4e08-f2f2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627840963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627840963, "uuid": "1f5344a4-6342-4b20-a261-46e0402cee85", "comment": "Malware payload (Mirai)", "value": "33b75dfbcbba286ae62034b48d23bb77", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627840963, "uuid": "2718537c-a96f-4495-b268-449e3490338b", "comment": "Malware payload (Mirai)", "value": "07a120b04a26f7e429499e29852fb6ad105d6f9a655ee9a4cfe064847ddb72c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627840963, "uuid": "d25c2fea-5b2f-404a-8409-9a683568b426", "comment": "Malware payload (Mirai)", "value": "b5a867006781df461a3b117340ba7452aff60a90", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627840963, "uuid": "807c01dd-80ea-40b7-aaa2-ce7abf402043", "comment": "Malware payload (Mirai)", "value": "700eb09b7005735040af874c1bc66da4f0e11f719912d1532a2c58f7494e085534bc2deed9fe9034abec0719f22f3c77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627840963, "uuid": "35c00470-1c38-40b9-8b88-30a1132d567e", "value": "T1A964029BEA627C5FED5B4FF021570A4627F8D2D6D3875540B328884839FE242A3647CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627840963, "uuid": "d508f275-0d67-4e27-bcda-fe71902cd5cc", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6cog3Q:7O/QJHZweEL/NOjCHm7FZZncQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627840963, "uuid": "75a03a29-7f75-43b5-b705-0990db19da1e", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627840963, "uuid": "70d0911c-5e1d-425d-93ac-456599192724", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627840963, "uuid": "75accf6d-e7d9-4647-aac7-0fbeaa9a7bd6", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59560de-f313-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627855180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855180, "uuid": "db8c711b-a87c-4a64-8a02-84b839c8653f", "comment": "Malware payload (Mirai)", "value": "bf0a9c9ac111a651818b8e64da85da32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855180, "uuid": "d8421a5d-9675-4d2a-9f0f-81ca5b7545c2", "comment": "Malware payload (Mirai)", "value": "08fcf0938cba9aac18dddf4348abd921445e87985db8298d9854c8db51cdb5d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855180, "uuid": "4cea7eef-cae6-4f11-93be-8b5f8a7abdc0", "comment": "Malware payload (Mirai)", "value": "3ed95861269acccf6c8be8fbb1409ab8e21b5794", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855180, "uuid": "9400882d-3856-428f-8d47-0997222cbe59", "comment": "Malware payload (Mirai)", "value": "3dfe9f13cfb49ebfb67a230a78fd2d0c0b1d3e5ba7ca87955ab2bf98a300a54d1284e5d7cb4442d6ccdc3b9f297be8e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855180, "uuid": "c05961c9-327b-472b-86c0-a19e03d06563", "value": "T1D3333CC6F401BE7CF91FD6BB4633490DB920A2548193072377BBFD97AC322A85A12D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855180, "uuid": "a95c4aa7-590a-4424-8d82-3f20ae0a9292", "value": "768:UceKIZ8v6XCqeOXiBIStGJsvOtMnjvuTFSwQ8deE6N7l68D/Fyqh9:vXIMqqVGi4IjvxwQ8deN7o8zFy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627855180, "uuid": "880b51a9-1309-43aa-adf8-d5097d5bb602", "value": 52280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627855180, "uuid": "d9a04159-46f7-40c9-af14-f76dc346ae0c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855180, "uuid": "b8d0e355-00d6-4621-8b56-5e158733bbca", "value": "bf0a9c9ac111a651818b8e64da85da32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5068794b-f317-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627856702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627856702, "uuid": "2e33a372-f8d7-4a74-ab2c-84ce3beda40b", "comment": "Malware payload", "value": "ca9e51552fcc1c9c8bc1f24575a79a34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627856702, "uuid": "9c9b1b46-c2b2-44a5-a401-eccf5ab77955", "comment": "Malware payload", "value": "0b07bbc49f08cd87639c0fb15a6b49df76df564e8e2a99f59518b227db7cc844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627856702, "uuid": "5ea634a9-443d-4ad8-a5a7-dee7bc59fd58", "comment": "Malware payload", "value": "8d37d8bc1a3f116ba8cfdb0443731327f760d4a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627856702, "uuid": "59ec4a2c-dec0-4cb3-a1b2-aa02d6b82c79", "comment": "Malware payload", "value": "0bf06c5f72f4c61d8aa3a2e567906894f60ed701e4956765a6ba3da97bb27d0195832d8b03779a55597ad05699eb73e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627856702, "uuid": "7f9256cd-2f69-4ea9-b7f6-1243016c63d5", "value": "T1A664CED37E508922CE278B3050269F510776AEB7BC22F156695DB2380E732EB3D5B853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627856702, "uuid": "ecf769da-a9e6-4fd0-ab93-06ed73199f34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627856702, "uuid": "861771ab-da38-4bd9-acb4-f9d758cc1d36", "value": "6144:99brlY85lBILaxlG7Ib+1KSHoUhjxtbU+iZNWEj2AYE7:7Zv5lBSQCIOqU3JIsEaI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627856702, "uuid": "ce456860-20d3-49a1-a2a6-fa9693b4d3cf", "value": 317056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627856702, "uuid": "6f6dd3e1-4797-4205-bb1b-24cd8d0469a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627856702, "uuid": "78065f58-5750-4191-a533-7e969d38b0fb", "value": "Minecraft_v3.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae76c2e-f2c7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1627822548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822548, "uuid": "46a3c78b-5e5d-477b-8078-07f2d54af4a3", "comment": "Malware payload (Stop)", "value": "d23f5899352f63e1e45e615ef6526f10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822548, "uuid": "a2a52160-ba5c-4a33-802d-fe28fbc210c0", "comment": "Malware payload (Stop)", "value": "0c1571e0f22ecc1c3ed2b80ee90df329d820e287ac0be834aa905726ea96887e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822548, "uuid": "f7470423-da8c-45d3-80d5-c695f3af06d9", "comment": "Malware payload (Stop)", "value": "be86fce35c64c758a6a824fb09e94846b934a54e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822548, "uuid": "576bbb69-1313-49b2-b3e3-37383f45a148", "comment": "Malware payload (Stop)", "value": "7ed1dae6a6f629b29ee4b9f35813a278c0d702d4d1f045d59ac5d18facc6ad786651bcba631bd91a6e94a34d17b96399", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822548, "uuid": "d825a211-074e-4ba5-afc9-1ae900dfdde1", "value": "T1C40512113280C172C3614A305961CBA07728B9F599794D4337A46BBF2EF32F29A7BF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822548, "uuid": "b4616a56-1a91-409b-aab3-65dc38062d26", "value": "11bc5a96dc8b455509d3ea367d443d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822548, "uuid": "bea17887-1b4a-46cb-9a7a-18053ba82b42", "value": "12288:FeLPKC5IbDprrWu5xDH/4COf0jeeKtX1zWb/Mrs5gK2NnM9zgTOR1bs/7m+FE:F1JSUz/4Eed1g/Mrs5+nMSTOHbS7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627822548, "uuid": "b73cf0c4-29c9-4fcc-b7b3-b91c920a2231", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627822548, "uuid": "ac3952b2-3ae3-46de-aa81-1dda48fc3c42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822548, "uuid": "1df78063-9117-4684-ac2c-64d81f10f909", "value": "d23f5899352f63e1e45e615ef6526f10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51926292-f296-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1627801299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801299, "uuid": "276ae05e-3dbd-4bea-a6be-e719d1e8d2b0", "comment": "Malware payload (ArkeiStealer)", "value": "ad91056d751fd1a37689daaa789c2e19", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801299, "uuid": "570ff573-9acb-45ae-a1bb-c15119c61ba9", "comment": "Malware payload (ArkeiStealer)", "value": "0fe40289008f481b84b73f77c87efd5a737df057e19d9799a7c8e5b0b3a29539", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801299, "uuid": "bb711156-9c38-477b-a2ad-fa99dcac2acf", "comment": "Malware payload (ArkeiStealer)", "value": "52b17f69cb9a921a678b8d7ed17e8a490c10a93a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801299, "uuid": "b05f55ae-d52e-4494-b334-4f9b79d4597b", "comment": "Malware payload (ArkeiStealer)", "value": "2610677626ffbe72217c38374ba81c82f84d9ef49d22d51275f59a38cec251d91f318080568d80a0e2c4990d1e2f3447", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801299, "uuid": "639a544c-5c3e-42b8-a06d-61adf2ceba1d", "value": "T1F6D40179321C902BDFAF9AB9977285D20271D35FA2976B6F0574E2F02729FE144400BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801299, "uuid": "3843c38b-77ef-45e7-a4af-e13d23b9c0af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801299, "uuid": "da4335b3-d30e-4ddc-b136-345bbb7393f0", "value": "12288:S2Vk7izDbNku5ZuX86JY1oowOZ6XxAiVrjJfostVYrtIj:Sr49ku58XfeXv6T7XHstIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801299, "uuid": "ef459642-4abd-476e-a3be-cbb58b6fa144", "value": 613544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801299, "uuid": "35a4f605-9193-41e9-b777-b13da09d1131", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801299, "uuid": "60e37536-1e89-4387-b985-d03484dafc4a", "value": "ad91056d751fd1a37689daaa789c2e19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f2cd98-f313-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627854933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854933, "uuid": "28c55d00-8588-4833-9ee2-704c37cf197d", "comment": "Malware payload (Mirai)", "value": "0e71c5e7f7a64093ec313c0e4faf044b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854933, "uuid": "5ba55ea4-5a9c-4490-8494-b564a8e9763e", "comment": "Malware payload (Mirai)", "value": "107e0ba2bf4f976bf489d90631ed80a4a9fa6897b2cc5e728130e0747e9cbd43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854933, "uuid": "7aeba179-990d-4179-967a-b3bf05f6ec85", "comment": "Malware payload (Mirai)", "value": "e78440a77d43cffd7cd545e31e3a1049308de1b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854933, "uuid": "cc8d07da-0561-446f-ab18-adee366e30e3", "comment": "Malware payload (Mirai)", "value": "c7acff85442b44b6d0020a081d7670565b45f79c73b5cfc0110f9759c347549e8069b4c0314be1057216fbee90eea23d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854933, "uuid": "acaa27df-01b4-4266-ad6c-59658e3f54e5", "value": "T1CC2302421B245401CF943E7FEA98C312EB9F6B76D0A92AE076A448473F41E9235E4FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854933, "uuid": "092a1443-a6b0-426c-8b96-e7472e88f3ee", "value": "768:0Hq8XdG1zv6dgQqzo/8r0Ak6DOXz9nDK1rNS9q3UELbyBZRUpjx6+KNn2Ca7:0Hq8XdKziiQL/8HKXND6NHLbSUpk5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854933, "uuid": "fc597b95-45d3-468c-be13-44b16c475667", "value": 46856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854933, "uuid": "8e87f579-e3d3-49f9-9b93-86d6d1de11a6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854933, "uuid": "834dec4a-9d1d-4533-ba05-95a41095fad3", "value": "0e71c5e7f7a64093ec313c0e4faf044b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69a669d-f2b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Neurevt)", "timestamp": 1627815642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627815642, "uuid": "e98f8019-0963-4154-8a81-d223c7626016", "comment": "Malware payload (Neurevt)", "value": "c46f1a56503f218c2977b4b42f5aa84b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627815642, "uuid": "0474aadb-fcfb-485c-84f8-82849f35629d", "comment": "Malware payload (Neurevt)", "value": "144c0621ca5ecb402de01d8f10044f92a2ef917522e4b4955f3760bb17095bac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627815642, "uuid": "38e7430a-79a5-495a-9df9-d2ab05a41097", "comment": "Malware payload (Neurevt)", "value": "25449ec8c765f94ffc284022374a9139dc46ebef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627815642, "uuid": "f7e7203b-591f-44fd-9db0-e006abb224d6", "comment": "Malware payload (Neurevt)", "value": "7e6f6438eeb627b17c40abf66cfbf775f270581c5c7d3f48fd449d4365ccf8c1b5e2c07a74f9887df8628a107f341469", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627815642, "uuid": "4faad155-dc85-4be5-84ba-68dbd55c30bd", "value": "T170C46CA063597E8AF4556D3A12E56627C4E07D326B0FD0166F832FABC27DDE0CA15B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627815642, "uuid": "a1af9d3c-b2c9-4f13-99a9-42776599187c", "value": "2b2756717223a193efc4a129f78f966e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627815642, "uuid": "4f2c7ebb-c22b-4bf0-9d5e-3d2c8c395316", "value": "6144:fx3+m6HONThlgxVlAwiGURZKgLaXEBXON3dTmwsXYXjxPkQv4RYj8yqrK2BhG0Oh:f8UPgKIgL0eOnTHscPmvOOp1beWNGxdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627815642, "uuid": "b9d03fd8-8f2e-4d98-a079-39e6f7a35246", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627815642, "uuid": "19651c6e-a4c4-4be7-aa65-ba30578a6994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627815642, "uuid": "cd232e97-7ca0-4cfb-96cd-2c90d06edb6d", "value": "144C0621CA5ECB402DE01D8F10044F92A2EF917522E4B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536fca89-f2a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627809462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809462, "uuid": "55b0cec2-a33d-40ec-bc14-5bc2ce3ff9fe", "comment": "Malware payload (Mirai)", "value": "ef17d599c1296e069d412e075d29783c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809462, "uuid": "72796f17-e08a-4770-9255-c97358e05183", "comment": "Malware payload (Mirai)", "value": "179a36654f957997dbbac8eb8835279ff653982039d0705fda62c843b1a23227", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809462, "uuid": "bbefe494-d8c3-4bf5-a978-8addb8c87dea", "comment": "Malware payload (Mirai)", "value": "974cebb978557005e6a82bd5f64cfcb6c45ad2f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809462, "uuid": "b0e4727d-a5fa-4ddb-9101-e9e6afe204c7", "comment": "Malware payload (Mirai)", "value": "3e1a9c3c2d80cf1e7022f4e27b52205fcf2b91b66f7ce6fd891d4f85955d41792afccb44499bc8b2e1add73660735d66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809462, "uuid": "7d9963bc-6bde-43b8-947f-a84cd4711c52", "value": "T1D8A30731A641C973D14305F211A7DB620D32FEBB1A6AAA96E36D3CB0DE360C1B561E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809462, "uuid": "b261a573-b2b9-4986-b3fa-273a6a6e2a14", "value": "3072:gjtwgA6UlYzZveohR9kIEtfdGZmmFVcqq0G27ZT:gjhzt3mIEtfAmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627809462, "uuid": "8fa50174-47b5-41c8-85d3-4e5a90e6ed9e", "value": 100267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627809462, "uuid": "25ff289a-ed99-410e-9f34-e1a95e1a2a4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809462, "uuid": "e81f37f1-0a45-434a-b127-33477b233348", "value": "ef17d599c1296e069d412e075d29783c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b23cc5d-f2c8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627822655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822655, "uuid": "74ecaeb5-3131-48ac-b7d3-1170e2a826d3", "comment": "Malware payload (RedLineStealer)", "value": "179bf04261648829b6608a118b2a1a1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822655, "uuid": "4e9cef95-b7b7-40bb-b4d7-d255f0c30eaa", "comment": "Malware payload (RedLineStealer)", "value": "17cc58e77877849e90ead801f4c0295a29067a8a013e8d852d56b1f4bf71f88e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822655, "uuid": "44d43970-0413-40b6-a54b-3874c664904f", "comment": "Malware payload (RedLineStealer)", "value": "ace832c04968eca70baa147a3dc9499e4eb0367e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822655, "uuid": "524017ac-0aa3-4508-87ae-386ea3af1318", "comment": "Malware payload (RedLineStealer)", "value": "d39153c30d99eb1c262c9457a7026c995754cda76cb7ec29de52a0052a683751c13902602a08b713d768054695431728", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822655, "uuid": "16ac0539-21a5-46e5-a79e-2aa3e6e0cdd1", "value": "T1B974E0117280C471C39209305891D7A02B7EE8F198758907379867AE7FF73F1AABAE57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822655, "uuid": "0f9a3066-d1b4-4e17-b578-d42add7b3ef1", "value": "c8b9c145ec19b60e1b1e5259a226415a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822655, "uuid": "942b1bab-33d5-4f1d-9d80-9459c9638d28", "value": "6144:hCD5qOoyf904/z3zmndL6p4aE7j/5EYIM:hJzyf90cfmdL66P/5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627822655, "uuid": "1aef757d-34f4-4c9a-ae41-5a8e763ae729", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627822655, "uuid": "bea6b544-ae7f-4052-9af1-fcf9a5bf1442", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822655, "uuid": "254295fe-5b62-4cba-bb3e-0d5d04f33b8f", "value": "179bf04261648829b6608a118b2a1a1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec710eb3-f2d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627829046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829046, "uuid": "f3175001-985e-4364-810f-4aba9161fc1d", "comment": "Malware payload (Gafgyt)", "value": "c2fe2f4b8bbece78287a02034d827bb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829046, "uuid": "29c5ef81-2640-486d-9a02-9a42164f2378", "comment": "Malware payload (Gafgyt)", "value": "189aadd830cdcc85e5060ccea71db9e36510a81231ceffdd44b49dc927943654", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829046, "uuid": "294fb84d-1cb9-4951-a6a6-a2ce474c45e9", "comment": "Malware payload (Gafgyt)", "value": "8fdce7d13b3396976849d3be48643c6aa45aafc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829046, "uuid": "6496db4c-c868-454b-ad17-c8fb642dad84", "comment": "Malware payload (Gafgyt)", "value": "0408313beb8aaa5e7c823f265432c89861d5df0d20c877612bec6da040393e78cf37da453e12278587e27e550bf91053", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829046, "uuid": "10d535ea-268d-4024-93f4-cc36b2c63aa9", "value": "T169930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829046, "uuid": "fb26e5ed-b0b3-46d2-93a2-c6e1b9b5ae07", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOxCePczYrmREqQ4b/X7XSee:OQ2HYBv1WT/ePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627829046, "uuid": "811567af-0ed6-41a9-8d88-ee31efb33fd6", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627829046, "uuid": "36331439-dd6a-4323-8317-e4a51776176f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829046, "uuid": "e15990a5-43e5-4361-a45c-8b4dafb1b1a0", "value": "c2fe2f4b8bbece78287a02034d827bb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea30465c-f2d2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1627827325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627827325, "uuid": "c0b1e2fe-2f44-45ed-9ddf-55954a95452f", "comment": "Malware payload (DiamondFox)", "value": "dafa83d84b03fcfac9730d199c122b96", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627827325, "uuid": "74bb10b1-23e8-47cd-ae0a-d96318d5253e", "comment": "Malware payload (DiamondFox)", "value": "1a263b2603212ff1e492d9e0c718f12601789e27eaaba9a7a7048b4080c08bcb", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627827325, "uuid": "564a6764-3335-4d76-87b6-8985fd12c71f", "comment": "Malware payload (DiamondFox)", "value": "49f0f9a195c39023bd72414bdf907815a9a453d6", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627827325, "uuid": "edea6edc-cf95-4aec-b93d-1bbffdf85f49", "comment": "Malware payload (DiamondFox)", "value": "8c598c74e96d2f68edd513718f51c656b679a7838fd11b399381de415836bf4c742fca91575e439d52de731bd933c4c4", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627827325, "uuid": "a58c0efc-f107-4ce2-a8ac-8553622acb38", "value": "T144E533A137F6C0B5EA880272AAAC77B7A07BC3CC07741DD373A0D6195F6D86B511A523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627827325, "uuid": "dcab6ee7-40fd-4a18-90ae-4a3ef29d9f4a", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627827325, "uuid": "04171b95-b6dd-46cc-a879-1bacce532beb", "value": "49152:xcBff7zgcRFIMWab1+IjfHybCMFTBgITBaixfk0eW7Ox/iRzyulUEwJ84vLRaBtm:xc4cDLx0JDg2nf4Em/SzyWDCvLUBsKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627827325, "uuid": "d04ddd71-d760-4bce-8fc7-29e4acd1822a", "value": 3132184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627827325, "uuid": "7cb139ff-bb8a-46e0-beb2-3e37ff44e465", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627827325, "uuid": "d2a73b0a-d772-4088-a88a-0cd8c81a2892", "value": "1A263B2603212FF1E492D9E0C718F12601789E27EAABA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e54a96-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627808774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808774, "uuid": "6771e5fb-1a70-445f-b881-daade75d43af", "comment": "Malware payload (Gafgyt)", "value": "61580264358991bd0129392f5f9fe113", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808774, "uuid": "adc121ae-6597-42a5-8795-b7b5493d45a3", "comment": "Malware payload (Gafgyt)", "value": "1bdd2a3e29818c3bee956d3212998797577ecc6f09a4253ea0451796125163fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808774, "uuid": "53c3c6ac-9559-453e-9e32-e7cc2ffa9a9a", "comment": "Malware payload (Gafgyt)", "value": "27556bed8d2287e0a393cdcdeae11de187cc1295", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808774, "uuid": "134af804-847d-45cd-95cc-1f7cb2c26883", "comment": "Malware payload (Gafgyt)", "value": "099b32ac8a69af87122b4c4dac003527c2be5ac54337750f87889f30f4eb9509855bcfa30bf40517ec0f8ddcedad570f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808774, "uuid": "cb51caba-880a-4c63-893a-3c1d2713cee8", "value": "T117A32943A71D0F83C4DB99B12DB72BF1876DB97112A361C1690BEE900373AB81517FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808774, "uuid": "6e47d44d-1673-4694-be9b-a218a051d648", "value": "1536:TQQfc83mRkvoP9OJcegUN1cXD3z+Favgx/nrEmL49VqFjtUfkjX:TxT3rx1n1cXD3mbfrEmU9VqFBUfkjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808774, "uuid": "cacc7ecc-f88e-4800-8ee3-05711971b150", "value": 99023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808774, "uuid": "876fb99f-8240-4383-b454-af6d87189fdd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808774, "uuid": "52f31b23-c60d-4967-b740-7837b25e7bcb", "value": "61580264358991bd0129392f5f9fe113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2455d8-f2d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627828804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828804, "uuid": "b7667491-4734-4912-a249-5928ce781b21", "comment": "Malware payload (Mirai)", "value": "a0cfa37d99c01b3d20a752b22e88dac7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828804, "uuid": "86d85a75-ae40-4ecd-bb16-ce32e0736a69", "comment": "Malware payload (Mirai)", "value": "1c50ccbeba7b7b5db7099dc6b6492b05c7ec9e2d7df58a5b36660a96dadf027e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828804, "uuid": "3d292ace-053d-45e0-9d7f-35494480cef0", "comment": "Malware payload (Mirai)", "value": "966c5ee727d44ef48a05a94ce896176bf55a52de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828804, "uuid": "5b2e3ce4-de68-4300-954a-5bf0174a4574", "comment": "Malware payload (Mirai)", "value": "5552f3d9695209bcb61f12bedbfa5a2441fc6ff74b80eb3a24b1d6a1b3701aff41a648a5e4c849d5840a6483ee5a9257", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828804, "uuid": "064bfb65-8c25-4b33-ae0a-1ad0cd3f513f", "value": "T1EE534B0277684F07FAE61AF4243F1BE483BEED8025E4B588690FC7424635E374999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828804, "uuid": "b230d4a7-00d3-42ff-8931-88fb92efa5fd", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9Bv6GG4TlW2c5sjgi+DDiZ/vUBbsVf:2KbpuqJlzk5xGpJgbDOZ/vUuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627828804, "uuid": "f5b4eb2a-4321-4906-9588-f51c53e5b477", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627828804, "uuid": "4a2d2e9d-dd44-41bd-92e7-ed3331c69815", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828804, "uuid": "fce5f77a-5a44-46df-81f9-ed9feeea69db", "value": "a0cfa37d99c01b3d20a752b22e88dac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37162f17-f285-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627793953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627793953, "uuid": "cab9248f-ff2b-43c3-b8ed-e6859e25f7a3", "comment": "Malware payload (RedLineStealer)", "value": "8c36d4f1e288c3f8f6eb0be63f1c5a30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627793953, "uuid": "8f78c50a-b851-4eec-80cc-98db31f5c4d8", "comment": "Malware payload (RedLineStealer)", "value": "1e514875bf316fb915692db9e6a716d76ff7d149decbb0b2cd31a075dd349be2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627793953, "uuid": "1e73b5f4-2630-4307-81b4-1e8d2cc0798d", "comment": "Malware payload (RedLineStealer)", "value": "8a839b855bae0363eec13328e99da3795476527f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627793953, "uuid": "ef68ac0a-046a-4a06-af93-b4b0e6df8def", "comment": "Malware payload (RedLineStealer)", "value": "39e65979aeedbb5640ae199e6afa2c20e4691e4106e935c928852783a45f6952d1488e87630a21a97f8d6532bb01cd5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627793953, "uuid": "17139fcc-fffd-4086-9c24-a10d72a04467", "value": "T173D41280F550D232C39009B498608251272DEDF5CD789A472A58B29FBEF73F116FAE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627793953, "uuid": "7fc6d59e-0bf4-4279-87d4-852b0684adc4", "value": "be037a61d0fc8d95adaf9a493416af5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627793953, "uuid": "87337323-4d10-406e-b8f2-a36142924401", "value": "12288:XNI7PhYzkS6QSVSir2HdueH8xX/EfSt6if9YZEL:X67p+v6LVSGgu9tEfs6iVY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627793953, "uuid": "4d3f5540-9c6c-4d80-a71c-bb6510825899", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627793953, "uuid": "bc715532-36d7-4443-8af7-d6fd43d7f801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627793953, "uuid": "518e8c1d-debf-4fbe-8ebd-0c517b6bdae4", "value": "8c36d4f1e288c3f8f6eb0be63f1c5a30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccb8757-f313-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627854924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854924, "uuid": "feef6b15-8601-41fd-a711-5392cc970410", "comment": "Malware payload (Mirai)", "value": "6f7c3a3d7162d8e21ab588ac52040a00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854924, "uuid": "54c1c392-59f9-4d21-b957-bd3bc56b3b2a", "comment": "Malware payload (Mirai)", "value": "203a8c5b03f4bcf6033db2cd117cae83fe44f7f3563cd5bb9afbcaaba5d85538", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854924, "uuid": "6383fad2-bb0f-49ac-87c3-ed455028e287", "comment": "Malware payload (Mirai)", "value": "de6978471b20b17f64e77cccd65eb9873bcb857d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854924, "uuid": "844ff871-bfe7-4d4a-9d9e-43c72d8c2279", "comment": "Malware payload (Mirai)", "value": "47361627eaf9c6a016137e32cdfe3e580394e921b17ccf3aa04a8388962c77168befe3e0532f24c5448083dacfc48613", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854924, "uuid": "33892777-7bd8-40d3-9edc-5df1fad816fb", "value": "T19FA2D030547DE87AC6329C36CDBEC147575E0EEDA3D12A73140A47BCA94B3964874356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854924, "uuid": "7ff7903c-0c9b-4d44-8a11-109b9c45d79f", "value": "384:wyEdLVqASt9VNo8FY+3eZc08qTQ0ksn26j09HoClhymdGUop5hK:30LVq193FYfW0/sTsN0Ns3Uozw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854924, "uuid": "d75f4f3f-b326-428c-90e1-ede7f1f73242", "value": 22504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854924, "uuid": "144af2a8-0593-4c26-866f-eb114a8a0535", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854924, "uuid": "f8af5d73-db97-43bf-9991-bf275dc484ee", "value": "6f7c3a3d7162d8e21ab588ac52040a00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704927cf-f2dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627831415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831415, "uuid": "7bb87c31-48fa-413a-bb64-3baad70bde88", "comment": "Malware payload (Gafgyt)", "value": "02cc122b6023d927adc1e7d42b93d7d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831415, "uuid": "a8dc50a1-fb81-4de8-b5e1-dfd0c123269d", "comment": "Malware payload (Gafgyt)", "value": "20cb89a869b8288a0fc68860d2790ae33c4a06572d101ba6701666623d32c46e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831415, "uuid": "6f5b091a-41a8-48d3-899f-5d58a92c5751", "comment": "Malware payload (Gafgyt)", "value": "e894df5152917c6439a500ebd3fdd4309c8dd6bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831415, "uuid": "a9e11dee-1738-4955-83e5-5474128d7780", "comment": "Malware payload (Gafgyt)", "value": "f272c381e74bf70122090a470df1ffd46fc1601e23fe6be1d7c72aa80d8c4e17af1d30e30f15cd7baaed3889cf4c6944", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831415, "uuid": "de5c8325-b389-47c9-96c6-50c547d52b0b", "value": "T1D9733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F59F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831415, "uuid": "c88ff76f-a5f1-4f5f-9a90-1fbb5a630b31", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzM0MmLI2VOCjXUfJRk:45omr0xKFn6J+ODMmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627831415, "uuid": "13e95ea8-aded-454a-8e6e-1e52d2bbbd5c", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627831415, "uuid": "86d57cf1-f67f-4b13-baf7-ca9010d66ef9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831415, "uuid": "d2bce1ee-cfa1-4cee-a571-9c5f2d409ac7", "value": "02cc122b6023d927adc1e7d42b93d7d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a6ad37-f275-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627787100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787100, "uuid": "aaa487ea-32e6-46a2-8593-4e6233209c8c", "comment": "Malware payload (Mirai)", "value": "c3a3ecf45dc580588f885c98c8c7884e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787100, "uuid": "027fd0c3-0fe1-453d-a446-a56c0ca2d9e3", "comment": "Malware payload (Mirai)", "value": "21df1139c4bfd641ebab93bbb59a9a22ba9995102207d867c5aa5dd4a3a80bc3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787100, "uuid": "2debb402-7f30-49f1-982e-be7c35bfda86", "comment": "Malware payload (Mirai)", "value": "dc6bc8c65270cc4d54e3bff30267be7201cbdcf8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787100, "uuid": "41e48d6b-7a67-4c11-be14-6d8b2a79c0ca", "comment": "Malware payload (Mirai)", "value": "ff2420c392077780b3f7697e1b47a8ecf7ef6687d7186a1c2d629a9408df036fc55bfdfb546c1a48e64ca177f4dedaf8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627787100, "uuid": "f4e01303-476b-4157-8c7f-9aaef3cc9f73", "value": "T1F464F1CAEA11AD7AF9CA47B9796B0B0973F1CBD8D3C3B140E224C6143DAD245DB645C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627787100, "uuid": "226687a3-f73d-4469-8cdd-f0c8b29f8926", "value": "6144:7O/QJHZweEL/NOjCHm7FZZnc6qqfPqOJ:78QpZsKCai6qoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627787100, "uuid": "f99afea4-6be5-4e53-bfd2-c5c68be93a9c", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627787100, "uuid": "432ac982-6d02-4db9-8442-1f32414ecc81", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627787100, "uuid": "fd6ac5c9-7e89-4f62-9212-f95dab6d212e", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0547dc-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627808780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808780, "uuid": "5268638c-5a9e-49fd-a858-8c74532c0674", "comment": "Malware payload (Gafgyt)", "value": "8acf36fc1390e375b3c6b5a3f49c3f5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808780, "uuid": "1babad12-57d0-4569-a896-1fd8f9e5aadc", "comment": "Malware payload (Gafgyt)", "value": "21e4125e7a901e29e3637ab3263589cfdb1b27eaa9b382fbe882d59915c75633", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808780, "uuid": "aa79e048-7ee5-47e5-b990-acd7eb125d1b", "comment": "Malware payload (Gafgyt)", "value": "3ccd7340198a08fa43e0de25bd3b094335f7f6cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808780, "uuid": "82142bd7-371c-4a3e-bcca-7df72367b02e", "comment": "Malware payload (Gafgyt)", "value": "bb86f3f03a120e2f3d6c9abce252bf09380099535ba3ae52e82f6ec7d4215c74f6059e8184b5899aba2e301c9ee61387", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808780, "uuid": "d789ba08-287d-4a7e-9de1-c56e509f1508", "value": "T122B30804F8448727C2D327BAF78E439D7735566457DB33116A38BEB82BC6B982E29170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808780, "uuid": "79706167-b2c3-458d-a6ed-d559e9219fc5", "value": "3072:9lfKjGRicFHj2TJvn77agD3UmGVrQAXiUXouX:OjGF4Jvn77fwmGVrQAXiUXouX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808780, "uuid": "f6e46fac-5579-4940-9d11-5774e20e3131", "value": 112657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808780, "uuid": "97ae5fdb-6142-44a8-ba68-d62405d57377", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808780, "uuid": "ef0304fa-403c-42ff-9bd4-a84815a87113", "value": "8acf36fc1390e375b3c6b5a3f49c3f5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422eef66-f2c0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BlackMatter)", "timestamp": 1627819312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627819312, "uuid": "53559c6f-d8f1-44ec-aa37-0352372600ba", "comment": "Malware payload (BlackMatter)", "value": "598c53bfef81e489375f09792e487f1a", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627819312, "uuid": "602b9521-6bcd-425d-8e3f-614af15909c3", "comment": "Malware payload (BlackMatter)", "value": "22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627819312, "uuid": "d8cab27f-8310-41ec-8116-cfdee0768b35", "comment": "Malware payload (BlackMatter)", "value": "80a29bd2c349a8588edf42653ed739054f9a10f5", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627819312, "uuid": "af7a4187-ffbe-4f72-8d28-c6a2f78fdf09", "comment": "Malware payload (BlackMatter)", "value": "18d7abab59b38e6fc45d3f77eb3ba9a49caaa302f614ea986ac58d70d71531da5b57d0373f05932c49625985e29af257", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627819312, "uuid": "41f1ac34-0456-46ca-9c8e-94c15f9d071a", "value": "T1CE633A207081F0B3E466DAF3E70AB5A26349DE360D766827E9E80F042DF85536F15D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627819312, "uuid": "a7e06057-d566-4a47-ac84-cc8c57a969e7", "value": "c94b1566bf307396953c849ef18f9857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627819312, "uuid": "11846787-c215-4226-a894-359bb2f296e3", "value": "1536:RzICS4AT6GxdEe+TOdincJXvKv8Zg3kl:qR7auJXSkZg3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627819312, "uuid": "754f381e-6311-425c-9510-65db11a2e5b7", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627819312, "uuid": "9d2dc47b-f0a8-4f4d-b5ec-8262dd21c751", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627819312, "uuid": "78413bdc-3611-411e-b589-66dc7b800882", "value": "22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474864aa-f2af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627812019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812019, "uuid": "f01449c2-bb27-4e29-8913-f5ec6dcff701", "comment": "Malware payload (Mirai)", "value": "4dd47822511c95b4c8b75c8f1ea026d6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812019, "uuid": "f04f4704-64ee-40f7-b981-acf60089946e", "comment": "Malware payload (Mirai)", "value": "25da8659c6960c9159b093f8eb79c732cd96bfe704408596bdfe0d65e47951b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812019, "uuid": "c2e5cdf9-35ea-46fc-83c1-aa123bf10117", "comment": "Malware payload (Mirai)", "value": "e762d0c87c69f55bac5837e1ff714395d43c13c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812019, "uuid": "04c2e965-2883-41e2-824a-5cca7e991858", "comment": "Malware payload (Mirai)", "value": "dae9fe4e38f0a825944c60b5819cbd1379a9d068da980c16652bf3065b9b73a775c30468c4859ced82f4db4535e08178", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812019, "uuid": "3bede2a0-7fb9-4f80-9fc5-9b007a14e2fa", "value": "T1C564D086ED00BF61E4D521B9FE1F034973634BACD3EAB111E6249B2436CA65B0F7B185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812019, "uuid": "ec434131-c7a6-4066-9154-38c5380eb7f9", "value": "6144:2IIKXhZtL7jOTyIG87XBE5wKSDP99zBa77oNsKqqfPqOJ:ZTj8w6BEDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627812019, "uuid": "69df38fa-b5d4-40ea-bb35-5d02069013a7", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627812019, "uuid": "0550fc1c-ab95-4be4-b686-1fba13bbc3d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812019, "uuid": "b0706018-802a-4604-b007-11ea0f13b372", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4399244d-f31d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627859257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627859257, "uuid": "15d13822-f893-4fd4-addd-e61ce6d2a7e4", "comment": "Malware payload", "value": "22c3194529458ef4bfb5ce9934d06ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627859257, "uuid": "910b8672-f7a1-4a84-88f4-e1faba217134", "comment": "Malware payload", "value": "26018f4239d445f9078c47c3d7f5fd4ec6e5c27c242f732ce1759258aa1ff949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627859257, "uuid": "a91d22ce-c3ab-4583-badd-e5a3c2d51f90", "comment": "Malware payload", "value": "203eda015c77d04e6bf35830a2d86e6184525f00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627859257, "uuid": "9432a29d-d4da-4555-a1ce-dd27b2930d10", "comment": "Malware payload", "value": "45ab655f75cdc4edfee12a9976cb307b121a880c64ad0d1628ad70776e4b8c3978fb11b82a5f5ec326caceeed2db177d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627859257, "uuid": "c12faa72-4ac0-40af-a88f-ec10ac4ad9e0", "value": "T15465CD0EE1867125D06FF2F039ADD7A211642EAF27E4D2D4738CFF45C9EC1A09926276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627859257, "uuid": "13630a63-db55-41a1-85ef-e1b4003163eb", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627859257, "uuid": "55e5f03c-1885-4883-96eb-c8c4b2163226", "value": "24576:Qq3Uy8RaI3BL7iI6SmpFvr43PzbdY2RfD3Rtr7R18qlMH8FERCy1:B3UyQL36IaMdtr7ReH8oCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627859257, "uuid": "072d771a-7e69-40be-8809-9db98fd5f6af", "value": 1483264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627859257, "uuid": "2fb3689c-8636-4e18-baf7-35688075daa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627859257, "uuid": "dde63099-9b7a-443d-acff-675f87e6dd12", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24c7448-f2f5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627842290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842290, "uuid": "2a26d019-c015-4b73-8089-3c7143bef149", "comment": "Malware payload (RedLineStealer)", "value": "d2b7580d40d74302a11feb42394a7fdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842290, "uuid": "9da0b509-d421-44d0-91ba-357ca5604e56", "comment": "Malware payload (RedLineStealer)", "value": "28f5fa7118d4f1866643d781c3fee5cb4507f3d268c263ef40551d527da2c330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842290, "uuid": "730e9491-7f0a-47be-85f6-64b4e2ad8d72", "comment": "Malware payload (RedLineStealer)", "value": "c48a5bcb6bca66d67c9b1bb64875cf05b0ca2c8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842290, "uuid": "aa1fdaa4-c110-411d-9fb3-fe40b4af2ef4", "comment": "Malware payload (RedLineStealer)", "value": "ca5acbaa435632b253d9f45697d96670d85453df1bcf195413384243558111e274a9db35bd84a1523e29931cd06d3301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842290, "uuid": "53df6f28-3c59-4dd6-8fd1-bb78642dbb42", "value": "T1C2C512D931C8BC9FE3422D31E75358913284EE03DB7B85A1394BF7C9AEF11749A0685A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842290, "uuid": "81a9bc79-ceb5-4bb5-a21b-17292ba3e7fe", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842290, "uuid": "f7dc7c75-86d5-4763-9144-e4adbef69aad", "value": "49152:mcQXmqvtdeOC1ILcpy76fIY2t7iqmbA/Omu1GwIjoEI4zBLzAKR:/QrnCRDIZbH/OooT4zBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627842290, "uuid": "21eee345-7e2c-45ed-8bc3-bdbffc411ef9", "value": 2557240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627842290, "uuid": "54421c3d-a710-483b-9068-8c3711303e96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842290, "uuid": "c1ebfe24-ad6e-4fc6-bd61-8d0958de4fd4", "value": "Syndicate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1d4c45-f293-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627800239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800239, "uuid": "0aa330c9-a451-4b0c-82d4-cbce0ac48fc6", "comment": "Malware payload", "value": "d4b507c09d6c50cf9da763ff7efe4301", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800239, "uuid": "fd04de32-3a89-4db7-b753-f92093b31daf", "comment": "Malware payload", "value": "2ad2e60ee7607dc8b074be23af06012df776a9ee6e25e4a9432a2708538eab72", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800239, "uuid": "dab38c99-5442-46e7-ad12-f6a0aa6967d3", "comment": "Malware payload", "value": "63db1b5bfc44d84ae6c347aeb0437fab5fa8c563", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800239, "uuid": "5a957afa-3f54-48a5-b69c-2995b19033b3", "comment": "Malware payload", "value": "d5eb2705f234d748af937751290696cd128f12f72de0e51ed10c2b493e42a343ac2d94c666e898a571b17d97e4dbb8d4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800239, "uuid": "4d221b9d-346d-4085-bc73-7d1f3a86b839", "value": "T145E60197E74DF89AC4F3D236A2761057B41A0CA48742E7971A16F1381EF7AD0E90DEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800239, "uuid": "cd875ad2-f96f-4dde-8e34-5c17d5c008b1", "value": "393216:OMaCog0iflMFyWwWbWgr6M/P41oK3VisDvl0GZJQ3X3:OtC8AlM0Ww5grZ4N4GZwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627800239, "uuid": "7dbf5efb-1637-478e-bd02-d8496cbd7c2f", "value": 15116040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627800239, "uuid": "7506031b-47c6-4eb2-8a08-9e8b09a559ed", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800239, "uuid": "dba8f3b9-f0f2-4c72-9e39-b827f09dea1a", "value": "Exchange-CX.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67672a64-f310-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1627853734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627853734, "uuid": "bf7bd554-17b4-4028-9570-f779d01a0a0b", "comment": "Malware payload (NanoCore)", "value": "40058619e2924d55f7a4e704991e08b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627853734, "uuid": "db9ee2ff-6137-4324-adf1-8cdb8322636b", "comment": "Malware payload (NanoCore)", "value": "3511a32415e449888bb2bff8e38e099c20949f31015e3531f0b35149d4a2328f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627853734, "uuid": "cb1207a7-c3c6-408e-bbf4-750f31ff8f89", "comment": "Malware payload (NanoCore)", "value": "166325568ba393e189cd653cef07e29956c020fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627853734, "uuid": "79355504-7e89-484e-b24d-e840b8282509", "comment": "Malware payload (NanoCore)", "value": "631f0779ff018964f88ee41d08f893cc298a9b7b793de7214116a805bc92a1772d2c8c51ec592ce191cb56d6133dc76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627853734, "uuid": "57e7036f-8dd4-44fb-95c9-66bc4f88519c", "value": "T13305BF7417471AA3E139D2B3D016A1C1FEA0D8A3A3C1DF59BAC7969B0D12713419EE2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627853734, "uuid": "7fa2cd5a-5766-4a8b-a8ee-c9d80717ea04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627853734, "uuid": "40890475-c393-490c-a36c-e4d61c922df8", "value": "24576:Gue01us2g9yuLGOpaBfICkwXhaolS9CS:GyEs2gH/+fICkAaoUMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627853734, "uuid": "c9cfdb39-f0dc-4877-aa82-47d7089e75ea", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627853734, "uuid": "25ed5e29-e2a2-434f-8899-5861b189f1a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627853734, "uuid": "b23c0e50-aeb3-4b3f-9a0a-fe06d6d54d27", "value": "40058619e2924d55f7a4e704991e08b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065fbd27-f296-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1627801173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801173, "uuid": "2c340cb8-1f4a-4ac6-83fe-c5a39bf69925", "comment": "Malware payload (AveMariaRAT)", "value": "2b41a99cdf2d243256bf5950dcbc38b8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801173, "uuid": "e27f4ab3-06eb-4790-9d1b-75031e271af5", "comment": "Malware payload (AveMariaRAT)", "value": "36c35b4364b62c4d1ff2be1e1a043a10bc587625ad383dd2b4dacde157a952e4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801173, "uuid": "463827fb-ca3b-4de7-adbb-eb89b046f4c6", "comment": "Malware payload (AveMariaRAT)", "value": "c9cea20f2c364b0fac333df91b58c6425193d2f9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801173, "uuid": "006afbee-781b-4d49-b5ac-5fa1a9337c2e", "comment": "Malware payload (AveMariaRAT)", "value": "82f968a11f64dd24039309248e7785dfda007b1773115c992f508953a7e8d0319cdc4dba86d8263fe8c1648eb1e4166a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801173, "uuid": "c4ba6886-2cc9-4971-a5cf-edb71e674239", "value": "T162E4CF7485CCEBEADC9C03791F8C03643EF18896E1B1E5603E4956F1E5C1E69EAB9702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801173, "uuid": "b52ab4a3-e0da-4c9c-8a20-15ef705336af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801173, "uuid": "635288f5-347f-4824-ac51-b7ee8d68945e", "value": "12288:EqTK7iS/d348SkQQSY93bnE2W+RhWMhNxzJeB2l3h1v30ob3fIKSt:rhS/d3ckJbE29RhHH3vEA3flE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801173, "uuid": "fdde6c12-40b2-40cf-b40a-f90e68496dcc", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801173, "uuid": "04781155-aef7-4910-a19e-eef8d6cdb96f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801173, "uuid": "df05781f-f43e-4f10-8bcb-0dedf188d80c", "value": "2b41a99cdf2d243256bf5950dcbc38b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40cce92-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627808765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808765, "uuid": "aa1215fd-47ad-4d6a-9dc9-2b79b4a5c42c", "comment": "Malware payload (Mirai)", "value": "617b17ab90b9b031b0db9eba002ceff1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808765, "uuid": "e703a8cf-4a30-4622-b49f-6571aeb329d1", "comment": "Malware payload (Mirai)", "value": "37b230e65d0c8653e0e0fa39465ede6f1d301210ce488bd83c19cc71236b00d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808765, "uuid": "4aacdf0d-a988-43b0-8a80-e6ab9c39e91c", "comment": "Malware payload (Mirai)", "value": "2b87fffa28fba4f8173311ec0619ed933224a67e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808765, "uuid": "9bd879da-69fd-45d1-8375-f4badcb5f579", "comment": "Malware payload (Mirai)", "value": "586703c80421ce7a7c5ee17b966a48db4184303697d6f2c70b7bc26228b7ea1edb79a2600b00ae875d5a946718ddea7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808765, "uuid": "e0c53979-39ef-4f64-b195-6a4cf0f8d79e", "value": "T1D1D3C73B27170E23C0C950B101E74332AE75DE9B34B952D7AAA07D686F37A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808765, "uuid": "35c246ba-4aaa-4359-8d9b-50246664b17d", "value": "3072:3v8G4ZNBQTZiNPR6Iwd9g+pCAOhmm/QMurB12CGNb:RrUlkCXmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808765, "uuid": "cfec2815-76b4-49ed-9ef1-aa13f8e90f11", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808765, "uuid": "39bc21e3-982d-4318-baad-29bf5fd4fe2e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808765, "uuid": "f71c59a3-4eea-4339-916d-af5a276d65e1", "value": "617b17ab90b9b031b0db9eba002ceff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fb1faf-f2ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627839315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627839315, "uuid": "4821f8cf-c032-4e61-b37e-1148d1930f14", "comment": "Malware payload (RedLineStealer)", "value": "fff7c1f77588105fc5a76b841983253f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627839315, "uuid": "69097c65-bab0-4f48-8416-7bae257a632c", "comment": "Malware payload (RedLineStealer)", "value": "39ec80621b9b8fcefe89e543622c4263b7629a1207107bebd239a50124bb7fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627839315, "uuid": "bae5e1e4-4cda-48a5-9428-d0ea933dd035", "comment": "Malware payload (RedLineStealer)", "value": "c87d3d2cf8d649d9e0cd045f28d6972fc1ab9edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627839315, "uuid": "541e4e01-1af5-48bb-8920-6808ead34429", "comment": "Malware payload (RedLineStealer)", "value": "afd0891ad4206c75fd498513b71eb7a39066f1388d4578616a8337b35c3bd75cf4698123ae626aea8953951a9a37ff5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627839315, "uuid": "7098adf6-1745-4e07-ab3a-e8032c3dbf0d", "value": "T1DB9523907FD580F6C6415034DD88BBB6E1FAC7894B702CE77350DB0D1F2D998CA2A9A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627839315, "uuid": "d8f721c6-055f-46de-82fe-9f4a57d7d8e2", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627839315, "uuid": "b7b551fc-c5cf-418b-969e-f696c44d177a", "value": "49152:xcBGvy10E+QMWcLctpCOOeWAbaW44EwJ84vLRaBtIl9mTRP+m+OJz:xb4MWcApaeW9FvCvLUBsKRPUkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627839315, "uuid": "b1c3f44b-f1a1-45b3-b0c9-a1d69f353048", "value": 2001556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627839315, "uuid": "8e7f6378-857c-443a-bec9-a1e4e791689b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627839315, "uuid": "58756b5e-4b20-419c-ad5b-7c94581ed2c7", "value": "FFF7C1F77588105FC5A76B841983253F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f1367c-f263-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Pony)", "timestamp": 1627779637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627779637, "uuid": "e8b01a9e-7b09-453f-93db-db8cc42395f8", "comment": "Malware payload (Pony)", "value": "902520746cfc798190cbaf6534753dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627779637, "uuid": "ee89449b-d029-4994-b99e-4c9f8b3887aa", "comment": "Malware payload (Pony)", "value": "3baa3afdc0dbd4cc6bd1db808eae12356bfe7bb8e4640d96116a38111367a5fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627779637, "uuid": "cf15dab1-8443-4ba1-add3-249d7ea39492", "comment": "Malware payload (Pony)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627779637, "uuid": "2c169d74-b6bb-4d31-8908-8b008ca19c37", "comment": "Malware payload (Pony)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627779637, "uuid": "0d92b7c7-0146-4a43-a517-20136a7d3770", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627779637, "uuid": "d9936705-b61a-4f31-a3ed-2fbf3eb7e13c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627779637, "uuid": "f1253d3c-5465-4d83-a920-4825df621e67", "value": "3BAA3AFDC0DBD4CC6BD1DB808EAE12356BFE7BB8E4640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ff3e0b-f2dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627831660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831660, "uuid": "34d66feb-cd63-4b96-8ac1-ed1f93226d96", "comment": "Malware payload (Gafgyt)", "value": "02b7a5a8755bb1dd9e6d8d1bc1c62ca5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831660, "uuid": "2af68baf-c25a-4630-993c-17f4197c8c4d", "comment": "Malware payload (Gafgyt)", "value": "3f00590fc26bc161413819a49f0d103cb1400870e1f2335dd3d1673c9598d246", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831660, "uuid": "911b0016-53b7-4ebc-9a82-95e071f9c2d4", "comment": "Malware payload (Gafgyt)", "value": "d3c65043ac58fc43704532ea6937f2253a354957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831660, "uuid": "069f09b4-0f0c-45d0-89ac-f23f5e6c9fb0", "comment": "Malware payload (Gafgyt)", "value": "9267df133dc414e55f16b89c77fff995fc6c289a61d0c6c77a84793801968c349b1243ffd9dbe3f02413fd72ee5f5b2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831660, "uuid": "610a35f8-297c-4b93-9f6a-26c9bc001754", "value": "T168734A47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831660, "uuid": "329c75fd-8b4c-4dc5-b4c0-3b4f099b0ca1", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/Cf3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/I3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627831660, "uuid": "e9591c17-ed7e-40ad-804b-e428ef836db3", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627831660, "uuid": "f0c19cce-a3b1-4d37-8af3-7c511650e324", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831660, "uuid": "e14d641d-5c6c-4eee-abab-b5987a6e81da", "value": "02b7a5a8755bb1dd9e6d8d1bc1c62ca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f281faf1-f2d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627829057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829057, "uuid": "b46e5394-0df0-444c-b8fe-15a9f8baa309", "comment": "Malware payload (Mirai)", "value": "c0a2482d67bbdbbdf22328d63bc1018e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829057, "uuid": "112d19ba-33c7-4223-9af8-728883ee7390", "comment": "Malware payload (Mirai)", "value": "4193d53ba0e6cc2f9f341ed932d2afc4dafe7f92ba6019573157b9dd951fdc57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829057, "uuid": "05406a9d-7606-437b-950d-e0e0e4e00e3a", "comment": "Malware payload (Mirai)", "value": "8573468abca33e0e9fbf86cd16180ec06782b54b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829057, "uuid": "e0db256f-bdf1-4a4c-9929-3167a8f23d22", "comment": "Malware payload (Mirai)", "value": "b2144a25b1874d63f5a6d034294b9cacd5887172742297114b5c8bf5305919b0b558208ef93ba21df921706639d4b01e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829057, "uuid": "6a9c3865-09e2-462e-b5c9-ed6eb155e90b", "value": "T16B93734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829057, "uuid": "bcbbf555-445d-4791-9a48-2152643f7a2f", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOP3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627829057, "uuid": "a10482d8-22a9-46cf-8eec-0c1ed74aef97", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627829057, "uuid": "d8fa6a84-5e29-4ab2-a241-71941a28de93", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829057, "uuid": "af988d94-aae7-40a3-b58d-2d29885f8c8a", "value": "c0a2482d67bbdbbdf22328d63bc1018e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35ea8f2-f2d9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627830266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627830266, "uuid": "5f412290-8a3b-486f-8d38-e2b2cab7d4e5", "comment": "Malware payload (Mirai)", "value": "ddd28dfad5f94cae2ded67426410a6de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627830266, "uuid": "bcc722ac-01b3-4327-8694-7d8f394859c7", "comment": "Malware payload (Mirai)", "value": "41a604bb6994f75458d256a706f8a403d174cc97d8966bc0a75e2c38ef118da9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627830266, "uuid": "26cf74de-9a61-4e2a-9b27-bd34d040d08f", "comment": "Malware payload (Mirai)", "value": "c7f7f14839c9916104609964217131628d833f69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627830266, "uuid": "935289c6-5ba6-4b15-a89c-b4e6e29f61dd", "comment": "Malware payload (Mirai)", "value": "63b3a3e3c729986b4f3406982d52de4c7d570cdccd3a92c6f32f63a7733772f686f5b7e08651eb46c7f011883d0c289e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627830266, "uuid": "d8c061ed-4397-4f4c-8948-721bfe1cc30a", "value": "T123735C34A97E2E26C0C4A17E52F78750B2E5220F2AB4965D7CB20F4FFF24544A8562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627830266, "uuid": "baeea57e-a4b0-4dc6-bccc-75bee0ba3041", "value": "1536:vsnCSemCLLWeKNJ+1kbOSYcpC636v/bcYSZgFFi:rS1+SYccv/gpSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627830266, "uuid": "fa99840b-2869-4e81-9fa4-0a9d80c960ad", "value": 75388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627830266, "uuid": "7f859764-8ef4-428e-81cc-38b967617771", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627830266, "uuid": "7c18094e-dc6c-458f-8d45-bd8d78459224", "value": "ddd28dfad5f94cae2ded67426410a6de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1e5b45-f26b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1627782959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627782959, "uuid": "67be60cc-1eb3-4477-b2a8-41e94baed0b8", "comment": "Malware payload (Stop)", "value": "c7b1e94b6c418bc8ebc5e624933460d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627782959, "uuid": "bfb1eff3-f55f-4ed2-bd0a-d1d0d1c37c37", "comment": "Malware payload (Stop)", "value": "456079ac17674de342836dee558093a80c9b6fb869b5a7562a615db1bbe1b42d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627782959, "uuid": "8be3266b-14e6-4bcc-aaa4-dd1edd8909fc", "comment": "Malware payload (Stop)", "value": "0da68ce254e2bd684ef9c422783ec8b85c66f3c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627782959, "uuid": "08f5f488-60d6-4426-8c5c-5bf8c3881886", "comment": "Malware payload (Stop)", "value": "078c15ecf7653eb7e0ba9488e121d7ef11e169165c9882835aee72084d5c7b4bd6d7cf5c3b6c1e4fc7cf113c2e7b8a23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627782959, "uuid": "927f6bd4-41ce-45b2-86e0-89bc2d406b7c", "value": "T15CF41290BE10D222D34446308861D266A63ABDF5A8659A033F8927AF3DF33B15275F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627782959, "uuid": "e2f29832-7244-4b6c-9833-b0b78ab4a7dd", "value": "be037a61d0fc8d95adaf9a493416af5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627782959, "uuid": "ba50a34b-5d31-41cd-add4-cba1a64bb254", "value": "12288:n8LvMI/teHpSbtBpNy7JpYO1yk0H4Y3JmhXTVK17TIgE:n8LvLg8btBpNiykKYTVKFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627782959, "uuid": "a0f24a85-f65b-489a-8236-0f4b4fedb418", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627782959, "uuid": "c618f2f6-eb02-4d31-a70e-64615d65a99d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627782959, "uuid": "79a5ab07-5d34-47bf-bb69-bd8690d36da9", "value": "c7b1e94b6c418bc8ebc5e624933460d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a441ad-f295-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1627801139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801139, "uuid": "65388475-8a79-409d-a662-fcdfee46ca88", "comment": "Malware payload (AgentTesla)", "value": "7a6eb6b5cd944850b4c517db62476e65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801139, "uuid": "e06565b2-7b5d-4a3c-aa5c-9706586702ff", "comment": "Malware payload (AgentTesla)", "value": "46a96491765ac14a4726f52d36a4c3f76d6f2adf9a0879ba7365b476c78f9cf0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801139, "uuid": "07c8fbf4-b2d8-42da-8c3e-afc8ead06ca6", "comment": "Malware payload (AgentTesla)", "value": "ad6075ebc60232853fabe93c57ff891dfd560e85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801139, "uuid": "62ffe755-a0b9-4e57-9269-4276e94fa15b", "comment": "Malware payload (AgentTesla)", "value": "6110f8bd712c5b6e96cd018b1da70c85659606dc4b8a4e5f31cf0f50cfdf0d80c4c80bb5641d3ace80306cf9bff21e10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801139, "uuid": "c6566798-8c43-444b-88be-a28f8a572a04", "value": "T1C315CF6589CCDBAADC5803745F4C42743EF28C63F0B0D5613E8AB6B1A4F0D54EABA752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801139, "uuid": "2c26a9e4-fcbd-47c3-b176-3ad7d34cf3a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801139, "uuid": "259b73ec-10c2-4191-b89f-d19f52d5cad2", "value": "12288:HVTC7iS/d348FhUwesmcOci4O+QfNlVsDvN2K+rBqblnmHwDNkT3ko/:1RS/d3PTZihFl2DV2NkBzPo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801139, "uuid": "d0c46b99-705d-4e05-91b1-ba15a4dab933", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801139, "uuid": "9bdf481e-f0cc-468f-826c-b7bf3e066182", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801139, "uuid": "ddf0c0de-7465-4e13-afcf-a9690b00379b", "value": "7a6eb6b5cd944850b4c517db62476e65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e8baea-f26a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627782349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627782349, "uuid": "a07345e7-6649-4270-8442-6ce3d44325e0", "comment": "Malware payload (RedLineStealer)", "value": "a0680a1de10066f640fd52149343d384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627782349, "uuid": "2d2d3617-6d1c-405a-8f58-52bfd964f341", "comment": "Malware payload (RedLineStealer)", "value": "4869e227dc7fd28afeab3a5e42322e1069c712578d0ce5ced4f6862fbbafd587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627782349, "uuid": "f82ef107-dd68-402c-8dcd-3c96e2150ed3", "comment": "Malware payload (RedLineStealer)", "value": "9271108efe8c31da2a886ec2e33d224b26fd1175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627782349, "uuid": "702cbee0-c773-4d60-bfd1-fe6b9273a8ed", "comment": "Malware payload (RedLineStealer)", "value": "29ea34347594068b580afb5df2ea171922ebb9bd3997a66da188559795f53e552518b488239ea47981146ba2e97acf9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627782349, "uuid": "5b93a5fa-7886-4c9f-bc8c-8b3466c4e9fc", "value": "T158E4BEE1E4490696E80D213718690D0D3A525C7843CFB9BB73993FAAAA0FB9D115C37F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627782349, "uuid": "60dce460-dac4-45a5-8998-386552184a95", "value": "62707b6884dc214d3c7d0a9b67c3b770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627782349, "uuid": "3c5239de-a812-447b-869c-eaeff84d1ac7", "value": "12288:LIj1q8+8Y61RgSvmQ/gbiMhP+HXCuHB7ENoefNsrp+i7hvMHvXRc4Mhws4D9:8qj8Y6fgomog2Md+HXhZENosNjiFB4Mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627782349, "uuid": "433755c5-b716-4e2d-aff0-3116495a2038", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627782349, "uuid": "57410f76-9c66-4100-9109-0615131264c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627782349, "uuid": "fecc741a-7be7-4e76-a2c6-95fa84d16961", "value": "A0680A1DE10066F640FD52149343D384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de334235-f2aa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627810125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627810125, "uuid": "66e0292d-d140-4f64-bf16-8c4fbbde72af", "comment": "Malware payload (RedLineStealer)", "value": "1868b8297aa938d8918ab0ed3f619794", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627810125, "uuid": "f984ca93-3c4b-4590-bfcb-1678fac35d85", "comment": "Malware payload (RedLineStealer)", "value": "4a6bf1668bd4c6a6c8afbcea62d489853885f492a381d0d49b9e4b96ce2fef34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627810125, "uuid": "4fb3eadd-30bf-4f0b-a6f5-d6c84a651e3c", "comment": "Malware payload (RedLineStealer)", "value": "2d39b73dd0d6684457587d708aabdf83a211547d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627810125, "uuid": "931d5ffd-c908-46c9-8db6-6003d1a4362f", "comment": "Malware payload (RedLineStealer)", "value": "69bc43c0ba08f99158d8b58f00d1ec5228deb160d54412255b5d08a4011b33e602fe338b8bcc70e7e9bee930a16c5e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627810125, "uuid": "a67dcc27-d51f-4252-a2b3-f52db920448b", "value": "T1E4C533D9AEDC2770C45223390BC2BD478AA6A742F67CD50CB2C154872E56BFFEA44D81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627810125, "uuid": "fdf86c95-beee-4ff7-9676-746cb2fd5ebd", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627810125, "uuid": "7d21728e-e4e7-4eeb-9ecf-b34521cff9c5", "value": "49152:/7Hz2h6v2zjbcPaSL7PSHsMdlmWLMtZQnEd9s6YvOPcEIVNeETiKjq9vA:zHiUOvb7SPYMWYtZRCxRNtTikKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627810125, "uuid": "2e405c78-347a-4e57-97dc-6fa4d5512dc2", "value": 2555458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627810125, "uuid": "6f100d17-27de-4d55-9ee6-643bf976f004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627810125, "uuid": "b7164041-7ebd-4823-b86a-869a9a145cfa", "value": "UnitySoft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b48245-f293-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1627800155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800155, "uuid": "a60895f9-ba58-4214-bdea-de591627ba36", "comment": "Malware payload (RemcosRAT)", "value": "60994ec6dc169ccb15fd0b3b502390c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800155, "uuid": "1cc8a535-864f-42e1-a590-431eca7c010f", "comment": "Malware payload (RemcosRAT)", "value": "4a84faebc419ed0cddbc9e37b337a3090a01051d3ed7d1650c2845369b9a1d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800155, "uuid": "905fc59a-c987-424b-a4c0-c75c7f361f1a", "comment": "Malware payload (RemcosRAT)", "value": "a9c0dc9424132e14be9277eadbc3e6aa870440fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800155, "uuid": "4bc4f158-a285-468a-a5e8-7286e8e4cf72", "comment": "Malware payload (RemcosRAT)", "value": "07439d534ae567bef32abc6ad023f33bedca2fa35081c2d3efbd4891203b03163ecf41939da9c316c2d5ba0075e23838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800155, "uuid": "b0206228-2829-4d15-bb9c-2f257b3569c3", "value": "T11D058D32B140A577D12216BD5C17D778BD26FE153E28AE8B3AE8FE7C1E382417634186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800155, "uuid": "a17d6753-6313-48d2-ac82-7220911848a8", "value": "c76515f33c28ab06b1b9a160bab156ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800155, "uuid": "c075948c-34d0-41d7-b644-60ce288dcaa5", "value": "12288:Pk7JfNhjmkfdkN9ogGWRmYcGT8+275o2xaUGmj1a05q+KgTJ28BDGQPN+BRKa:mdXmkaN71RmYcN+MVxauj1fQn4cSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627800155, "uuid": "f8a7e335-2028-4dae-b4be-16f4894a8109", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627800155, "uuid": "dd11c7b8-9312-4f4a-8046-f03e9c56e3ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800155, "uuid": "2b628ba1-1607-4f16-bdba-8cd6863f47e5", "value": "60994ec6dc169ccb15fd0b3b502390c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0457feb0-f2d3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627827368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627827368, "uuid": "1ac7fd14-5006-4948-a6c5-5cf737994408", "comment": "Malware payload (RedLineStealer)", "value": "a03809a5458f9f12ea149bdfe0db7c1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627827368, "uuid": "7d0d7447-3fbc-4342-973c-b3b5a5f60772", "comment": "Malware payload (RedLineStealer)", "value": "4d97a3f97aeeebb6e15603acba4108e0925458122213136d3a15e7283569512c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627827368, "uuid": "c45a9684-21d5-4119-a0a4-b0c2e5b4b6f5", "comment": "Malware payload (RedLineStealer)", "value": "38351e59798b861e2386c48fc5133af681464e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627827368, "uuid": "46a79653-182a-4166-9132-0c514e7f3ab5", "comment": "Malware payload (RedLineStealer)", "value": "5fb89af060c87948d4e4069f149274cd5be296bd2c863e64defc72f4a802e34e75c0b120400667ef14cca5a82d384e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627827368, "uuid": "6c9ad89e-8ac1-4559-be63-c47272c98718", "value": "T11484462868BFC01985E3EEA12DDCA8FBD99A55E7640C703701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627827368, "uuid": "c8e56776-6d34-475a-bc2c-a9a45ee025a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627827368, "uuid": "3bae4387-06b7-4a30-9108-94ea4f3baa9b", "value": "6144:2FhUfR1GfaTFwEklf2oqtBCzX24zDqQvj9JGhwPgALx1:6hsR1GfaTFwEU2oqtBCzX24zDqQvj9J/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627827368, "uuid": "ffb0e084-e1e8-4748-8f7e-ad8c6eac90d7", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627827368, "uuid": "a459276a-163f-41da-ba77-948a7808bdd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627827368, "uuid": "e5081378-a1bb-4677-a024-2a4321983ac5", "value": "4d97a3f97aeeebb6e15603acba4108e09254581222131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4756f949-f296-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627801282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801282, "uuid": "ebc4f038-7747-4a26-99e0-b968b2f5a1f6", "comment": "Malware payload (RedLineStealer)", "value": "4431b1333363f8e42a5bc281b7280493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801282, "uuid": "8bb8a617-a6fa-4e0e-b78f-b35ee429f96b", "comment": "Malware payload (RedLineStealer)", "value": "4da1e9b11e61a8f2633da08aa63bb869e7130d04b15d06a81db1047f687ebcc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801282, "uuid": "5ffd6229-aaee-4f80-8bfa-f9b8ff4b686d", "comment": "Malware payload (RedLineStealer)", "value": "fde122774c66ee446c3f3814f89b011529c4179f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801282, "uuid": "4c43f561-333a-4522-9b29-ddb7bd91ee99", "comment": "Malware payload (RedLineStealer)", "value": "d83cb96f36e76c6bbd4809e8a61579010a329e08651afeca9ee312bfca3b8ea323cb728519d26c473d1f0d3160dcc408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801282, "uuid": "71ec75f7-fc07-46d2-a08c-613c424d15a8", "value": "T114F4122236E1C032E963197089E89362F9B8F93156B1A68FB7540B5D7F71BE1C716B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801282, "uuid": "5dd75546-0469-4888-b590-fc656eb39993", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801282, "uuid": "aa1cbbdf-b6b1-4155-9a4b-cf2a9a46b49e", "value": "12288:4Y20AljdZgBPfKf1kQxAogJfqsUsz0cX0aNWTQysUxRUP0o0QjTiIiJQ:d20gPgFKNkQxAVBbIcX3/tXZQJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801282, "uuid": "80fc24b6-c414-4a20-9ee6-7a0c8f28242f", "value": 779548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801282, "uuid": "718043f9-d343-4f55-84de-1d611ba73c85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801282, "uuid": "ebd96076-1b51-4f4b-901b-b28eb50aadb3", "value": "4431b1333363f8e42a5bc281b7280493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b845c39-f312-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627854680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854680, "uuid": "ec890b2c-a369-4591-bb06-b46945f7ae2e", "comment": "Malware payload (Mirai)", "value": "733b10b19c67048379c5e4f404c6ba7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854680, "uuid": "9d81e533-0295-4603-81b7-138d78603498", "comment": "Malware payload (Mirai)", "value": "50adca8efc82564c743352f90891809d397f1c01f760ebb0d4ebee9aa7208f82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854680, "uuid": "4cc4af05-5913-455a-a581-127ffd371f1f", "comment": "Malware payload (Mirai)", "value": "3b484caad89a8ea9de7d301ed3b07ad5bc4c8785", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854680, "uuid": "73c8ddf6-a3e3-41ee-b85f-2d83f5926067", "comment": "Malware payload (Mirai)", "value": "1598c262f458bd9a77bde178c10bfaf0a30a09142a8588223e8144c8304b7ab8baa6e67b4dfcd03ed7100ead045ebcd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854680, "uuid": "fc32f983-7172-4da2-9e31-1558d157319f", "value": "T196A2C070C2692FD0FEFF3E6559D9C362279103AA43B10ADB11C9BF613253467E524C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854680, "uuid": "b58fb2b7-24fc-442a-b83a-767e0222b13c", "value": "384:FQswwhn+Nore50szoQYwa6Ol6jrnwbaIp49rwGqL8M4uVcqgw05LxJ98:FQOtreCZVLJ48VukGUj4uVcqgw0zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854680, "uuid": "7e2a9fcf-1273-45a2-9de7-e60147add8d3", "value": 22280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854680, "uuid": "5156ff9a-0dbe-4196-862b-5f371a579baf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854680, "uuid": "28e26e3e-889d-4ca1-a095-831226b356c7", "value": "733b10b19c67048379c5e4f404c6ba7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa38bd59-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627808749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808749, "uuid": "0b09ef61-0c25-4d8e-8b5b-6f01feb05771", "comment": "Malware payload (Gafgyt)", "value": "c99e8de64b680c79fcfc11f3c7ac0ea6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808749, "uuid": "eeacb5c8-ff52-4305-bf21-e59aa9da64fc", "comment": "Malware payload (Gafgyt)", "value": "523d2f73bdcccb64cc1b0e4c99df20e00caba3b3326806f2bfc6b7389863ba3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808749, "uuid": "748e9173-0f4b-45cc-af0b-4d8c244a973e", "comment": "Malware payload (Gafgyt)", "value": "93154d1507430ab25a972f2e68fd79a1d81204fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808749, "uuid": "86f34410-bd55-418a-b494-f1bd86acbecb", "comment": "Malware payload (Gafgyt)", "value": "d31ab07012e26baf2ba46db12f7e215dc4eef9b53013978b5ff994329476353147c532f45dc36552aab10293d15676af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808749, "uuid": "c582ccd7-07a8-4c77-83d4-e23e5bf5efdd", "value": "T1BCA30A01F9419727C2D327BAE7CF479D3B355AA497E733116A357EB02BC27892E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808749, "uuid": "72850781-8d11-4fe2-b2cb-4248b4786ac8", "value": "3072:g40ftZuOYZc3P/xEqPt3mCVrQAFiOXkYe:YtZ2Zc3PPhmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808749, "uuid": "8f18244a-8890-4b4a-b948-179572dc8f99", "value": 99994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808749, "uuid": "e2a1f2f1-5aae-40da-a95a-3d46d72e0e88", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808749, "uuid": "919b42e0-9a06-4cf3-bfe1-700afc383277", "value": "c99e8de64b680c79fcfc11f3c7ac0ea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4f6fa5-f31f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627860294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627860294, "uuid": "39341f60-0532-46b2-83e3-50aa79d08ab1", "comment": "Malware payload", "value": "207450ff08453cc47b40df231032d4d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627860294, "uuid": "a5175493-a796-449c-9567-7278b1b7a218", "comment": "Malware payload", "value": "5638a743d42c3622f1826cb1120aa4e22a40d1e853472620071cba8a1388409b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627860294, "uuid": "96be5256-a6f7-4106-ba79-a70d7be3248e", "comment": "Malware payload", "value": "8204c388e65ea1d91f345a16545e05004101869c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627860294, "uuid": "2a3b3c0a-82ef-453b-bc26-4fc18c01b459", "comment": "Malware payload", "value": "0b58df7ce92273f7a99711d1bb3b8073fe1bc776ff6f90cb81b15e5e0956ce41ecd029a73bf8f20f6907038994a80784", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627860294, "uuid": "36f727be-830b-4d22-8d23-752d0346505e", "value": "T152263323C72158E4D476CB3D858EBB60E11EEED41869EC5DF573B66008BDAF1805CB8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627860294, "uuid": "cd07c9f7-0bd3-4f7f-b356-cb1325507a7d", "value": "fbf8d2064762660e5e8e47447b532751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627860294, "uuid": "8359e265-8611-40f6-99f0-6a5d5385edac", "value": "98304:zzlsF6obmLepm99gQS8kzdO1foaQr/lfO3wRXzv7+ey2dDkkCkM1pue8:zzlsF6Sc9BkzdIgailW3kDTpHdD8kM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627860294, "uuid": "c9833a31-37bd-4878-afb5-9f6f222d0c04", "value": 4840960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627860294, "uuid": "43cf0a44-9eac-426c-8546-5f829ba32054", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627860294, "uuid": "332a19c3-e098-419a-bae9-865455ebb720", "value": "207450ff08453cc47b40df231032d4d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe67a1c-f26c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1627783552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627783552, "uuid": "b65dc297-5024-48d1-b4ab-7d3441988d63", "comment": "Malware payload (Stop)", "value": "68b16b954da4726f6ccdaff90b0d6c23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627783552, "uuid": "e89a1d9f-f792-4158-a4b4-5d2347a1c8c2", "comment": "Malware payload (Stop)", "value": "5651c726a433d942eb9cdbe74c6631178fa3e243e0953e0a55f54f1752e05682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627783552, "uuid": "25651b38-8ec3-4e21-9409-e3d0026cf929", "comment": "Malware payload (Stop)", "value": "25ac9da0e40f472e0c7fc01c5137d9e3a53c0567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627783552, "uuid": "c6ea81e9-de6b-45c8-afae-fd23dfe213f3", "comment": "Malware payload (Stop)", "value": "e929233751eb2d2f748e1cbc9c07ee3001c803561e4a4ad79923dff5b832bd160cdfb0e33717282b5f1ac7c3701cb69d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627783552, "uuid": "1f04f5bd-a572-4c82-8c46-3801220baddb", "value": "T12CF41250F141C062C71206B04465C6612728ACF6AD7982473758EB7F7EF73F1A6A2EE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627783552, "uuid": "6976f1f6-55cf-4467-9abb-54a711695a9b", "value": "be037a61d0fc8d95adaf9a493416af5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627783552, "uuid": "40572b5d-ad9d-4a72-8155-1b5350ef6474", "value": "12288:wq/ULziS0lTsm41fQka0hLmw/ozhGNLZ5uq7YdqNFl3NB1UZE:wqxSG4ZU0hSSpMYHlN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627783552, "uuid": "67974fec-45af-4e95-98ba-289399f1badf", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627783552, "uuid": "bc0d6c32-0605-40ef-81a2-34de3a98db0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627783552, "uuid": "e1bda2be-edc3-41c3-992f-083303a75c5a", "value": "68b16b954da4726f6ccdaff90b0d6c23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2058621-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627808735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808735, "uuid": "eec63162-f115-4ce7-add0-f55b9d087a77", "comment": "Malware payload (Mirai)", "value": "ee5c5a31617f7c87411d8532315d15af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808735, "uuid": "53a6e8c9-f796-4489-90a7-cd72750d02fd", "comment": "Malware payload (Mirai)", "value": "56c5d4c7115f389452a76751cf1803cdd510fc55577fc4bda4b86d46560f98f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808735, "uuid": "28d725b0-b55d-4491-8841-b24090f82d8a", "comment": "Malware payload (Mirai)", "value": "9b04b14d108aa978ad15aa7aaf7da6a15e264536", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808735, "uuid": "13f37457-5069-4cb8-95d1-6bd68209abe3", "comment": "Malware payload (Mirai)", "value": "dd26e9fe324afc0863a6ed1f20cf121134a6dcfb92aee33f39af5b7d847d6b90b70a11094450e4a17ed88f8ba0880472", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808735, "uuid": "6a171ff0-17a7-4a30-ae7f-e6bef1fa7d33", "value": "T1CFB31877A4515FB3C045A5F125BA99320F12AC931B1F1A84763CBAB44B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808735, "uuid": "10ec1450-6c54-4cdd-9462-7ceb90870f43", "value": "3072:OwNUWqpCgYXlrSyWUfMNAMmH1cuEgv26uN/:OwNjqpC/G8fMNAMmH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808735, "uuid": "67cab4f0-58da-46df-9633-76696661b779", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808735, "uuid": "3cfb29af-104e-4677-ba66-351c20a8341d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808735, "uuid": "ce6bd5ee-364e-4ad0-92d6-fdf3fcf91641", "value": "ee5c5a31617f7c87411d8532315d15af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca46d1be-f295-11eb-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1627801072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801072, "uuid": "e7c135e3-01ba-44b2-875f-490b50679caa", "comment": "Malware payload (QuasarRAT)", "value": "e7cbf2cdc843b3c59d9f07ed5a124de0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801072, "uuid": "d6040891-3da7-45b6-aadc-30acb45f6dc7", "comment": "Malware payload (QuasarRAT)", "value": "5ba130e20c196975dd6cb369281c1a16cb523433aed75a17a47ffa3b2928b841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801072, "uuid": "59ee4007-089b-4218-bd1a-3a46ce962f35", "comment": "Malware payload (QuasarRAT)", "value": "e5233b3f0efed3a80cdfb69ed19fe122c249d086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801072, "uuid": "e6f3c88d-d823-4594-a969-8fae00eae0c9", "comment": "Malware payload (QuasarRAT)", "value": "5e31bbcd93116f99144392ef4e2f068c897eff58262e01c2a3ebb126119bb0f0ac3279bd9f0836372742738f539328e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801072, "uuid": "8a56ef2d-9a94-4fa8-af8d-323848bda741", "value": "T141953382299B9C39EBB728FD42769751EA903E67D8B9133477B44E621E1C1B4CF460F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801072, "uuid": "c2d5be8e-6362-4de3-b486-1078c757888b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801072, "uuid": "1d34108a-d58a-4d34-83a7-df18980fb4aa", "value": "12288:4Q5NTnTfuZfxwtex8R1yxwClzeVSD4ufsPB2CyyPmqwfkmxymnCSrHRHYnpbBC6A:4j8S8XIWpNlXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801072, "uuid": "71866276-ef95-447c-9ea0-1a06b0400344", "value": 1911296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801072, "uuid": "8248c193-16b5-4ae0-b703-3fb7c43dce27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801072, "uuid": "8f408f64-28ce-43b2-b1ee-175f1353244d", "value": "e7cbf2cdc843b3c59d9f07ed5a124de0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e5392e-f312-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1627854624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854624, "uuid": "384b8d25-b8fd-467e-9ddd-989d92db45f6", "comment": "Malware payload (Stop)", "value": "704dc4ae0454d7c116d75eed8c7a0b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854624, "uuid": "00b7dfd5-aef7-4b5f-991a-4a4da711ebbf", "comment": "Malware payload (Stop)", "value": "5d232ce70bfdc3344ad9c117da898e5d72ea5a5ff0704933735abb186714c9f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854624, "uuid": "1214ab57-b639-4a8a-abdb-6534bb5a7088", "comment": "Malware payload (Stop)", "value": "17d5c60ab29c1a02ff21228aba0ce652bffe11cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854624, "uuid": "f95bf47a-3b66-4d35-837b-1de57919a623", "comment": "Malware payload (Stop)", "value": "4bdb811dbb92435abc9b5b8b6c7f433e50eb72300b8e00724481262bfd3bbfc3b8e52eef1590297e24a89b47e131481d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854624, "uuid": "57b4848a-8381-43b1-926c-0b1b7dec30e7", "value": "T17F051221FD41C433C29606748062CBA8766CBC2A6561858B3764676E3DF33E1637AE7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854624, "uuid": "5f56b12b-54d6-4a97-940b-f228858deba3", "value": "3cdea9fa065b5ffb20003adb7f4144ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854624, "uuid": "6e451027-79ce-476e-9de6-67e7b7179dd6", "value": "12288:0rcpbavvXqCS9jzdDYXeCLadGXzHOgU/rQ/hkSJ5mVOyMJ88ugSIxdfN2:Wc4nX4pwLosurQ6wmlU8D4dfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854624, "uuid": "fa3196fd-8f13-4965-803f-fa2daf4eed75", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854624, "uuid": "fe270383-9e92-4156-98a8-2b54e6a1dbbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854624, "uuid": "23f1d60c-2a47-4139-b918-a97a3011a952", "value": "704dc4ae0454d7c116d75eed8c7a0b8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e36d82-f2d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627829061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829061, "uuid": "526545a7-1593-469a-abab-beb6e090a01b", "comment": "Malware payload (Mirai)", "value": "75d98930b1087ea48be75418e8bec8b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829061, "uuid": "76ae550e-c44a-42b7-96b7-0b80db03843f", "comment": "Malware payload (Mirai)", "value": "5d2a1eb718f11482faba0c90571a4d2542e3d9aa6fea5bc05c35ec5245907b46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829061, "uuid": "027cd366-2829-4929-acef-2beef5117f3f", "comment": "Malware payload (Mirai)", "value": "f8252914b5c6ff39a172e117794467c3eb7be826", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829061, "uuid": "58f4c71b-e9b3-4ad1-ba50-708dbd84bcfa", "comment": "Malware payload (Mirai)", "value": "aa67c8a6ca2f6a9158eef63536367e9843ae2b5ed8c0c825010338025222aee7c37ca8500c8258b551573e7f563e9de0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829061, "uuid": "a16eb0ac-c591-4f00-aaff-62ed66053c0c", "value": "T1D393800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829061, "uuid": "4fea3722-18db-4e69-bd0d-1926558859a9", "value": "1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqti:qCYxrKDy46Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627829061, "uuid": "ed63fa3c-62b6-483d-9145-59a27033349b", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627829061, "uuid": "fd283ce0-2909-41ed-8a24-6cd2edcc5a67", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829061, "uuid": "ec1a73a1-fd5f-43a5-80b5-ac2597ab186a", "value": "75d98930b1087ea48be75418e8bec8b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2aef43a-f293-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BazaLoader)", "timestamp": 1627800227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800227, "uuid": "30124c27-1879-434d-971c-da812104efd2", "comment": "Malware payload (BazaLoader)", "value": "a989a70066d734762a1ec5255604c197", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800227, "uuid": "966a3f68-0feb-4961-8480-a460b4ec81ff", "comment": "Malware payload (BazaLoader)", "value": "5e1f7246b57c5a54c246d40ba8adcdd2fdff29b8760c7dc7ca5893b4764e6949", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800227, "uuid": "31204509-2dee-40be-8ccd-a29b0124bff0", "comment": "Malware payload (BazaLoader)", "value": "537b6577c8d58982a1ce4f21a799bb44b0f0019d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800227, "uuid": "466e42e4-3520-41d2-88d3-935539d7114a", "comment": "Malware payload (BazaLoader)", "value": "a75d6b7ee31f5f90be208ecff9935bae611114aaace16c95437c904e9448884a1a5d59f25e4e494a1ff9300c1375604f", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800227, "uuid": "0e8d39aa-db9b-4cc8-98b3-54a6d3be50bb", "value": "T12E455B127CE184FED63AE0344892C3917632BC6563313BD73E5565BA2A75BD23A3E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800227, "uuid": "c9971266-4011-48d3-bd23-876c47548773", "value": "2869cb885758b15d003acb119f131468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800227, "uuid": "bfbf83a6-10c0-4264-a422-e1b51d00176f", "value": "12288:6yWeahQ/LWnzkXz5HYrniajhuSlHJzJBlPXXo/6aNdCaBSPZC1XZV72Bf:HWeaZzqY7dhBjz/lfo/FIyXv72Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627800227, "uuid": "476a6979-9e7e-44ca-bf44-b50d853bc491", "value": 1250833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627800227, "uuid": "33d7c863-d3b3-4b9d-a920-a5a26a21405e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800227, "uuid": "16cebedf-5cc5-4bcc-81ca-9cce730d71c9", "value": "a989a70066d734762a1ec5255604c197.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff06492e-f295-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1627801160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801160, "uuid": "8aae8684-48b6-4c0c-aab7-a6173affa647", "comment": "Malware payload (Smoke Loader)", "value": "b8febfc6b3d2e6543792ade9dffe9bc7", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801160, "uuid": "411db60a-6473-4124-be5a-417372b02f42", "comment": "Malware payload (Smoke Loader)", "value": "630d1743c5856d0bd5aeab5fea4f818645bbfa902b5131d88b8cfe7118e793b7", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801160, "uuid": "dea7db5d-c856-4598-a195-b387bbc99ee9", "comment": "Malware payload (Smoke Loader)", "value": "a37ae8517fbfea422a0cfe813033baffae7bf2b2", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801160, "uuid": "2c8c9212-6258-42f6-b479-ea7cdf6a96a6", "comment": "Malware payload (Smoke Loader)", "value": "087436a444a43fb00aa9c07de5dfaa83b2bba3fdf6e339a6af1d04c6c663b490808cf65179c72500da06444f87417b13", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801160, "uuid": "c5e3e0a4-a907-4140-a662-8770a63a0d99", "value": "T12F749D30B6A0C035F4F712F445B993B9B92D3EA19B6460CB92D55AEE53346E8EC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801160, "uuid": "50c30c97-cc8c-4314-8359-9951c2c2e641", "value": "3a882b0a906e4a3ae01bd3c1a3fc4b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801160, "uuid": "a4933a04-256c-4292-857e-bf70f97a9667", "value": "6144:FFnlLsIrdIS00AOQzE0cgxozsTZKU15Jv8QRlIt:RLsI9BAOQzxWzsTYa8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801160, "uuid": "c6793c24-c5ff-4390-b3a4-2524dba06513", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801160, "uuid": "8a626052-2daa-4015-81d6-c1d9ba0ec3aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801160, "uuid": "99400890-7721-4684-8c5c-9689e5645fae", "value": "b8febfc6b3d2e6543792ade9dffe9bc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addc128b-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627808755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808755, "uuid": "f2b25111-2d17-4b39-9127-ded14ebf4c16", "comment": "Malware payload (Gafgyt)", "value": "39ad9c59bd96b8e55336aa7dcffaff3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808755, "uuid": "d890b226-e3ff-4d94-8b89-c9f44ef6a5b6", "comment": "Malware payload (Gafgyt)", "value": "633d9de9de5439b32a1bc07a5c126c420f0d80b4b71334807fbd058d837b2878", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808755, "uuid": "d1e4fc0e-1ff0-44dc-976b-ee391bc69d63", "comment": "Malware payload (Gafgyt)", "value": "ddc304df9fcea061ec8ba659247ecbe952d5cbe1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808755, "uuid": "2a24bec9-7ebb-48f7-9b97-eaa79cb8290f", "comment": "Malware payload (Gafgyt)", "value": "ff17a9dbe0d56f7b089fec4b8d87cc2d15780e2fdbf5041794909c25919664bd72861537d7c248ae32bf46bdd45b4ccb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808755, "uuid": "ed1fce48-e70e-4b9b-a669-c2433eacfa61", "value": "T1C8B3842A7E22AFFFE168863107F35F708795229226A19386F26CD7181E7128D1C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808755, "uuid": "ec8e2e5c-162e-4d4a-8bd3-8782891255fe", "value": "1536:27jr1TJsq+XIEYe2rKVCeNjHGb3e+1thQ3w2LMzpUmkiSFxfC7xbXe:ofNYljHG7PQg2EUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808755, "uuid": "153a3a8c-5a0b-42c8-b384-72c13e917e93", "value": 113995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808755, "uuid": "5f01d2b1-0b5c-492e-8880-30d6852685b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808755, "uuid": "ce18fc93-8970-4b3d-a7ec-e92c27d4f5ee", "value": "39ad9c59bd96b8e55336aa7dcffaff3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0809f1-f2b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1627812346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812346, "uuid": "b26b57e6-ed05-44e8-8ab4-f4e51a87e004", "comment": "Malware payload (RemcosRAT)", "value": "f2d7a001bdc3a590dccad2b6b7ef7739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812346, "uuid": "b810f8ff-b51b-43cf-b072-d37f99230237", "comment": "Malware payload (RemcosRAT)", "value": "64dbf3976d752392f5594ebd0fe2185f26b04cc4998d94e46062b4e3615c7ccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812346, "uuid": "5f5144bb-c1a4-4bbf-a4e6-9b0a3bdb0d81", "comment": "Malware payload (RemcosRAT)", "value": "7626899da63238904792095f55b6095d6038143b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812346, "uuid": "62be486a-fa7d-4c89-89a7-5e37be7d8138", "comment": "Malware payload (RemcosRAT)", "value": "842369a8b0ba9399a6716858b6b2c2c9011fbe840ebb0c08b5a62334480aad183508b39cb52de37137169bc30b4d4c86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812346, "uuid": "4c5a3569-ee7c-4d99-a30b-5fc8d227728f", "value": "T12F256C12A2610E37C93F3239EC0E9A6C5827FD41DD6897C37EA93D5D7B382D06466293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812346, "uuid": "cd11b96e-7a01-4dfb-953f-2c04a8ce59e4", "value": "23869c7840ff70c0fa3f99abf1a224c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812346, "uuid": "090f89f3-d52a-404a-b594-16ce5c6e41b6", "value": "12288:ZJcwZP9daceFar4BasT9dqmeLdb2joBqUJeyL5Z1MxtSWu9egz9:ZDUgr4BasT9Am0bgWjSxwHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627812346, "uuid": "a7b01f78-1d82-4992-8f97-8d9dbb142250", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627812346, "uuid": "79ad9094-8821-48a0-a65b-7e0f2f107e06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812346, "uuid": "2a893e81-7840-4315-a50f-f4716fb4e67e", "value": "DOCS-RFQ-009934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9733bd87-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627808717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808717, "uuid": "9c45197d-f1de-49b2-84ce-0b6e6b588978", "comment": "Malware payload (Mirai)", "value": "a3e52d7c9c3cd5b0eee7dd8ec61c9f83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808717, "uuid": "f2de2477-3cb5-406c-9732-2c7bb3d80fd1", "comment": "Malware payload (Mirai)", "value": "66244ec9c5ccd9a6e19d98f8136df51d5a1ffda8b019ba04697580c13bb0aae7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808717, "uuid": "3bc9a3ac-ca36-4d9d-8179-348a4b94323d", "comment": "Malware payload (Mirai)", "value": "fb4ce92f7685d0d3a7e2ca006528dd0ba9277ae0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808717, "uuid": "5b1d2ec0-69ff-4225-b3fb-05b59848f26e", "comment": "Malware payload (Mirai)", "value": "564dec115c5f0e620bc113d19cdf7e3f212d463558bc0501b03864769d77835e1ff3b241c8d46c5dcab22e3d92bc616c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808717, "uuid": "443dfe0f-7308-43b3-817f-ab8e1253a5ca", "value": "T15DC3F772B804DF66F40AD6B604D38B227E30BFA70E631662B31739669D331D52867F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808717, "uuid": "13463149-0783-4ee2-9d3c-1b110b53dfa9", "value": "3072:L+YUpmc5hIof5UM7XgYjykKdOmm/QcuLB126DNb:LwU1of5UMPyk2Omm/QcuLB126DNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808717, "uuid": "a0949c64-1533-4fea-b351-9e1480c45d2e", "value": 118319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808717, "uuid": "205b4220-e890-4f3a-bb3e-5f6b02e3eea8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808717, "uuid": "d8fdc0c0-eaef-40c8-ab1c-45718ff064cf", "value": "a3e52d7c9c3cd5b0eee7dd8ec61c9f83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb1242f-f2dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627831656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831656, "uuid": "b8f04051-fbb0-440f-a0fd-bb702886f763", "comment": "Malware payload (Gafgyt)", "value": "d1201f0df19486cbceb64d2c1d610633", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831656, "uuid": "b6d27734-4a4c-4562-9450-4aaeb4fa4eb1", "comment": "Malware payload (Gafgyt)", "value": "6642aeeb67af89d3e4564af78a7473725364d87287f503ed7daf23d190d8e92c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831656, "uuid": "12c2c14d-1b78-4687-b4fe-14e2bfe53ff5", "comment": "Malware payload (Gafgyt)", "value": "4294fa42bc1476ee8aa137a228bfd92c302bf7c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831656, "uuid": "a70449e2-7715-49e5-9a1c-905e8025adec", "comment": "Malware payload (Gafgyt)", "value": "60300b74981818a6650a14dfc9810ec69482fa8354cdce6975722310bcfdc34aeb5ec6812d57cf95697994579e0de1ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831656, "uuid": "7e5ec01d-eeef-413f-87f7-e21d3baf0085", "value": "T16AB3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831656, "uuid": "eb0c406b-2d28-47dc-9ecb-3e5de0bfaa72", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2ONN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreUNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627831656, "uuid": "4662bea5-4f88-46a7-a26f-15e705976ca7", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627831656, "uuid": "4a88785c-aed9-4acb-9461-685db4cc28a5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831656, "uuid": "b1f93d52-44e8-4f3f-9506-39ca748de3be", "value": "d1201f0df19486cbceb64d2c1d610633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868ce33b-f2c8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1627822862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822862, "uuid": "3a433b96-afab-42dd-ae0f-69db6c9772bf", "comment": "Malware payload (Loki)", "value": "d9c4292c44def6e0a607c24427aa74e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822862, "uuid": "8b2dfc58-6731-4793-9b8f-1091c4c9f769", "comment": "Malware payload (Loki)", "value": "67746f374044e6e84b71de09e0676de8aa022e94ecfb53c83a39920d2533b087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822862, "uuid": "dffd003f-fb2a-43d7-ba6f-bfffa049ec25", "comment": "Malware payload (Loki)", "value": "9cdeb1875be7b2e9e358c3c79b5bf2a5fe7a1e55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627822862, "uuid": "dd036c59-9563-4658-ad67-dd7a8e2211af", "comment": "Malware payload (Loki)", "value": "faeb7b1f9928a47d4d4ae17ae32192363bbdd90b1e8333c869137a7184f4df43dd022ee41a210564fde86390b1fcee8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822862, "uuid": "139d174d-7ff0-4997-bc9f-16eac267c838", "value": "T193A32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822862, "uuid": "9589b571-5bfd-41dc-9f31-81dd3c976499", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822862, "uuid": "b64d70d0-1846-4e16-bf3c-02efb3b4583a", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627822862, "uuid": "25f77d7d-cd5a-4cb9-805f-1aa66c3110d9", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627822862, "uuid": "f4441544-929c-48bf-b2ef-fbf376ac2274", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627822862, "uuid": "dc53fe8e-f37e-49f1-86bb-2e592ee759b0", "value": "D9C4292C44DEF6E0A607C24427AA74E8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4885852-f2b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627815692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627815692, "uuid": "4cdd6b96-d520-4e2b-a005-cffd5897f920", "comment": "Malware payload (Mirai)", "value": "29b64a80409b3bb2ee3cdc93f32d37a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627815692, "uuid": "50705fbc-8dc3-443a-9e71-5b7be1873559", "comment": "Malware payload (Mirai)", "value": "67df7aad33e2b7c699b413163da61a4ebe15274d0462ed0024c253c98af9481f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627815692, "uuid": "f5246f49-f6ed-47c7-a610-8bf4b9c17945", "comment": "Malware payload (Mirai)", "value": "ab2f4c96d6bea5519fe8cc492e4cd06c72e06ed8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627815692, "uuid": "63ae1dd4-608c-4f2f-ac38-55eada6c9ebd", "comment": "Malware payload (Mirai)", "value": "8ec2bbd2edc5e6bf9bba355b1d2a9ef92e233e501d5ac1bf0dd943ff8dc45404ef0d353f110fcc3e8eccede0b00dac45", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627815692, "uuid": "1b5bd574-f436-4cc2-bbe4-e79dccddfa12", "value": "T10D64E08AEE01AE25E9C016B9BA5F034D73778BACD3DBB111F620C72936DA54B4F76044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627815692, "uuid": "e032cb0b-df2b-4f0a-8287-eaf3afc143d0", "value": "6144:p3lOYoaja8xzx/0wsxzSihBa77oNsKqqfPqOJ:p1CG/jsxzXhBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627815692, "uuid": "d2917500-95f6-4837-98fc-6e6a0ac6e4e6", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627815692, "uuid": "835f0a1b-00d5-4dd2-ac53-dd691b36fbe2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627815692, "uuid": "4dd71d76-7016-420d-ae64-912d5bac70a4", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab19384-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627808723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808723, "uuid": "50234f54-fd29-4b2d-a003-8ddf010f919c", "comment": "Malware payload (Mirai)", "value": "26e0404e361a803ccac8c28b5daf9f20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808723, "uuid": "7f98b49b-c68b-4264-a6b2-cac76e529e04", "comment": "Malware payload (Mirai)", "value": "687ffcc1a264711c987befb349f2bd068214b2a303fb812c7e94ce3ea5d71d60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808723, "uuid": "9b3d4d86-9567-45ad-ba63-cadb0ddcd9e8", "comment": "Malware payload (Mirai)", "value": "e6ec4cd242ab78ce677b6b9cf76b0e043564c82d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808723, "uuid": "5b1c235a-4693-4134-aae8-1228872a5db7", "comment": "Malware payload (Mirai)", "value": "e4ba39d8a21cd85be2dd5eace3e08428d20e6a88dee555788e3cdc8e21ed0aa6ece73ec1509c8110e3a8e7299c80312f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808723, "uuid": "5256ea34-4eed-4264-946b-dcb312bc6f9c", "value": "T1B5C3E731E8044B1BC2D223F6E79A829E3F351E9797973311573879B02FF27991E29524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808723, "uuid": "7b96c8fa-f977-4fc1-a7b8-863cd4ba3599", "value": "3072:FDcYVLWKlAQTv+mYubpl2m7/L7QsvmGugiNb:WYVxlAk9YubH2m7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808723, "uuid": "e46caa8a-730e-435f-bb60-8eef7f29f27d", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808723, "uuid": "e7bb01c6-b0a1-4670-a8e6-ec5c8a614dda", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808723, "uuid": "f9650f87-d314-4c73-a6e4-27fab50cfdeb", "value": "26e0404e361a803ccac8c28b5daf9f20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0cb40b-f312-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627854686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854686, "uuid": "cf653fee-2095-4bdd-9a63-9dfffada029d", "comment": "Malware payload (Mirai)", "value": "43b7a636dd9c62d187ab931855e963bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854686, "uuid": "d1412491-aba9-42da-b063-270e5bf92bc7", "comment": "Malware payload (Mirai)", "value": "68954dd33fa951c34c6a8be28a7eb6a4f2bb29e4c8c98a6cfe851dac791ac667", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854686, "uuid": "1c247b99-fc9b-4961-b6c8-b7cab65e5a76", "comment": "Malware payload (Mirai)", "value": "21e17153402f60ecfc6ec3d0fac28f6a978f40e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854686, "uuid": "08f8a4d2-0b7d-4d8a-a684-681f747639dd", "comment": "Malware payload (Mirai)", "value": "b006e4e9fa85d67b9bcb85cb617d396cd83e76eae0d680237d0967844d2d1ce0adb7eec1b3f37284bdaf625b49a7d1b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854686, "uuid": "f261b5ec-d0a3-44ab-8d19-0f28a86c7014", "value": "T16FB2D06C9AFCE9BDCFECECFC90D50A545984B088735D878D9362881C763562AF1C90B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854686, "uuid": "16e10a1b-7dce-493d-9093-108434443738", "value": "384:UuxNuRTN/gJ7nrL2T27MJS8XVdzxDqjT6d2GQok0+VxKA8dsiDr7aKdRWGVCz0NI:UuxNOenrL2TqMQ8XVdVY6d2G7k0wKr/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854686, "uuid": "2e8d9cde-1569-4fa5-8d43-178c1f0bff80", "value": 24556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854686, "uuid": "07c0f7a9-d74f-4ddd-823b-63318bc3b7c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854686, "uuid": "63173307-d0c7-4b83-8bbe-c020de56ba69", "value": "43b7a636dd9c62d187ab931855e963bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8cd571-f2f7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627842950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842950, "uuid": "e23c1dd9-0044-4fca-a886-9ab189ab50b4", "comment": "Malware payload (RedLineStealer)", "value": "11821df0179e7acadb1226ffb045b8cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842950, "uuid": "df6b9c2f-4ae5-40a5-bb4e-f9a2900935fe", "comment": "Malware payload (RedLineStealer)", "value": "6d807d0723b2a5cc11bb2f7e83b678cfd9f981c17dc9fa32d6c79aa42dfd31bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842950, "uuid": "3468d22b-fbc2-4a76-9e81-053f5616f233", "comment": "Malware payload (RedLineStealer)", "value": "fd30b6b8fb5250d3816922b58b2921e7f6f8b473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842950, "uuid": "78187230-9990-4173-b2cb-b87c81139a95", "comment": "Malware payload (RedLineStealer)", "value": "c3bfc99371b857a1a583986857676e2ed6ba6a9939ca80a95fd98a91992a51b68680ab4ddc4a354b59e7de04333e7226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842950, "uuid": "c1e683d4-d5b0-44ff-ab7a-6c745a615e1c", "value": "T162A35C2563ECC61DF3BE0B326470091B47F1E18F6412EB5A4DC1B4EA2E767826548AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842950, "uuid": "b994f055-b263-47f0-af46-da81caec7306", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842950, "uuid": "3c76ae21-fc05-44df-9661-2cdff31d4a3e", "value": "1536:Bm386AEAlBxdBBMWB/LgdS/4aQzd7hgbue7v5uvByAsdNDi1xQeTEyG6WAaoigY:Bi86AdzzaaQzda35uJydd0svAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627842950, "uuid": "3eef1c93-fd89-4008-899e-a64d1d7508b1", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627842950, "uuid": "ca7e6b90-9177-4cb7-9b95-5826d14a0fce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842950, "uuid": "c05dfd4d-89bd-43c1-ab5b-5149f45632c1", "value": "11821df0179e7acadb1226ffb045b8cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce23154d-f2d5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627828566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828566, "uuid": "a1c39f66-c092-4165-b405-23e49c7ecf13", "comment": "Malware payload", "value": "e4dc1316bde5f058c3eaf297a378f07e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828566, "uuid": "9e418255-5fa4-474b-9c15-bba6801de734", "comment": "Malware payload", "value": "6e5a7fcf8c27fb801d08efe579582948fea2eb62f2edf9669350c50eaa91ed71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828566, "uuid": "1cbdb1dd-408a-4f92-a788-0dfaa58c8a22", "comment": "Malware payload", "value": "bf13554579f3a1790d38c340803b7a7435af19b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828566, "uuid": "4f42218d-4b28-4d33-8e58-41ad6c8d80c3", "comment": "Malware payload", "value": "a6919ff54088a01ffcdb089aa0f6131f481778352751b9a4e8afa2eedacba2ad9c789adb5831d714bbe266aea1f8f1ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828566, "uuid": "1d9c6fcb-3069-4d04-a02f-c4bf435bb804", "value": "T1ADC533C38D9D35BBF65D63BC7EAE7B842E0F7427214802C9663867E069534988EE504F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828566, "uuid": "6772f71d-ac71-43e6-8c08-98f459794e18", "value": "f6e4c27a9632149744d004de67a6dd3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828566, "uuid": "886a2f74-de16-44fb-bcf3-58fd93cce675", "value": "24576:vIt5+bgJZt6Ay6hHW3BfIOcqCqxEclEappvNo6JOyRyjIm5h/29xNkXt/94IFi1s:8kgAADhHW9PcrclEIrRKmnksR0DfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627828566, "uuid": "29ac0118-b443-48a2-af35-7979f99b1f74", "value": 2581504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627828566, "uuid": "33a7ad1b-15ba-4441-9caa-ba90e797a234", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828566, "uuid": "eb40ddd6-ac32-4c94-b75a-d7091e9483b0", "value": "e4dc1316bde5f058c3eaf297a378f07e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cfea1f-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627808760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808760, "uuid": "2d7a8f1d-2863-48f7-a659-6113cb18e464", "comment": "Malware payload (Gafgyt)", "value": "1fccceec318597a415e2d7c6c4413138", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808760, "uuid": "3d46e1aa-e468-4c5b-aab7-938934bd6538", "comment": "Malware payload (Gafgyt)", "value": "6ecb0626ec76c63783bba100b9c3bfd30efcec4342f65fb7ae10fe88dc0d50b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808760, "uuid": "0008f04f-241b-41c3-be1a-e01b4981a128", "comment": "Malware payload (Gafgyt)", "value": "1922ef1975da6e9c90df0be8baeb773ac3c38893", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808760, "uuid": "ab4e40e0-9707-4917-9c1a-9fd3caed0fdb", "comment": "Malware payload (Gafgyt)", "value": "ebad20b49c898a5e43907dc2cc1efbd1717d88b1187c8bd0d76a90ff37ed3e550eea23786b965dc2bed95d72ee921ae0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808760, "uuid": "cbf1de9f-116f-4364-aa85-0a6bbdccb8ae", "value": "T1BF930941F9418B27C2D337BAE78F479D3B356A5867D733116A346EB42BC27892E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808760, "uuid": "437a49af-6a39-41a3-bb6e-791e0b2ecb07", "value": "1536:3qbFN4P6jdJmkfosSfq1iP/vbxHO9lXPz5YdmZCmREqQ4b/X7XSee:W4cJdp1mb0XPz+dbmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808760, "uuid": "fad57cad-6f21-4e54-85c3-f6c3b4f551d3", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808760, "uuid": "c99849dd-dd2c-4f99-9a16-c492b8d64608", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808760, "uuid": "3c05e555-b636-47d4-9914-c0d59b8e6208", "value": "1fccceec318597a415e2d7c6c4413138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e7aab6-f2ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627846274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846274, "uuid": "83e85f31-5828-4756-9899-6c2219ac87e2", "comment": "Malware payload", "value": "dfe21baea2a1898113da529289fb1b29", "object_relation": "md5", "Tag": [ { "name": "HBanker", "colour": "#C5F300", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846274, "uuid": "4cef3c93-ed32-42b2-bea8-89a6723d88d5", "comment": "Malware payload", "value": "6f35ab9d6aed8b8df1754149da79be5cdadae7b5366e8f2be46d9370f7e920c0", "object_relation": "sha256", "Tag": [ { "name": "HBanker", "colour": "#C5F300", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846274, "uuid": "5e276d9c-3928-48bc-9578-75e9bf92aebf", "comment": "Malware payload", "value": "c70700683d67f169d208c245e7c77f3e9e0ef24f", "object_relation": "sha1", "Tag": [ { "name": "HBanker", "colour": "#C5F300", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846274, "uuid": "9bacd230-f0a6-4f69-aaa5-862a5b524c79", "comment": "Malware payload", "value": "c9349e4c48f9b11e990337ce41a8a23b4258188fae8f24beb4b4a431fd9d644cf4918948276ca7a64a42c2012af54eb9", "object_relation": "sha3-384", "Tag": [ { "name": "HBanker", "colour": "#C5F300", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846274, "uuid": "f8dd2967-6ece-4931-95c1-cdcefbef9582", "value": "T10EE533B0D48264357E99AC394E2E0C6971C55B34DEF16C3D83D8BFA4BC983DD27A2168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846274, "uuid": "2ab0fb22-1608-43b5-98e3-2f655886f5e5", "value": "98304:1N/rg6gL9U8iiQ1NOIo9aHg0UerlpZibnEgHf8pdF:jGL9UPV1gvaHCeZgnEg/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627846274, "uuid": "d1c68e1a-6eb3-4a3d-a4b0-374200ee2d0f", "value": 3207299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627846274, "uuid": "741d6b5a-7ecf-45ce-ab25-4dfbfcd4ca4a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846274, "uuid": "87a11013-627c-4931-902f-455641c4079e", "value": "HBankers_pack.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa17b35e-f2af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627812185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812185, "uuid": "d0596c95-f26d-49e0-96d1-e434fa3cce09", "comment": "Malware payload (Gafgyt)", "value": "a1a996643cac77af06c514f005f16949", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812185, "uuid": "f5ac4e86-4720-42ee-b88f-c943d5287da5", "comment": "Malware payload (Gafgyt)", "value": "71c566d3383d725d903b922f2437cc1e66ddcd27032f06899295813321fd5e7d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812185, "uuid": "e0bbbe1a-2676-4298-b001-fcf5cecf2958", "comment": "Malware payload (Gafgyt)", "value": "db4b09b34dd9c0393ba262f196628286bcdbbc19", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812185, "uuid": "e38eedcc-4c67-4a7a-95af-5c2d8b25b2d1", "comment": "Malware payload (Gafgyt)", "value": "90a9ce1ed0946384f172e7420e37e8e1bd91b9eb612f360244796c0c430e1fec704c5782878ee84a9cc9d371cd789e70", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812185, "uuid": "660c056f-cae5-4151-84ce-72193a93a1f9", "value": "T158E3842E7E22ABBEE168863107F75F70C79521E336919382E26CD6185E7124D1C9FF90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812185, "uuid": "b6297895-3d99-420e-9f12-dab8e24dbb9d", "value": "3072:8ojQwuvPKGWQkL05huY4oemMJMRSXqK4Yc:XwX7RkA5huYxemMJMRSXqK4Yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627812185, "uuid": "c34f8bab-1368-47bd-a875-6731bb6b1121", "value": 145048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627812185, "uuid": "b247bd0e-e56d-4a41-992f-7b6485fd659c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812185, "uuid": "dffa9a3f-9c44-4886-897c-f5ea48dba965", "value": "Might.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f73b011-f312-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627854445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854445, "uuid": "f9e17a39-f33f-44cf-a177-cc1832152e6c", "comment": "Malware payload", "value": "fd047a74224274e29409c2b841c2b306", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854445, "uuid": "28a63b43-0bd6-4f13-a983-7ab34ff90a66", "comment": "Malware payload", "value": "71e5de30f627eacb124f9f11d7ba70de43997847e88a61e440593ef9fd776bab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854445, "uuid": "a65a78fa-5b96-45ca-afa8-be8d7e18ece3", "comment": "Malware payload", "value": "94067fbee35addbdb6cc1b330aa6746415382f4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854445, "uuid": "4e808d55-15e4-4095-ae6e-c4480d92550a", "comment": "Malware payload", "value": "9cecb12ea05effe570b60b47effad1c21000f90c056af8e1eac18198b5a9fa8209c6eba6c937e762d2d2d0f72ea3c8eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854445, "uuid": "3a55b343-f3ac-426b-a60b-913c9816c7ed", "value": "T1DEE4C033F0C2C07ED0321032596CEB6259BFF9320A25499BA3C4156E9FB57D29E3665B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854445, "uuid": "0a4557d6-9fd6-40f4-9e9c-1dbe37b2de5d", "value": "2a908babc5cc3af850e078751d7de0e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854445, "uuid": "80ed840d-da8b-4890-b55e-31b47c6f5f9a", "value": "12288:VoJqNIPtNmO6IOOEp0TMlja7NRl2PSVikIyoyueh+AkHcnLwuukoCOD6zlTjOz+2:VoJEKZ6IEGTMxapRl2PSwHTehy6B8+p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854445, "uuid": "e3b3f69e-572d-4eac-9448-cfd47705f203", "value": 698280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854445, "uuid": "0c94836a-25b8-491d-bad8-382ba67b6945", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854445, "uuid": "e3603836-383e-4e55-bd95-0a3189cbfde7", "value": "fd047a74224274e29409c2b841c2b306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b25e5c7-f30e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1627852828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627852828, "uuid": "4ae06824-8c06-4f45-bfa3-4e151223e6bc", "comment": "Malware payload (NanoCore)", "value": "afac8acbddfc59d99959ea4ab137fe92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627852828, "uuid": "8f149472-6b03-46dd-8ce2-5c21bc2a1a5c", "comment": "Malware payload (NanoCore)", "value": "7878b172fba181c1788524b5ef99f4d9129714e6193ddab14f7545670231fcf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627852828, "uuid": "48f91ae8-268b-4195-9bef-3ebaa3a94979", "comment": "Malware payload (NanoCore)", "value": "028fa87f1970e2c84506c0997e553a72b5ac144e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627852828, "uuid": "95a91b49-7a32-458b-8b8d-75d5d1275261", "comment": "Malware payload (NanoCore)", "value": "a559aaec14770a2439b3f54da332a874b27eabe9fa1ea1c2c2ec6bbb84ec15be1ad24543616822a109e3d69f570f034d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627852828, "uuid": "00db7484-2c96-4426-9ea8-5be52fe6857f", "value": "T1E8E4BE6484C8DF9ADC5C03B4DA8C02F02EF19CA6E074E5633EC57DB5B5B0A55DAB9382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627852828, "uuid": "1be47cb8-896d-462f-9597-8eb2b406504f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627852828, "uuid": "4a5832eb-ab1a-44c6-baed-5e1d1681b9cb", "value": "12288:zxRS7F7iS/d348yw6V/avP+lDh0HwhuAnnCj9+u:z4cS/d33uA+lAwhuwn+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627852828, "uuid": "6c7e1c41-f46a-4cfc-9e5d-7acf7fbccac0", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627852828, "uuid": "94143e9f-0879-40e7-8dd4-841e10bb24c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627852828, "uuid": "7b4f3809-5402-4ca7-8b89-89b7874d8c6b", "value": "afac8acbddfc59d99959ea4ab137fe92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61edead-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627808742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808742, "uuid": "954182e6-cc9e-40b2-a242-7e8df57b34d0", "comment": "Malware payload (Gafgyt)", "value": "c454ec7538dba90ce942e3625e3c27b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808742, "uuid": "9e4331d6-ca4d-49e7-a702-be76d8a9939b", "comment": "Malware payload (Gafgyt)", "value": "7a9faae4d7d55142b7769491ef613d0b3b54d5f48322c6fd17d4438c33146592", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808742, "uuid": "6c0780f5-77d4-44c3-970c-cec7db55657c", "comment": "Malware payload (Gafgyt)", "value": "14e5d1eee0809fbc286b7117f8570df036407657", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808742, "uuid": "bdde03f4-e1a4-4470-89a0-8c9866c8feaf", "comment": "Malware payload (Gafgyt)", "value": "8e51202383ee90841b81504cc50b7be87ebd6ff8bd104eba14186dd27719a46d10b25d35afe346b32b1e4c33196c564d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808742, "uuid": "19f8a840-0dbd-4902-832f-c3f71d088658", "value": "T1E4E33A05EA408B57C1D2277AF6CF424A3333AB54A7EB33055938ABF43FC27995E22516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808742, "uuid": "159a50f8-bd4c-4e62-930f-5fa6860e7343", "value": "3072:gI4HnYasTJPcOl8w7aMz96ZnM//XM/9qlmpwfvRQfZn:gI4HYasTJPrl+MzMZnIPM/9qlmpwfvaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808742, "uuid": "7ddbd9d6-fb49-48cd-82fa-74f5a9520057", "value": 151465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808742, "uuid": "eabb20d5-1752-4ea0-938e-e59096920e86", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808742, "uuid": "fa46c711-5883-492c-8a00-4a539e3502c0", "value": "c454ec7538dba90ce942e3625e3c27b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23865a4-f2e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Redosdru)", "timestamp": 1627835821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835821, "uuid": "63bb64b7-406d-4a81-a3ec-5bbb359a3568", "comment": "Malware payload (Redosdru)", "value": "02ab49305f95f010772aba55ea61744e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835821, "uuid": "ec111679-35e2-4cf8-b215-c1613a6f7f60", "comment": "Malware payload (Redosdru)", "value": "7e6b769afc67e5e76904920f69a8d31475576ee4dc3411379efa665de38f7697", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835821, "uuid": "0a90764d-8a1d-413a-8228-0338f1e34a5e", "comment": "Malware payload (Redosdru)", "value": "21d8aed31b7a2ccd2254a21c940a545693ca5835", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835821, "uuid": "c74605c8-6c40-431d-ac5a-71a0bfe6094a", "comment": "Malware payload (Redosdru)", "value": "612d79cb66d6b743ed2b770df57c76622e9e6e9cf5948407b2fb78777758213bf32b39e088df4231b9a214c2bf6e7f3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835821, "uuid": "51e0e683-d8eb-474b-8386-dbe756c3cfef", "value": "T18BE1AFEAB53F4F1BC73C4DB687C5C514788F25609B9F93CA6E0C23A988B955C420C319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835821, "uuid": "16d9cd2c-5e1e-4b29-9724-b93c2e5f4911", "value": "df4e1b963fa5cdc49c40d711c068a030", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835821, "uuid": "0da909d5-fb47-4a4b-9d0e-449f35e32393", "value": "96:y6WLGnf3+tUxu1ZeJm30hYLhV2TjeOrgY35yC+6rDSANyYCk0DicmXnMigz:y6WC/yeJm30SW33vJyu3VVCk0hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627835821, "uuid": "c96827f1-1087-4a3a-8db2-09c6b9cf0e58", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627835821, "uuid": "1b1cb8f0-ad6e-4d73-a4ea-222e1bf80366", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835821, "uuid": "d7718fce-32c7-405a-a127-904744ac06dc", "value": "02ab49305f95f010772aba55ea61744e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2c1f66-f31b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627858706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627858706, "uuid": "72ca1c68-5d95-4e84-9697-7e27c0c2fdf5", "comment": "Malware payload", "value": "d0512f2063cbd79fb0f770817cc81ab3", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627858706, "uuid": "f6ba1d3f-85d9-4569-ad39-92a91ffef079", "comment": "Malware payload", "value": "7f6dd0ca03f04b64024e86a72a6d7cfab6abccc2173b85896fc4b431990a5984", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627858706, "uuid": "19a0a9a7-79a5-45af-9c22-cbcd46b50755", "comment": "Malware payload", "value": "e324a2c8fae0d26b12f00ac859340f8d9945a9c1", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627858706, "uuid": "d6379af4-3135-4a64-9e49-884308b34dac", "comment": "Malware payload", "value": "18fc0ae8c2dd2c59a1d7295947433c958c456ba822c64b8a63b2f949a4d976a5876ee8898fddb287590601ce18029ea6", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627858706, "uuid": "e40471ed-2d28-43ec-a786-d3307f1b79d8", "value": "T110633A207081F0B3E466DAF3E70AB5A26349DE360D766827E9E80F042DF85536F15D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627858706, "uuid": "fbd096df-e5bd-46c7-adae-aad57b7dcc90", "value": "c94b1566bf307396953c849ef18f9857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627858706, "uuid": "f7fd05ea-7383-4e48-a1b7-825ea01a834d", "value": "1536:RzICS4AT6GxdEe+TOdincJXvKv8Zg3kl/:qR7auJXSkZg3C/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627858706, "uuid": "ebb258ec-9be9-41ec-be66-d03afd812134", "value": 68640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627858706, "uuid": "77f57ac9-2c6f-4e1c-a300-8639135d1bab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627858706, "uuid": "9b20e36b-b428-46a9-9de4-f2c3d2f83fd8", "value": "7f6dd0ca03f04b64024e86a72a6d7cfab6abccc2173b85896fc4b431990a5984.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31788199-f2ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1627846342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846342, "uuid": "f929fe43-bb0e-4e9a-878b-fb92a2809233", "comment": "Malware payload (RaccoonStealer)", "value": "a86ff7ca3055602b0f1c6395a17180c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846342, "uuid": "a18c8331-7059-4474-a622-8633c1b0f4bc", "comment": "Malware payload (RaccoonStealer)", "value": "7f74f36952503e1686edd46a2987fd0a540f18cccc9732e9814620983b2df7b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846342, "uuid": "78b63853-d6f3-4ff0-8dc4-aba869808746", "comment": "Malware payload (RaccoonStealer)", "value": "182018d914a1b6b629f6212338525a62ec174a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846342, "uuid": "c27bc73c-5d1b-4e54-9337-b1021e199f5f", "comment": "Malware payload (RaccoonStealer)", "value": "a0d4dd9ec4f7a7ee2e47badc78af3b055bedd1104b6dd710dadd1db485f44e21b7fca8eb072d55eadc90134efacde9dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846342, "uuid": "3dba011a-8d54-4359-bb39-868e1004cd16", "value": "T189C40111FD90C432C06546704862D7E26639AC2169A9A60377643BBF7FF32D2637AF39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846342, "uuid": "98c35440-4f56-4aef-8e3a-e8825cfe64b1", "value": "11bc5a96dc8b455509d3ea367d443d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846342, "uuid": "e45d66bc-c39b-4c34-b650-39c44cffba2f", "value": "6144:LhBwvv8WqDFN3+HA9R/16fVbctUvu9zyNtlh20+guqOyvFGLMC8EBKw7lefnWajt:svvqR/160UeIt/L+pacLMC89WaU2N2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627846342, "uuid": "6c2deb1b-74a6-4777-9761-70c0f2ee74b6", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627846342, "uuid": "85ca7530-e5fe-4fcf-9db7-04fe29f27e3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846342, "uuid": "1de4b2e7-6896-4231-bff5-15a49180a63b", "value": "a86ff7ca3055602b0f1c6395a17180c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36a577b-f2ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627839285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627839285, "uuid": "e39bfcdb-cc1c-4613-bf06-067e59cf698e", "comment": "Malware payload", "value": "d097d6e3d52d03949ce798aa768a805c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627839285, "uuid": "004a4c37-a0b3-47d2-890d-a3119406a882", "comment": "Malware payload", "value": "84d7f98350c50be6f36ffac192a8fa44b63b1378f4ae648fa092af7d210b91b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627839285, "uuid": "0e9693bd-8ca4-4f7e-a458-74c19dc434af", "comment": "Malware payload", "value": "6dcc9c65a08cded842f502c19c6d40db78828fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627839285, "uuid": "b1bb5000-b16f-4353-9716-f0602fa6833c", "comment": "Malware payload", "value": "405e30f09af636a8aea27c3a6d2dd6d4fca98c4b7ec166fb8301f469e436e3e9442de1ec5789a7eeb464d4926e01531b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627839285, "uuid": "e2a6f1f5-023a-441e-b033-b4b6b661f9d2", "value": "T180D423C32CD62AACF04C61F89F4E3CD4064D9126C2DB4A0A7D78A7658FA34ED46A147F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627839285, "uuid": "90436220-44cb-4cb3-9da8-2d85f96d909a", "value": "12288:fkmRrN+DyQMe+qtNx+rUJpbt6Ag36rtHWcxFsBCoIOz4qC9YBqN69m:vIt5+bgJZt6Ay6hHW3BfIOcqCqxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627839285, "uuid": "3b35be4b-4ff0-4c3e-a4c8-f8d53c6947a4", "value": 622871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627839285, "uuid": "2c4b101c-bc09-4743-b4ca-5bb5c0f96e80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627839285, "uuid": "3cda8582-8b96-4a1a-a91a-7f8593782b00", "value": "SecuriteInfo.com.W32.AIDetect.malware1.11304.30359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f6a563-f293-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1627800263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800263, "uuid": "18f34732-af5b-47b0-b620-f0aa955e35f2", "comment": "Malware payload (Dridex)", "value": "a66dbdea71c220e57325e20d01516820", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800263, "uuid": "1ce1be67-1140-4b32-9ef9-140e265a9e6c", "comment": "Malware payload (Dridex)", "value": "851c23c1e7511cae9134da4086116a84a8c28405a0ba05f1a9654a518e2cd64d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800263, "uuid": "9b9b1a2c-63a0-4e5e-a888-42b7f8fefe74", "comment": "Malware payload (Dridex)", "value": "c72bfbfb631123ff26c4278ca4f059b8185d46d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800263, "uuid": "03c69fff-cd22-4194-a33f-0500951f57f5", "comment": "Malware payload (Dridex)", "value": "a87ee50296b5116cb5ecdc3c965abfbd93210cfa6e3a6135adac48b3877369fa5910191a2eeeec968e6582b0b8eb7ee2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800263, "uuid": "2faccf97-288e-4b27-a3ab-539b49363891", "value": "T18035F0C63668EA62D71BF170CC299A32C356BC0E57B4603777863BEA36F279109113D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800263, "uuid": "f74060cc-e230-45f8-acc5-8b0ba96805cc", "value": "9e8f80efadaf14eb472507064b44e82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800263, "uuid": "8b986781-6489-4e80-bfa2-82c9d12f334c", "value": "6144:VK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTlHZOUlcRvfc:VM+ZdkmHubeaCo6IHZbOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627800263, "uuid": "4057c4a1-1627-4146-a70e-56cd93280675", "value": 1131008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627800263, "uuid": "0e56b2ff-058f-4196-afe9-fa8ced516656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800263, "uuid": "a4edf857-b44a-482e-87cd-2401f4cad86e", "value": "a66dbdea71c220e57325e20d01516820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42286bf-f2db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627831153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831153, "uuid": "b67ca634-3551-4bbd-a476-069ac6064e2a", "comment": "Malware payload (Gafgyt)", "value": "360c9a41e71f17919198c21aeab4eca5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831153, "uuid": "1c958b1c-d3cc-4721-8fcc-18cd85f1aa56", "comment": "Malware payload (Gafgyt)", "value": "85632ed117d4e98d35f420f8b0932aa308bd5369a13faab605ac4747d34a1b59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831153, "uuid": "1dee6181-ac0c-4965-bf42-7a0f779c7a1a", "comment": "Malware payload (Gafgyt)", "value": "e0d32907bc04f7eb5979dcb20985255a01221ed6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831153, "uuid": "d4af316b-d2dc-4560-b760-a4c6aae90820", "comment": "Malware payload (Gafgyt)", "value": "bc8e1976155a483323dc93344edcd83c80b06258003d6e22622dfe6f526a202e3d115cec86c314f5ea8887fec578fb12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831153, "uuid": "fa7d3abd-4c59-497e-b1ae-38234600e512", "value": "T14D930892B900EFB6F40ED77A44D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831153, "uuid": "4f60d781-5100-4f68-aea2-e67112ebacbb", "value": "1536:4mZMaXpB8F9OEG6ktQm3r/FS3n9RIB6Yy36g962f7vTmQ9VqXjewf2Le:v7p09W6KTG/IB6Yy36UNfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627831153, "uuid": "9f71e584-02da-4caa-a7a4-ee9bd42119e0", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627831153, "uuid": "68ef34aa-68f9-41ec-97e8-cd2fad86c1e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831153, "uuid": "502d400a-d884-4fc8-afea-087348e850de", "value": "360c9a41e71f17919198c21aeab4eca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c916050-f294-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1627800431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800431, "uuid": "ee42cf1e-c6ed-4d73-95d8-c615b28d5b75", "comment": "Malware payload (njrat)", "value": "50d8ac11ba7973758b13053ba156b7cc", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800431, "uuid": "c4d3aba1-139a-48d4-b303-b7cdbd0dbfb6", "comment": "Malware payload (njrat)", "value": "87f4a4c323f26710b7acdc123173fa63f4ccb4f3c8239dfaa489ee69ab89f7cc", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800431, "uuid": "c8dd1068-8484-4b4d-9da8-942c40bcd7d6", "comment": "Malware payload (njrat)", "value": "4698750a58a24d43c7102ba0f0f48058c7cb45fb", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800431, "uuid": "5b69118f-20fb-407a-b32d-6287d6b8aae2", "comment": "Malware payload (njrat)", "value": "38616f196794187fdc87d9c9e2b17b5325933578b9d74f50ac24bf08d57c8d3493192e970fd354b2a7bec7aa96f0d6f8", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800431, "uuid": "a012fdc0-daa7-4146-9623-c8d739c778ed", "value": "T1442103203A07F135504AE3C65DB99A39F2B752E6C5505486363DC19950BF5EE28C3ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800431, "uuid": "ff4a3677-f1d0-4f83-b02c-32e63e4264fc", "value": "24:APcmi+r3ibJWWNzeArpIqmnAMvAN5STD69P1EI3SDKV:rt+bitvz5rK/AN5SPc1EI3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627800431, "uuid": "037f8b38-cc93-43d8-b33f-3ba45c750abf", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627800431, "uuid": "fbce14d5-ba63-4427-a620-732dd7136062", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800431, "uuid": "124e927b-9a38-4fc7-8506-dc6f4773b048", "value": "Booking_confirmation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bc93aa-f303-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1627848257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848257, "uuid": "3cfa4e4a-3a8d-4e5e-85a9-a311d9a78842", "comment": "Malware payload (AveMariaRAT)", "value": "7b751b12e1ba5957b750deee88c76556", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848257, "uuid": "08281882-5de9-44dd-994b-4825abdacd61", "comment": "Malware payload (AveMariaRAT)", "value": "88694f8e030e9d1ef06c16419ae18bd428c1e6907d191e20679f36734b2fe22b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848257, "uuid": "26e90cf7-3dc1-48e2-ab97-55628c12149f", "comment": "Malware payload (AveMariaRAT)", "value": "c00cc6033fc686d60a8731f5f9fef47c9b9dd6e6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848257, "uuid": "28446be6-ce25-4d04-9634-b72f45352e1e", "comment": "Malware payload (AveMariaRAT)", "value": "093dc43529fb7924e6ffe5181594e502a0cc808d58912609d7892936137f0928ec82f60dd1e3ce0b3b635038d75cfd9b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848257, "uuid": "e56fd06e-8402-4f18-8799-14f617bc5bb4", "value": "T1A254F11779D5C0B0C0760D3141FCEAA6596EFD182F69CDB7275822A90BB04F1AC36FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848257, "uuid": "ee7df4ba-547b-4ec5-a697-67532aa13237", "value": "93c8a344ef87e9896779f819a07dc9df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848257, "uuid": "009e47f7-a6ab-45a6-bb26-a581f1439492", "value": "6144:F2OO3dRD1tAJRn3EdJgq9RN/7581IWrAL7qHJKeQNCE:8VfDPenWJgqdTqI0AL7qEeQNCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627848257, "uuid": "d6786eb4-a218-40fd-95f1-b37aee5e3282", "value": 304224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627848257, "uuid": "d6e98bd7-5072-4b99-a529-7e32705ba384", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848257, "uuid": "226087a6-059b-4e27-bf7a-0af826fea7a8", "value": "Permintaan Baru 0010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e46dda6-f296-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1627801240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801240, "uuid": "6386869c-1129-4d43-adb8-1d0a08385115", "comment": "Malware payload (DCRat)", "value": "a6c8af48b5f7f850e5400cca5c288ae1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801240, "uuid": "2a956c91-cf69-41ec-be86-ab9fd7606efe", "comment": "Malware payload (DCRat)", "value": "88c642b1fa43b77487f3916dd95ac236189971475c3289c745dc45a739e6453f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801240, "uuid": "d469fcd4-5e16-424d-b0c4-8aa64090e12a", "comment": "Malware payload (DCRat)", "value": "0d506f9555aa68ddc5740652d477dd2e96a45e2b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801240, "uuid": "7999dde1-8993-4f1d-aeda-58ad6831d1c6", "comment": "Malware payload (DCRat)", "value": "5050c3621c86f2587cadd32faef6156078b8da076f529b905dc576ab2037edf58849e1f647408288f229d421de4b957f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801240, "uuid": "69fc3e48-dd33-41ec-a05d-9d4f446ac782", "value": "T139A4F097B2E051A8EAF582F6D9921342EB3074711714B3DB57B943B61B2B9C58F3C3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801240, "uuid": "73e3da17-a31a-450e-8e18-b0078510f16a", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801240, "uuid": "d22908bf-da8b-48b1-b796-810eb9058766", "value": "12288:AbjDhu9TsJYZBuLuM1reSNsX3Qku9EFBtsOciz4q4:u1eTsJZPNsXPu92Bts64q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801240, "uuid": "05b5138b-9e92-41e1-9e92-802e9a4d5bdd", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801240, "uuid": "56836794-553f-4633-bdcd-b9fad158d162", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801240, "uuid": "fbbb675b-e250-4b2f-9aea-765e4b377e34", "value": "a6c8af48b5f7f850e5400cca5c288ae1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3920e6f6-f2ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627846355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846355, "uuid": "360e4be5-6637-4e08-9431-a0ee91cfea26", "comment": "Malware payload (RedLineStealer)", "value": "55cf4b389dd1807d39d8e7fc762749d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846355, "uuid": "154a9e62-0fd0-4a9c-ba86-45e5f62c17d2", "comment": "Malware payload (RedLineStealer)", "value": "8aaf65b0f9e9b3a932132671c338a1198d5b1104dd8f7499a1afec5309bae904", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846355, "uuid": "5b4e9d6d-572d-4a41-af2c-ffd216ec58d5", "comment": "Malware payload (RedLineStealer)", "value": "ee4d12ff771332ddd152875fd24ddacdeef93c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846355, "uuid": "e90d4902-a98c-4df2-8f3b-93329a609666", "comment": "Malware payload (RedLineStealer)", "value": "7a0f177acdc2ae4359379435d31b8a284f4e67c14f55d196e3ef94fa9541c5b8328d5f179f91a8809d571e85ab643d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846355, "uuid": "c435d96e-4cf0-4ccf-aad1-acf6d9a75573", "value": "T197E40210FE40C572C25219308466CBB66379A8641A66820737A8277F7EF32F26776F7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846355, "uuid": "f7814e2d-bc8e-4130-98c0-cf1ea4b6492c", "value": "11bc5a96dc8b455509d3ea367d443d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846355, "uuid": "be4bb93a-b656-409a-9653-544bb575ed95", "value": "12288:WymNTxOkg0nQ1PGzyjUQdvxJSz8lhgWfzFRogwkilj5X2g:0TxIIEGzydizMgWrFRogwLj5Xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627846355, "uuid": "a1e0bc00-3f8e-4def-8a2a-6a1b10e9852e", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627846355, "uuid": "c71e31d1-90a7-4a7c-b334-951980aea985", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846355, "uuid": "be86662d-c7dc-4c42-a33b-3d47cb61cb55", "value": "55cf4b389dd1807d39d8e7fc762749d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47454270-f2c9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627823186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627823186, "uuid": "4ed2be14-c004-40f4-9a3a-c1751ea962c2", "comment": "Malware payload", "value": "5bf088dae5ad40d25667511efd8f8cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627823186, "uuid": "50533f87-89f2-45b6-b59d-d2752530e2fb", "comment": "Malware payload", "value": "8e179869692a91d891d9cec79601780b59615b85d472afdc0d3b70a48a81284b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627823186, "uuid": "e156c772-6fa3-4aaf-96aa-dc907a4364e2", "comment": "Malware payload", "value": "c589cc9a64d8cabd2c58fa62eeeeef8b27804cfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627823186, "uuid": "c217acb2-5626-4393-bdb8-3c1f1984af74", "comment": "Malware payload", "value": "3537eda8a9caff895d972e4f13d8a40feb98c79deb2778fbc69279cfb9114394f131aad4943ac15e5593627a75a65f7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627823186, "uuid": "785fa548-6f70-4f52-91c0-f1e4c4d44ba1", "value": "T18E56E015BCE214BAC97ED230855697517A313CA483323BD72EA4B5AE2B75FD02B3E314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627823186, "uuid": "24ca9e21-50aa-459e-a9af-e982172324cc", "value": "49152:F9eGepgtCWIxe/h55YTVEduGEJfoi6HmHBhuJl1jaYSsldKYjCVhg6er5HcocPKF:FgpgtN/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627823186, "uuid": "b0e730ad-c305-40d4-9d12-7b476d4d8e1f", "value": 6207307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627823186, "uuid": "70c04820-9d5b-4c83-99bf-ad40b24ab6cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627823186, "uuid": "88c0e7e2-ab44-4b17-bfb8-2c7ad95aa062", "value": "5bf088dae5ad40d25667511efd8f8cfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787eeb57-f2f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627840448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627840448, "uuid": "f120beb7-0dea-4fbe-b7e9-ecc8e11ccb7d", "comment": "Malware payload", "value": "85af27073ccc6fadbc02d76c3bbad917", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627840448, "uuid": "65970f11-cfcf-4ceb-b091-9ec42f1e8b3c", "comment": "Malware payload", "value": "8f1c6abcd065193379083f0a9d9bbdd3b7d62d8106bf7b01a1c26005378fea15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627840448, "uuid": "fd2f3782-499f-4196-9f95-810346dbffba", "comment": "Malware payload", "value": "45c4f6c68f747b49d8f4868fadcfa12f71901fc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627840448, "uuid": "dd494473-ed9e-43fd-81ce-89c3a79db567", "comment": "Malware payload", "value": "43febec290bd3450229b65c4ed62a2dbd17dc59b1d5da86b8e0dc95b95f9536c4ba63fffb30b3b59fd43d24889e531bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627840448, "uuid": "3a455d0b-4eb0-4c09-815f-05a343a4c994", "value": "T1EE95E08F660BC2ACD41D2E3110370957B671FC76E7A5997E8295333887B784F9683A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627840448, "uuid": "6fd17c17-94c0-4989-a70e-a4acc636712e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627840448, "uuid": "7666b180-e0a2-4b37-89f6-eb147968da04", "value": "49152:fdtfF9NTdMPmdgqnW7XkPxYxdXOxIqnW7Xk/qnW7Xk:1BF/dMPmdgqnQUPOOIqnQU/qnQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627840448, "uuid": "13413a4e-f513-44a7-bf77-34a231749775", "value": 2019840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627840448, "uuid": "6d8f6266-d648-40d1-81cf-eefdccf75bb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627840448, "uuid": "3a2a489d-feee-47f0-aa81-67c4ff8595b3", "value": "85af27073ccc6fadbc02d76c3bbad917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0e0774-f2d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627829042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829042, "uuid": "27c0423f-4117-469b-99e0-7153d1e1bd9d", "comment": "Malware payload (Mirai)", "value": "e1c30ba3e6d9e7de39a4b51091437486", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829042, "uuid": "a076a76b-efab-4af2-87a6-0a6076cafc95", "comment": "Malware payload (Mirai)", "value": "91cae68ca54ea551d6c307f0d03a23df50b4c370c2cb36904c95e24ecc2baa54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829042, "uuid": "27559608-69d2-4a12-995b-5a4cac297d44", "comment": "Malware payload (Mirai)", "value": "ec06178111bb2450bee1153de802ff652a31281d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829042, "uuid": "e56f483d-71a2-43e2-9e55-84beb0226cc6", "comment": "Malware payload (Mirai)", "value": "f3a19dd34c9d73c9cc18176ebebf81144f9285f0687c3ed643e1d5df735950df41e218cd9e74be1890d1d1ab649afd1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829042, "uuid": "8db9d0a0-d317-4334-9a9d-66f9c0189918", "value": "T1735329C8A593F8F5DC140978306ABB66AEB3F13F7035E99BC3D86927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829042, "uuid": "49c6f9e6-652e-49cc-b6f7-4a71093a1c4f", "value": "1536:IEX9170vwHbQXZ5+qXDEuXi95TSW7V/DjObeFt6PuQ4Z7:d917iwHbQXZ5+qXA599SWZ/XObeb6GZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627829042, "uuid": "cc904f91-68e6-442d-9166-2163627929b6", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627829042, "uuid": "3ac14c71-1b64-44d2-b8d1-c2c35e6faae9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829042, "uuid": "3743c041-c3fe-4f03-b8ba-ff65549af33a", "value": "e1c30ba3e6d9e7de39a4b51091437486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d63c0c-f2d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627829065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829065, "uuid": "8d285880-2bc0-4303-a77b-e208b4d3ee6f", "comment": "Malware payload (Mirai)", "value": "e69a1d664ee178157bdad326f8cdf89e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829065, "uuid": "15b7cd7a-f6f1-4838-969c-09c2362a3860", "comment": "Malware payload (Mirai)", "value": "92bd6f4616c72815e4593e9883539e2904622cf277341e5f706b46ccc26921eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829065, "uuid": "b88beebc-3171-40be-93a1-c20e720092f4", "comment": "Malware payload (Mirai)", "value": "5957f96da185802b6c1ba4e17bbcd64c71987922", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829065, "uuid": "4a1ce323-03bf-431b-92f9-5ae7de020e70", "comment": "Malware payload (Mirai)", "value": "debbaa116aa93bdee15ae1ebae787f60f6fa5e6e5b18e0facd4187d63905bd5775b4baf75f6f6147132434bf560a6dd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829065, "uuid": "0f7b19c0-206b-47f9-b0ae-78cdd4f02b10", "value": "T19F530A817C90AA29C7D0177BEAAF108E3354ABD9D0DB7347CC044B917ACA90B0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829065, "uuid": "50bebe30-3443-4357-9898-d1d4dfd9c6c8", "value": "1536:dOxGfyRWiPLacGXWzM9l6yTzpl84ETjpk19y20Yvck6YceZWGzDYMH:dOxkyRWiPkjX0QckVcwLVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627829065, "uuid": "6367ab44-0ea0-4e87-a418-5b023c98c5e4", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627829065, "uuid": "e1b11894-f541-4930-83b4-a6adee92f0a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829065, "uuid": "1f3bc5cc-19f0-4892-bc23-efef8e8eb608", "value": "e69a1d664ee178157bdad326f8cdf89e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9ccf7a-f2e3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1627834256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627834256, "uuid": "cf360970-d568-4cec-b236-822633593ba4", "comment": "Malware payload (AgentTesla)", "value": "f906b753d9b24e1a81a6188c9f48bc86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627834256, "uuid": "527270ae-5153-44ff-8aec-084b4d290565", "comment": "Malware payload (AgentTesla)", "value": "94d008685ba759f32d3b80b5542394c9bd4a4f2ca42781cb67f31a7460244bcc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627834256, "uuid": "ea934214-5c65-4360-809a-7d40519f8448", "comment": "Malware payload (AgentTesla)", "value": "663b677dfa84badfaa88df262763a214cc58be8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627834256, "uuid": "c1d9816a-34a8-448e-a045-8d6b50486e5d", "comment": "Malware payload (AgentTesla)", "value": "85d05758965c1d38be537526c4ae62e5fde440ce1f8d8abf74decb032e8baee53ce5e86511675651010a5a344e36d4cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627834256, "uuid": "d9f97c6c-b0d6-4356-b365-850e694f4390", "value": "T1BDF3C5583AB5090DE5FF5E348DA039264D7C9063E50BB75BE4A38196CB126C1CD8F8BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627834256, "uuid": "7c52cd65-7862-4216-94e1-c6433154132e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627834256, "uuid": "cd032d75-c459-4d54-bc7d-650e9a97012b", "value": "3072:tTDJpklQdiz2Y+pQD7k5XljclpHyP6UvSNSi57GLwt7TxLgQGLuz3QoelX2nfvAl:tYGvD6UuaaTeQGaGlWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627834256, "uuid": "56d4f0fd-8959-4044-a84e-2b660b2395fe", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627834256, "uuid": "b411a78f-0133-4476-acf2-686be7110dc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627834256, "uuid": "76aa5796-756e-412b-9469-c56b77b040e7", "value": "94D008685BA759F32D3B80B5542394C9BD4A4F2CA4278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc08c09-f313-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1627855167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855167, "uuid": "d5512623-14f8-4207-b147-7a0d3c202e2e", "comment": "Malware payload (DanaBot)", "value": "9129525b5a79a06dad5e9c6acfb72b8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855167, "uuid": "2d622bdb-4aeb-47c0-bcf0-ed0dda608711", "comment": "Malware payload (DanaBot)", "value": "967e08d85b9639892fd4bf4ab2d3e6fc7dcd4afe22326e4114df182c8b0a9b5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855167, "uuid": "3908029b-349f-40b8-a8a4-4303f1dc3c11", "comment": "Malware payload (DanaBot)", "value": "1c69b60f725609b55c4e8b60b1c4cc2afb05fa97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855167, "uuid": "ec94c3e6-5045-467c-84c2-d43cea5f5f49", "comment": "Malware payload (DanaBot)", "value": "3048650aff2dbb564d365c2043961c1e384a4a0c1cf2729e018581179a93679c531b831ddd628f1a44756b05ce9148da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855167, "uuid": "ffe22317-1d97-4528-af68-8f52a528c9ad", "value": "T106452220FE04C472C495023084A9C3B67339BC351559864BA7A4A27E7EF37E4B6B7E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855167, "uuid": "ca96b691-17a8-403e-b5a1-c8054004dd7e", "value": "3cdea9fa065b5ffb20003adb7f4144ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855167, "uuid": "fbf45138-afa9-48ed-a7ba-e5210b330306", "value": "24576:O49I0d14BsA6i8vzE/WaWSlOXeLuvNH7mE+FMgbZ//u+lD8f2bQR1N:OsAsDiCg+WOXpHKFMgbZXukD8fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627855167, "uuid": "0849db33-013c-4a5b-b8ea-29c1ffc334e1", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627855167, "uuid": "2a7b4ef3-ea52-4859-a26d-314eac2ba38d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855167, "uuid": "c9b8f3c4-1895-4ad1-859d-6f9b536fd683", "value": "9129525b5a79a06dad5e9c6acfb72b8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373c7ac8-f2a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1627809415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809415, "uuid": "ed519504-b5a9-4c4a-ad08-16961238339d", "comment": "Malware payload (CryptBot)", "value": "ae93ddcd6eddadb4b5d7b2dfcf0193be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809415, "uuid": "c32c9b0d-7808-444d-8e73-b29cca9729c1", "comment": "Malware payload (CryptBot)", "value": "991b82b18100c2c4a0cd920971a40e2410d15cda4fa6f11ea64190eb8a9b363f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809415, "uuid": "9642ace8-71ba-4c57-877b-3c46e3e8e054", "comment": "Malware payload (CryptBot)", "value": "512ec9b4d224373369358c0cd4b62c6a7ed57d69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809415, "uuid": "6137c111-d55b-4fcf-9736-bbf70b78f4ca", "comment": "Malware payload (CryptBot)", "value": "2520ebb39e1fbdfc5ee22e8d48fcebe98f9582eb6c292851765ca19ec41c2d4a8a2aaabd9baa6959f8938d2067716a29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809415, "uuid": "7efd4c3f-4cf8-417a-a3bd-6b1bae617fbe", "value": "T178D412403280C131C3950930A4A5C7656B7EECB269758A473768177F6EF32B0A67BE6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809415, "uuid": "6627083d-a9b9-4518-8d88-f43e0dee0c88", "value": "c8b9c145ec19b60e1b1e5259a226415a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809415, "uuid": "ec894ac8-6544-441a-a7fb-46799f591053", "value": "6144:isdrUY8FW1tLwh50JYtgqbo2Z/WwN58IEuR8sqBt+R+JvYsfr3bdakaE7kEYIM:isS/MTLwh5jgqbomP1BbmYsfr3bd7oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627809415, "uuid": "87e48689-f2b1-443d-ad33-af70cd88dd85", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627809415, "uuid": "8366e2f4-7196-4a36-916d-5102aa96c1d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809415, "uuid": "2d5528e4-6c55-44ca-a008-8c64b7783072", "value": "ae93ddcd6eddadb4b5d7b2dfcf0193be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e640feb4-f293-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1627800260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800260, "uuid": "7cb5edec-fd0e-4cd7-a1d9-66627462b824", "comment": "Malware payload (Dridex)", "value": "870d4a5e6be7fd07f7f651544d2d8bc1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800260, "uuid": "3c2ab5db-1e94-4eca-a472-5258a1a75fb2", "comment": "Malware payload (Dridex)", "value": "9a49377425cd34e622494bf90d1726520d879b2f7de449a65b88fa4f75965bdc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800260, "uuid": "6eabe39f-5a32-4e32-b725-94d5a9a37f7c", "comment": "Malware payload (Dridex)", "value": "5be0b0d3e987743d5ad9110ccb37d2d64be04ddd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627800260, "uuid": "a32e5fc6-36e0-47ea-9fbe-c6dcd92727ab", "comment": "Malware payload (Dridex)", "value": "d245debafe578976bd2e30845f49463403ca86b85cbb1dfd6192f1eb273599759c536138ff8819ace2bad76bdf5f5fa2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800260, "uuid": "9883893a-99b5-479a-b3e3-cbc50c9934a0", "value": "T1BD35F0C63668EA62D71BF170CC299B22C366BC0E57B4603777863BDA36F279109113D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800260, "uuid": "41319a34-5723-462e-aa6e-f1db5de6aca8", "value": "9e8f80efadaf14eb472507064b44e82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800260, "uuid": "144d13a3-a5bd-403d-8ddf-7b05c5819f3c", "value": "6144:FK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTlHZOUlcRvfc:FM+ZdkmHubeaCo6IHZbOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627800260, "uuid": "a6ef9543-d81b-4837-b316-b281b1da05be", "value": 1131008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627800260, "uuid": "5bcdf30c-4f6e-4209-afc8-7f2158557660", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627800260, "uuid": "0fb5636b-7112-4fa1-9c0b-a2ab87e26bcf", "value": "870d4a5e6be7fd07f7f651544d2d8bc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffb34a3-f296-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1627801269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801269, "uuid": "07507c25-6550-47d2-b751-0a118a04e629", "comment": "Malware payload (DCRat)", "value": "fe23dc62734828f2dfb01dac7a854dbb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801269, "uuid": "5d2b579a-bb3f-4d49-90ff-bc833e042c59", "comment": "Malware payload (DCRat)", "value": "9cc0cf19e63fbf43ed381c94967a1c52a606452657cc05c17b27a1a07e2c5607", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801269, "uuid": "86fa6216-d4e6-4801-94e6-039a962432c6", "comment": "Malware payload (DCRat)", "value": "e865abfec4ba14dab7561eba2f34e3bbb109b153", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801269, "uuid": "89ceed94-ef84-4e16-b02c-54a5a0ce289d", "comment": "Malware payload (DCRat)", "value": "2d613c75df329d6678409cbe63a52cef7f03084afa5084072741466855aa2514f371946f462503ae400549d10edc09dd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801269, "uuid": "a6f78c7f-9170-4aab-bdf6-fc13eabe76cd", "value": "T152A4F166B1E01198DBB182F6C8921706E7B074711729A3CB1B7867B72B1B4D68F3D3E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801269, "uuid": "e7966d97-8ef3-44cc-9159-7bb948e10536", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801269, "uuid": "b3b8644e-30fb-4a13-b0aa-695b4e9bad42", "value": "12288:QbjDhu9TfkDOhR4uS10bI80xy410YG62Ct6Fvt8jhzP7Nl:e1eTfkDOjNSWbGbG62CQFF8NLRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801269, "uuid": "40a218ed-798e-43d8-83a8-0cac62b6661a", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801269, "uuid": "fe6273ba-dad6-4b3b-bbe6-04233f82c5c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801269, "uuid": "8411d71c-9c60-4a42-9daa-821abc5a961a", "value": "fe23dc62734828f2dfb01dac7a854dbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d0b203-f2d5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627828555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828555, "uuid": "0fa53408-f0fd-403f-a1ee-4f51f65ac693", "comment": "Malware payload (Mirai)", "value": "9b5e4b68e29fbd7315f103f14ebc31bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828555, "uuid": "df87c737-31ef-4f5c-9091-9b41ec60831a", "comment": "Malware payload (Mirai)", "value": "a05113311e6f634baf2895cdda690bc98e1c419825bc20130a6a147966cfd19b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828555, "uuid": "464f8caa-05b2-4da1-9bbf-1e5db567ec82", "comment": "Malware payload (Mirai)", "value": "9a2d6e4a882b14a8c000330419baeb847a6eaf21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828555, "uuid": "80edc8a7-5f27-497d-813e-5dcd63eaa6f3", "comment": "Malware payload (Mirai)", "value": "bc5a64a48d4bfc35698ce7c75054c03638a738d7d6e8d2877537d0453370c8996df58693909a47244612bd439ca29541", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828555, "uuid": "eb70212c-7774-4e4f-814d-1048e38420d3", "value": "T129E34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828555, "uuid": "3d1a8267-e304-472f-98d8-35c2a23820f1", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1Qr:walgM69pe0QmlTvI8t9mrsplDKZUQQBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627828555, "uuid": "02794288-e615-4d20-b690-54128d401a4f", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627828555, "uuid": "768fb5a5-8786-4265-8de6-a9a141ec81b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828555, "uuid": "2ad444e5-796d-46e1-9c75-30fa2e42a692", "value": "9b5e4b68e29fbd7315f103f14ebc31bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9faf09-f2f5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627842257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842257, "uuid": "45e5d191-acfe-428d-a462-85d19102f33b", "comment": "Malware payload (RedLineStealer)", "value": "48efeb5867e36b7f4c58e587f51b0678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842257, "uuid": "fc27ed84-5d42-40c0-beab-df0d8bf6dcd5", "comment": "Malware payload (RedLineStealer)", "value": "a09cd8a5d439735f199cfc6b9eec7d1a9b212d5f0b131e6ff1ffa7a07c8f7419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842257, "uuid": "1bab538c-80f6-4642-864b-76f8139b00dd", "comment": "Malware payload (RedLineStealer)", "value": "505021a3c3e08f4d7ab9d5f62b0bfcbf5b8737bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627842257, "uuid": "5b895c77-0031-496e-acc9-461e0c806a47", "comment": "Malware payload (RedLineStealer)", "value": "2d49878647cf2c705bd366b2d3bed18e06df6d38899f75f90b0e9c5134089a1ef45aa68b7008e91be4da055b729edc47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842257, "uuid": "37f7a971-770e-4f30-b94d-4878e4f61151", "value": "T1790633230AB96ECEF4C69EBC484DB419FD9541588788A374F473047D6C80B2AF89DB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842257, "uuid": "f4112f1c-8a88-419c-be02-7ba512579e7b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842257, "uuid": "4b74c81e-8abb-4ffb-a333-45fe51fc4376", "value": "98304:KN2FDmvBjYeRHH6O1cQ7Kkb1zy8Nn82z7Q7oOEGscn:KcUv1AOj5b1zyiNQ4Xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627842257, "uuid": "ee2240c0-fa68-420d-9ce4-66a510b1fdca", "value": 4007160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627842257, "uuid": "ee99bc70-7709-403d-b153-4c12a01afdfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627842257, "uuid": "d55a6670-454f-4477-b300-f7dd46f5fc4a", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf399c8-f2dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627831408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831408, "uuid": "fdc5124e-c8dc-46f9-9fc2-69672f3d6c48", "comment": "Malware payload (Gafgyt)", "value": "8d95c95c409c40cd9aab4c4a6e701be8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831408, "uuid": "f2296c3d-3f48-4b38-b97f-d53c2d049e5e", "comment": "Malware payload (Gafgyt)", "value": "a2b8fabb676af200e8e95e52fa75a79eeee1767599129061335972ded45a22d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831408, "uuid": "db2e6af4-4a37-4acc-95c2-ea68811e7b79", "comment": "Malware payload (Gafgyt)", "value": "d71a7f8277c946fe942f3c28c1feb55010295fd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831408, "uuid": "53e74ffc-0629-45e4-9fd5-77d63590727c", "comment": "Malware payload (Gafgyt)", "value": "cfeeb6dcb4f0a05ee995680e39beccc17e0d05961566984f3e3aec21a55b25a6c99494708e6024f3e129affff47213f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831408, "uuid": "a8ee44e3-0735-4457-8704-b48f53c89dc6", "value": "T1D2B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831408, "uuid": "174a9dc1-b957-4648-a569-b4ddebb2c2d5", "value": "3072:b6an17WtsWhdgYJB0D6mbPbmTQOWsXAOn:Wan17WPJB0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627831408, "uuid": "15b46c96-356f-437d-82bf-a48cea72cf2a", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627831408, "uuid": "9c5e3cd7-844b-4d9b-b64a-c6a941e49239", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831408, "uuid": "7418e57e-13ad-4b6c-aba6-22c232c9f7f8", "value": "8d95c95c409c40cd9aab4c4a6e701be8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256fa979-f28d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TeamBot)", "timestamp": 1627797359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627797359, "uuid": "270175d0-4dc4-4751-b4f4-207e424ccd9a", "comment": "Malware payload (TeamBot)", "value": "e950889fc7f88cbc4408d934e2e220f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627797359, "uuid": "a27bfc1c-4236-40d7-bba8-5d1b0d433c38", "comment": "Malware payload (TeamBot)", "value": "a4520e17b63c5503219d9c36435b26054ac63e4539883c5244b3129535d82879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627797359, "uuid": "8ea735ea-1b62-4a36-a3c4-45e4be2ff3bb", "comment": "Malware payload (TeamBot)", "value": "cefca2c4538365655cb1eead3f3390313b9ea18a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627797359, "uuid": "cce321ba-1935-40e4-88ba-40d27b592e64", "comment": "Malware payload (TeamBot)", "value": "beb949ad445e820b2218be4c581a348a0b4a4adc6edc9861d3589c96c983f1b3a2cbfa01deb16373398ba7a16165e5ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627797359, "uuid": "f88b6215-cbf0-47a4-990b-d564f1b60bb0", "value": "T16C0512607581C476C7500A3084A597B0672ABCF1893409073F683BFEAEF73F196A9E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627797359, "uuid": "8cce1e3a-6e40-4878-85f6-fba00b73721c", "value": "c8b9c145ec19b60e1b1e5259a226415a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627797359, "uuid": "642532a0-c664-4824-aa57-32ea2516136a", "value": "12288:LVHqYgXjvWYZeTPFWz5RNUDIFUEW00h/HsS54HWuE:LVKvXj7ZeTd8/0IyT00/54HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627797359, "uuid": "58773a9d-0733-4bb2-b3bd-383b25f71475", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627797359, "uuid": "49d09501-a3d5-4844-b8e8-c32e8e4ccec7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627797359, "uuid": "1ad878a6-d6e6-44bb-b7c6-367549f302b2", "value": "e950889fc7f88cbc4408d934e2e220f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0a7a9d-f2a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627809421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809421, "uuid": "a2588156-e07a-4da3-b678-974605e3bc0d", "comment": "Malware payload (Gafgyt)", "value": "38d30ae124859d567c59118105709c77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809421, "uuid": "873b3338-9d9d-4b1b-9921-a371eb70cd48", "comment": "Malware payload (Gafgyt)", "value": "a590903007289e0a2c36be567fe01b7e2fa6477cf8b449f1f74640f59750cb0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809421, "uuid": "9b928c10-de62-48db-a3f1-d00130b8f853", "comment": "Malware payload (Gafgyt)", "value": "87b3ffcd72a9cb8b19cbd44128b740573da144ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809421, "uuid": "43a5424c-d5c7-4e0d-925c-ab4726b1e198", "comment": "Malware payload (Gafgyt)", "value": "8f16059e26a12f9d4c7d46cfbd7734963577f4eee4e71daf18c5433323e3547aaba15221af3ce799a0b7c692de2fb722", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809421, "uuid": "8e9d24d4-79df-4d1c-96cd-a4b3f19042bc", "value": "T1BA934B0799A59FB7C0C7EAB919FB59300316A8520B2F1A59613C6BF4438F9CC740FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809421, "uuid": "aac3dce7-0b33-4b35-b657-4ae27a3e4509", "value": "1536:zU7Ox4Io9+wLAi5K5msuxHh4U6vpVymCt6dadmW49VquLeefkcX:QZIoxLAiA52Hh4jym69m79VquqefkcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627809421, "uuid": "625f1517-7749-45af-9ead-d3c8136b5868", "value": 94352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627809421, "uuid": "2de8f1d4-3f2b-4644-9464-506f8390e13e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809421, "uuid": "5b1d5121-b905-46bf-a4c1-67c48aeefc4c", "value": "38d30ae124859d567c59118105709c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7e34d6-f2a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627808055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808055, "uuid": "de99f6c4-0397-4e7b-8fc5-f1983c324a0c", "comment": "Malware payload (Gafgyt)", "value": "86ab7daf79eb41da78508ed29e3407a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808055, "uuid": "8afde866-a2a9-4597-a31d-a552113536e5", "comment": "Malware payload (Gafgyt)", "value": "a6aef7ec1cd0cb7036969b611837fa5da7780341653da5e6fe52aa13c46aaad2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808055, "uuid": "318138c7-03cd-4e87-a8f6-4d9f91137881", "comment": "Malware payload (Gafgyt)", "value": "3dbd84747a5a1b8922556c46329ff05915943562", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808055, "uuid": "47b51a30-8930-4894-8695-93726f30b8b5", "comment": "Malware payload (Gafgyt)", "value": "50572aaf73b3976d75e1db737fa6ca9c60354cd1c42d197ed5457c0391fc8a4bb90220125fee779d3d972c72c406d004", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808055, "uuid": "706383eb-33cc-4566-b7ee-6c6b85195756", "value": "T154930797F801EF76F40ED77604D34B247630FBA24E532622B21739A6AE762D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808055, "uuid": "dc98346a-baeb-4e41-a386-4de87b4b4314", "value": "1536:tQehpGN+78pT/gGIXOQm7QbGt/p93bfhPym/gk13ZqfvqTmQ9VqXjewf2Le:ye7m+KT9I+T3nbfhPym/NmumQ9VqXywp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808055, "uuid": "7c5988e6-41b9-4136-8204-b97ec6f397b7", "value": 91967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808055, "uuid": "f5c533ad-7bf9-41f5-b69d-7fd39cf77e6e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808055, "uuid": "2af9551c-a451-42eb-b9ef-8f92903cbc0d", "value": "86ab7daf79eb41da78508ed29e3407a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe4da03-f2db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627831146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831146, "uuid": "4403a0ec-11b5-4fea-89c4-34c6182c8757", "comment": "Malware payload (Gafgyt)", "value": "4062739f7cf191d3f8c9347290db156e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831146, "uuid": "ea629b41-1e6d-45ce-9d8a-e520f9f98342", "comment": "Malware payload (Gafgyt)", "value": "a831046aa254d79b5380abed113a10163d19f994187a9158a68d3e3a692aa1ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831146, "uuid": "afc1bfd0-fe54-4e8d-be54-4e9d8f353cbd", "comment": "Malware payload (Gafgyt)", "value": "d0e929aa67789358c5cb435b72a7a888b2ba67bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831146, "uuid": "70e1de7f-4ef1-4f76-bef5-868915679185", "comment": "Malware payload (Gafgyt)", "value": "5330d7782897bc608099afd460b8cf53bb4e70b7d25ca910f75a0f8c486b4c2546b2e0e2e9cc26f3ef95cdd6796da657", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831146, "uuid": "36f8c70e-829c-431c-a56c-71c38d73c85c", "value": "T15AB3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831146, "uuid": "7549aa28-d45d-4cbb-ac15-60f442baa145", "value": "3072:R/4tNF9U4vvvKw6J73x8UmkiSFxfKxbXe:BUNFK+v8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627831146, "uuid": "2cbf2340-e707-40de-918e-98567d38f870", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627831146, "uuid": "b1e70286-f0fc-4357-a58a-b3fdfa2cbaf2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831146, "uuid": "d0db2e27-6f6d-4bef-9d55-9a4ad95590ea", "value": "4062739f7cf191d3f8c9347290db156e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00db0819-f296-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1627801163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801163, "uuid": "db812568-2fc6-46e3-98b8-095f317613c3", "comment": "Malware payload (DanaBot)", "value": "2b2019bf18467e9150aeda07acbdd1e8", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801163, "uuid": "04e4e11e-c90a-4c71-b22e-176eac596053", "comment": "Malware payload (DanaBot)", "value": "aaaab76abff4dc4dec34b967a7f3f03cf937d1d47f806bf193f9cb80d35e77e6", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801163, "uuid": "e1832b4a-09bc-42e7-867c-92f834c2a8f9", "comment": "Malware payload (DanaBot)", "value": "e080b0487cc3d78913f5ca78283cdfbd77b29782", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801163, "uuid": "e0db0a16-d987-4d6b-982c-3d8068be70b1", "comment": "Malware payload (DanaBot)", "value": "6bfa4c185f67d381fd247a08dad805fe406a7eb6a41a98058034432c540f9a3bc261292555a994e82e2e6770bc20d0b8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801163, "uuid": "8e789966-3c8d-4484-93d8-6a86724a49d1", "value": "T15C45123067E1C079E1FB22F845B9D3B8652D3EA16724A4CBD2E156FE16245E9DC3038B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801163, "uuid": "7397c82a-07b7-4956-a5f5-49371ecf21c4", "value": "3a882b0a906e4a3ae01bd3c1a3fc4b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801163, "uuid": "f1895110-517c-4347-88f3-be4aee92c71c", "value": "24576:VJw2kSyqsNiGVnH0QQpzwUFyJoD2fxb3WD2jc:QS5sIGJ0QPnfxbG4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801163, "uuid": "d49fe569-07bf-4c56-8e4f-a0f36afb7fef", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801163, "uuid": "21a6517d-d927-4bee-bb02-b7313ab24f33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801163, "uuid": "7d921983-dde3-4bfc-bdf4-7a29658419a4", "value": "2b2019bf18467e9150aeda07acbdd1e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f285a1d-f2dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627831896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831896, "uuid": "0fa504cc-1a2c-4b33-91ed-c7e7cbb811c4", "comment": "Malware payload (Gafgyt)", "value": "ba39f30768e005f4fd0ea5b4747c3693", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831896, "uuid": "c7526327-6743-467a-90ff-fd4db0b09ae4", "comment": "Malware payload (Gafgyt)", "value": "aabdd87fb86ce3d0b6570924d16b24a1b75290224b97fd61509c18eb39628640", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831896, "uuid": "4aa1fffc-8763-4716-a096-30525380e819", "comment": "Malware payload (Gafgyt)", "value": "5af0f65293ead8cc136ce790e5498aef943ccec5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831896, "uuid": "2b1146f0-6466-405e-9552-e62fb0213d7c", "comment": "Malware payload (Gafgyt)", "value": "e8d174c1c4db1e588c195387ea0909c60b3d4cfa5cfc96c64100a7ef5e34a1dfd8059afa92686ac89323ca0c483ba370", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831896, "uuid": "1989bbb6-166b-4823-b5b2-89040cc3d2da", "value": "T13D831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831896, "uuid": "5c0f37db-0385-4379-bda1-cda556f4c276", "value": "1536:BQOc40ozMPjej5qckA39ikRFabnrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BqrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627831896, "uuid": "754369b7-57a9-4104-917e-4a7d10345b8c", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627831896, "uuid": "df961e02-9f3d-411a-ab2a-05b5c7326aff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831896, "uuid": "7128ff18-6276-4c88-871b-71aca29a1920", "value": "ba39f30768e005f4fd0ea5b4747c3693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b544719a-f274-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627786863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627786863, "uuid": "294b5319-2132-4f8c-b0a0-b7df72897152", "comment": "Malware payload (Mirai)", "value": "36f9bbb3db1a8f5b13d4f991f1ae68db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627786863, "uuid": "70186969-32d0-4f06-b2c3-2ce1b4b54ecd", "comment": "Malware payload (Mirai)", "value": "ab8ff6f80a9e0c0d1bee1c9287d80bec4a22f9b3726ba46f342c43f2ba4b713b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627786863, "uuid": "742f9e11-8872-47c2-9e5b-50cad99eff16", "comment": "Malware payload (Mirai)", "value": "ca44e2c22e3a89e3b72c9146d4ce3f9189ec3f32", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627786863, "uuid": "78734ded-14a6-408c-abab-802be67ad4a7", "comment": "Malware payload (Mirai)", "value": "29f01ed109f0b938ae41a167a64f9332331ddcf1d685e190025283ceea4f6af085f907092f010bd02d4e362f90d94808", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627786863, "uuid": "93c6454f-0548-4b1f-9e3f-d67971288bd9", "value": "T13A64D08AED41AF25E9D526BAFF1F024973734BACE3EA7110D620972037DA65B4F36044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627786863, "uuid": "ade4b1ed-1f8e-4974-93d4-cfa464fb7133", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncAabE5wKSDP99zBa77oNsKqqfPqOJ:78QpZsKCaiAabEDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627786863, "uuid": "36d933f4-17f9-440c-aa32-5ba053931c66", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627786863, "uuid": "f3708697-267c-4616-9506-edeb0d7bd337", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627786863, "uuid": "a3ea6249-340d-4317-a87c-624569543914", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba7fb0c-f2e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627835568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835568, "uuid": "c73a08d4-e952-43b4-95d3-5badc1b48362", "comment": "Malware payload", "value": "25741ac45ffe74f8c4817b28500fa48d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835568, "uuid": "7a234760-76a3-4b92-a260-bf03b8d2beae", "comment": "Malware payload", "value": "acaed16a37962b29231a2b0842b616000656a12ff66ce41830ca855a207fc5dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835568, "uuid": "49336d59-b869-4cba-affd-52514c6ad100", "comment": "Malware payload", "value": "cf6ff0ee7850f490c00c617d8c169c9c754b315a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835568, "uuid": "dc67b0e5-7de2-4af7-a2d1-c31528f45f5a", "comment": "Malware payload", "value": "53d786204694f7728e9c796c5f1b17c2756e7521a07e68fdfbbfa6f55c48da9b2c51b2bb6984d1ef81a11396dea23a94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835568, "uuid": "85d79d24-a14f-45b3-b985-141cfd366f61", "value": "T11653070DE69EF0E3FB517530260E6A328EBDB82C853C951F2E56694D1CF5780A4AD332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835568, "uuid": "5d41b9df-c9cd-422c-a474-8c69851d9e46", "value": "d9c7208ff3022bb34870c7ddeb406eb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835568, "uuid": "af82b626-803a-4185-a0f0-bd3fe674fce7", "value": "768:jbz3IhpglwpDEq2m0j6Tf8V4Ie7ZZa3R1fb961vNPrl7EJnCJ0uWN:n4+wpDElm2IAUZZo1fbs1RVEZCJ09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627835568, "uuid": "b8193312-66ee-47fd-9d1b-a56dc0e9ae11", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627835568, "uuid": "09c2f7c4-2c1d-4c2f-b357-aa325df53445", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835568, "uuid": "5965fb43-68a0-4576-ac3a-3a021e30bf2c", "value": "25741ac45ffe74f8c4817b28500fa48d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4316751-f292-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1627799746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627799746, "uuid": "c0efe814-7775-4529-9cb4-2ace6860db78", "comment": "Malware payload (Stop)", "value": "3828de95c4e8146d8e220230690b3be9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627799746, "uuid": "675a5b41-4018-4e85-bc2d-037d654ef965", "comment": "Malware payload (Stop)", "value": "adc2c80f4a9f969a641f2674c94bd576420b34d338b12ba5b4cab09e6c51a466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627799746, "uuid": "84925dee-16aa-4323-a764-c256ed5eb256", "comment": "Malware payload (Stop)", "value": "cb7e1c1b3fbd9bff93c81efef319254d32636b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627799746, "uuid": "14636ff6-71c4-47d9-9498-247d4bdf8c7c", "comment": "Malware payload (Stop)", "value": "92915185af9a8cccc4d33a940ebc7a5ab274710511edbecef22da71e280b186185bd74d56393b054b61c5d0c0d5bf376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627799746, "uuid": "45e36f0c-dc63-40eb-8e7a-2f740b559349", "value": "T1830512217340D577C39A09B48061C364736A6CF299754A473A9873AC2EF33F15BB2E9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627799746, "uuid": "f94f00de-a4b7-43a9-b635-08b9fb1dc040", "value": "c8b9c145ec19b60e1b1e5259a226415a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627799746, "uuid": "4128f8c9-06df-4df7-a6e6-3eae4c63597d", "value": "24576:1B6ks2FGVfiFOvt+bO2VMasx137Y6QTyc:n6Lrpt+blVsz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627799746, "uuid": "0ffc1819-4fd9-426e-b4b0-7a790534f265", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627799746, "uuid": "260db4e1-e732-4414-b21c-387d3038018e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627799746, "uuid": "8aa1accb-348d-4e5f-87ae-1054ec62b39a", "value": "3828de95c4e8146d8e220230690b3be9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce72ea93-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627808810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808810, "uuid": "a3c70d1c-7a3a-4f7c-af8f-cf7e5af5ae66", "comment": "Malware payload (Mirai)", "value": "9f95c6d5a991dff6fbb77f2d389238f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808810, "uuid": "836b1243-fb1f-42ce-9fd4-11215f3ccc96", "comment": "Malware payload (Mirai)", "value": "afc11a2607eef420a04c0a155c5b5a6bc056726e7415f507ee10016234a3c3a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808810, "uuid": "d798fdc1-cd7b-4759-bc1d-b7f5daa9e982", "comment": "Malware payload (Mirai)", "value": "b971a8084cb5dc4f8bd835fe41aeb8b04035ad26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808810, "uuid": "b7f81b43-8775-48ae-8eb5-38a8c3f67517", "comment": "Malware payload (Mirai)", "value": "6ec6e9417b74c1a665fb00dd1c615d3ecfb8c6121507bbd81909db6d303f483e18b10edff0c22253d924f001f9972aaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808810, "uuid": "cbb065ae-e733-4d14-bb6f-c3b5b16adc33", "value": "T1B6F3A53E7A21AF7EE168827107F39F70CF9529D326A19341E26CF6185E7128D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808810, "uuid": "e396ab06-818d-48f7-9d80-571507ca0e41", "value": "3072:B7esBFP23rWfOB7ZOOyG6WKmrThPaLEne7rNb:1euCloG6rmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808810, "uuid": "79a809f1-8ff3-4a48-8cab-5f61ba965b68", "value": 159493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808810, "uuid": "feda6451-903a-46f8-9b34-2f210ee733a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808810, "uuid": "fc5aa057-4390-4f2a-81c7-b23632201a9f", "value": "9f95c6d5a991dff6fbb77f2d389238f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983bc0cf-f312-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627854675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854675, "uuid": "19c5b552-f6b0-43f4-82ae-d3994fc116ae", "comment": "Malware payload (Mirai)", "value": "c519dd235e502439bcea7f69a8afcf75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854675, "uuid": "53348f3e-d359-47da-ab5b-4f0c6ca41eb7", "comment": "Malware payload (Mirai)", "value": "b1ae3b7ff52115dc2208aa97c31e84cf96f73252fbc2a0e35508af041d96e4e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854675, "uuid": "1a93bfc1-9b22-4615-9cf1-71da66074822", "comment": "Malware payload (Mirai)", "value": "20bbdd69bff4ef122773393b3b4270c4bb959073", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854675, "uuid": "700c9440-933d-429f-8734-0e896a84cb06", "comment": "Malware payload (Mirai)", "value": "ddd925b2d176cd50655451733ac0c6d6a34fe7bde7bbbc699f98d2f0aa66ce1dccff6a3ea980bf6afb5dfd8af8c6d2e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854675, "uuid": "81af8320-003d-4750-96b7-972c7557ae40", "value": "T19CA2D1A9A9635C76EEB6B0377B6ECC8792805CA1537C1395F56EC09232EE20F0421DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854675, "uuid": "794ccb79-c008-4cf5-81fd-4ae1d4860479", "value": "384:MiX206yHsN1bGmfVtcekttoUz6iISkwyHYdQ/ACPbyxK3Nycz:l2/Wmfk1toorpyHjDbyxJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854675, "uuid": "cc3a3278-e29c-4939-9af3-b9303e53999a", "value": 22000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854675, "uuid": "d26302c8-3ca7-48e1-955e-87b27337c15f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854675, "uuid": "aac38c15-a338-4520-9d74-5df199a6127c", "value": "c519dd235e502439bcea7f69a8afcf75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f965ee-f304-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1627848603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848603, "uuid": "708388e6-b47e-4c62-995e-ed55c71df6b7", "comment": "Malware payload (DanaBot)", "value": "2b16b974325b5aa01406993d40ac15a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848603, "uuid": "6758c1ca-be9d-42e3-bcd2-102f13149739", "comment": "Malware payload (DanaBot)", "value": "b201c8657c45c97a017d357f7542d2786fac1e9cde1a4ce8c5c2021f52e83540", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848603, "uuid": "e12b5b30-4330-4a38-ae4e-5c2e98bb8a48", "comment": "Malware payload (DanaBot)", "value": "34726a44b3369b3d741db82c9571d80a15176f54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627848603, "uuid": "32bb8974-a2d5-4834-8fc2-711229255f39", "comment": "Malware payload (DanaBot)", "value": "cf2da718197972a64e9ff22a348ed121907b48fec42fdd751f693fa7294a1cf0a17370a3a1fe0a388bf87c1207b3ff1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848603, "uuid": "d34efd23-9692-4960-820f-096a18a12763", "value": "T186452322FD40C4B2C09046306481D7A56FF9AC22A6B087476794667F5FF31D2A1AEE3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848603, "uuid": "50b9d9cb-bf78-4b65-81a3-8168e9e0ffa7", "value": "93a0ca4b4569eae2a4959be5cfc00df3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848603, "uuid": "b0cd9775-cc52-4663-baf3-dd9b727259a7", "value": "24576:8zSJofHpHEd3bpCUA5HmD//3h3rL3pUB2bLfsf5N:dWpHEdLpC15HQ/pbTaB2bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627848603, "uuid": "154f3591-46a8-4307-b826-dec5ea881757", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627848603, "uuid": "2bb40447-bc19-4a6e-9f50-0afeccc9a458", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627848603, "uuid": "a3eb9328-d790-4b38-a515-c8997140726d", "value": "2b16b974325b5aa01406993d40ac15a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3659b133-f2ad-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BlackNET)", "timestamp": 1627811132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627811132, "uuid": "c05007ed-e36b-48bf-ae76-f1453e61de04", "comment": "Malware payload (BlackNET)", "value": "b72d429d1d690165c7b0de4a074c4a58", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627811132, "uuid": "e1586a66-6853-41f9-8a17-07263e5e776a", "comment": "Malware payload (BlackNET)", "value": "b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627811132, "uuid": "94836f30-75dc-41c9-8f77-d005f8719ec1", "comment": "Malware payload (BlackNET)", "value": "f0704d227482a80f2f90dab79ed4acd9770fe565", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627811132, "uuid": "053b986b-5473-495c-9c85-db8f843a3334", "comment": "Malware payload (BlackNET)", "value": "5995d66bfb095c5cb0de28579676bce29861ba23dbf6d55f0189ee8b14e96d493a953b271c5abf680d10cba4a8a1370c", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627811132, "uuid": "2e060131-d66b-4626-aec2-1cbd8854847f", "value": "T13BC3F61377EC5C65E1BEDBB4AB725280C7B5BD164922CB6C0CC060AD5AB7742B901BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627811132, "uuid": "1684e667-1087-4d5a-9c86-2a4ae170c531", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627811132, "uuid": "536e448d-e34e-4097-9c72-1b95b608480d", "value": "3072:qwS9xonGdoFlC5w/oV9RRKyfKW63beFEKyBFfa1:5CeSKyRPfKWybi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627811132, "uuid": "7fac7c9b-586f-46da-a78b-024c0c92d9b7", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627811132, "uuid": "1a3efe41-6bcf-4df2-b570-e3c689688de5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627811132, "uuid": "4a30f7c4-00e4-476a-9a15-78fec7fbd0b8", "value": "B30EEBF734354F55373978E395C912393F3C674AAA471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2781c0df-f27f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1627791350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627791350, "uuid": "1aa2f67f-1d52-4546-b4bc-9f3187b788e5", "comment": "Malware payload (QuasarRAT)", "value": "a86d1b872c7339cc73f7a6c602b0166a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627791350, "uuid": "b600e500-81b5-4994-b7b4-54e5db67667f", "comment": "Malware payload (QuasarRAT)", "value": "b4401e082c3eb9275a7be41c333f1d7ee13894dff4f794dc3544f8397990e35e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627791350, "uuid": "726faba5-c3f3-44ea-8f5d-874ee87068ce", "comment": "Malware payload (QuasarRAT)", "value": "fd0f8618acbfff4ceb0743b468976879f24dec88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627791350, "uuid": "88500e77-3e8c-44b3-8c94-d35c211ecb30", "comment": "Malware payload (QuasarRAT)", "value": "327e5cfd64cf04cdfa85ba372f70fd64a6cb5ddbc05a693da89d776e93d9c1d2f7ca51076f8687c01e95ffdfa54007a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627791350, "uuid": "270b4f90-dc4f-4ad3-9626-d1e77d42ecf7", "value": "T17DF53311FDC4A9B2D8E14D7255A49E20597FBC201F288E9F63B88A3B96302D1B771727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627791350, "uuid": "3abec759-f2ff-43cd-9744-a18834447586", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627791350, "uuid": "84cfc7c8-86f1-4e19-811d-10dc6159882d", "value": "98304:UbRdNP1xkn59yXmCJG/P2T+xgHyB9bxipo:UrenrDCJgeOyE91wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627791350, "uuid": "1fdbab5c-44e5-4116-b50b-ebac3cd6876c", "value": 3537313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627791350, "uuid": "3b927cee-6598-4296-aa3b-72ee1fc9631e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627791350, "uuid": "561f7716-574c-4c6c-a69c-472a3a0afc63", "value": "a86d1b872c7339cc73f7a6c602b0166a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a167d10-f313-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627854920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854920, "uuid": "3be52e6c-f4bf-43b3-b75d-9863f800007d", "comment": "Malware payload (Mirai)", "value": "eb9e53dd333652e77a626bfcdee33407", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854920, "uuid": "261c9634-e9aa-4e16-bfab-e840f3f050a0", "comment": "Malware payload (Mirai)", "value": "b651364f19bef276c0f1460991304d75132cfa43852e403f1e273731809e25e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854920, "uuid": "b5618338-801e-4171-830c-c6a1ba2dfd81", "comment": "Malware payload (Mirai)", "value": "11685c7352aee38e3beb957b4e40ec80ebab13ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854920, "uuid": "3e65ec06-4509-4f13-bea0-6f495331ae82", "comment": "Malware payload (Mirai)", "value": "9483fb631b27cce35b089b543c333f6b5a04b59c9d2a3cbf4289464e5af4b0c726e12fde9209b5d9e966a15a577b8277", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854920, "uuid": "552704e1-8139-433f-877e-e9661cd7ce94", "value": "T178B2E13D454609FEFB52D5B463DA0B702DB49763E8428D4B9489CF475F8B2D8B8039AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854920, "uuid": "c7f528af-c319-4d1e-8403-2054d099e849", "value": "384:BRtPJjgJUbyselGZ81T98eL9kwIKUQTL3cF0t0gSix0pRzZTChSO5Ie/NJgGlzD8:dPaUJelGC1LK1FQMc0XV20OL/NJgGlz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854920, "uuid": "19104a26-7943-45d7-ba89-0423a165ef62", "value": 24060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854920, "uuid": "18cfaab0-cf40-4730-ab2f-b53cd90021c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854920, "uuid": "f4525646-1a98-4cb9-b3ae-dfaaf1e1cd2f", "value": "eb9e53dd333652e77a626bfcdee33407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5357e6-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627808729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808729, "uuid": "b588c573-8d89-4630-b68a-afa815230ff4", "comment": "Malware payload (Mirai)", "value": "e43fe491cef4d07c15dc0fa529141219", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808729, "uuid": "7419aa5f-3bfe-4fce-9c56-a86a68bd0162", "comment": "Malware payload (Mirai)", "value": "b760b3b6faf4f07c373a7144aa0ec977b8e4f9d36e5362f40d8acf045ca4eafc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808729, "uuid": "70f32561-54c6-48ee-9267-f124536901d0", "comment": "Malware payload (Mirai)", "value": "3438d8f1debca3265abcdea2bc40a38617de457d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808729, "uuid": "bb0f4b87-2ec4-4f32-a3b9-151d0982c894", "comment": "Malware payload (Mirai)", "value": "3f019390a09e8a07a58bc8a2e5d58079c848da1c0830f44e9e719a1d349a79c77898f30476ca07b632f0d28a9b46d888", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808729, "uuid": "f9136bef-35b8-4896-bbde-987a818bc316", "value": "T185D3F730E8044B1BC2D227F6A79E469E3F351EA7979733115A387DB02FF27992E25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808729, "uuid": "802728aa-f643-478b-961b-fcccf52071f2", "value": "3072:+DShVLkDZ6waCAdcl6bYJOmP46aQyfPluesNb:VhVeZ6zcl6boOmP46aQyfPluesNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808729, "uuid": "a6eb5f70-17c5-409c-89ae-327430f3d435", "value": 130115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808729, "uuid": "14f45a24-a578-4556-8f07-a651d03522f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808729, "uuid": "106500de-ff92-4903-92a0-e0c28468973b", "value": "e43fe491cef4d07c15dc0fa529141219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1963e61-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627808788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808788, "uuid": "b0cdba42-9614-4f1f-bd4e-53312c591a77", "comment": "Malware payload (Gafgyt)", "value": "29cbefe4f2034fdc07cedf9b3df1a74b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808788, "uuid": "30be8dc6-07e1-40cb-b618-f361f8ac3e84", "comment": "Malware payload (Gafgyt)", "value": "b9a436bb1bee8797aa625954c5ec669662c40329797088e8ad3adc2bfbad421e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808788, "uuid": "b81642fd-2fc8-443b-8d0b-4fe9e33e6ccc", "comment": "Malware payload (Gafgyt)", "value": "45f0973baf99bed31dbe1b04af7700b12f77434b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808788, "uuid": "a0c5365e-95a9-4deb-be31-376ee3d8f990", "comment": "Malware payload (Gafgyt)", "value": "91ea8fa153af3fa8abb378d665f6b8c9e8e17666493c5134805e8eae543d24ce6c1b8a16cdc4ee0afd366b5bd14fd6e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808788, "uuid": "53b19785-7e3b-4813-8e6d-d05e9be6e874", "value": "T18DD3C55AAB619EBBD81FCE33059A4601248DE64682D97FBFB2B0C51CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808788, "uuid": "180284da-a60d-41a5-892d-6f6e122b8374", "value": "1536:EybeTzNNT9DERkLMurNpZ3efJp68E1wYqNjd00PUmkVmSFxBC7vXZX:EyENNRLlrvJF1CjdlPUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808788, "uuid": "5be20cb0-a8d3-48ee-8968-af051cfe4ef1", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808788, "uuid": "4b19c880-edce-4a46-9388-c0008042c900", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808788, "uuid": "807ba318-7925-4128-9324-78d6b0dceefb", "value": "29cbefe4f2034fdc07cedf9b3df1a74b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2bc4f8-f2cb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1627824353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627824353, "uuid": "37d20423-55a7-403f-9b07-8c6dbe26de1b", "comment": "Malware payload (Loki)", "value": "df3384444e356116e0fc91ca2ec37a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627824353, "uuid": "8ab0874a-297f-4bf5-9f01-d058fc7dae49", "comment": "Malware payload (Loki)", "value": "ba58d39a6fe9e9d906d6a23e953a7f42980e573110c0277ef3a9ec73515bd268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627824353, "uuid": "727dba0e-3966-478c-95dc-f86690749113", "comment": "Malware payload (Loki)", "value": "545ee17bd40daf5b67463544dc8c77e375048d7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627824353, "uuid": "8ae470b8-0a48-4428-b6cb-bbba2e4e890d", "comment": "Malware payload (Loki)", "value": "d0bf9b99516e65cb8b023a194a17e4a50d631b369c7fc0398fda05f2103484e47012e342a1c38c71f367010ba20d6c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627824353, "uuid": "69f6ce90-84b8-4742-a128-81458620e649", "value": "T1F4A4E1E312919971FC221731BD3BC6D06986FD5D28504C0EB8E6BE54627AEC67CA0B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627824353, "uuid": "31c745e7-012b-4612-9580-6257da6f59f0", "value": "e13558d7c99b114fb84d41280eb6cc11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627824353, "uuid": "05e0c074-5030-4e76-8537-fdf60d6559d5", "value": "6144:t5Here0QlK0siozQsMlqfEDakMCpBOVaCaOI:t5HerLnHzvanBUaCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627824353, "uuid": "f25cfb81-ac79-447c-a0b5-e1e70968ef9f", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627824353, "uuid": "7906e653-2c2f-4242-a129-891b750ff287", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627824353, "uuid": "127b4fa3-ab10-434f-b73e-29c5ac809c4c", "value": "BA58D39A6FE9E9D906D6A23E953A7F42980E573110C02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdbe52b-f2ea-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627837340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627837340, "uuid": "e81e6c34-9f55-408c-8bcc-84bf14513cc4", "comment": "Malware payload (Mirai)", "value": "28b22e0f92b67134c131c5f3c6015502", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627837340, "uuid": "d5f87ffd-7fe7-4393-88c3-f0f7bd109a67", "comment": "Malware payload (Mirai)", "value": "ba6281005b883856342459fad721eb9775e07d1b0cbd94d1ab4a9ee920edec5b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627837340, "uuid": "41e7ccaf-1599-4efc-bb25-1f39155d138d", "comment": "Malware payload (Mirai)", "value": "dae6bb2fff56b6aa45a1471bdd1a50e3b03d847b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627837340, "uuid": "d091c1cf-5393-4ab4-8b9c-20a0531cb9ec", "comment": "Malware payload (Mirai)", "value": "2341bebbce7ec5be91d5347b89a0709b91e97b62d3960e056596e14277e37959a8fc1f7fc5c7b6937a0c674c4db5ed2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627837340, "uuid": "519ec504-8263-403d-b795-98f9fdbd51e8", "value": "T1DB64129BD9767C8FEE0B4FF021971E4A5AF9D1DAD3C618907364444435FE382A2607C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627837340, "uuid": "f7aebd4c-c9dc-4d1d-82af-60aa31e3a40e", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coa:7O/QJHZweEL/NOjCHm7FZZnc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627837340, "uuid": "5db516ed-5eb5-4d18-841c-6671a6363b45", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627837340, "uuid": "bb9ad3d9-a51f-4823-920a-0a5b6d536b38", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627837340, "uuid": "ea2d649c-5a97-453d-843d-55a1716545e1", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a753fe9-f319-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627857470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627857470, "uuid": "a3f34724-9ef0-4d0b-982a-628b25275fbe", "comment": "Malware payload (Mirai)", "value": "6326b06b6996e0ab6860f749cffdde78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627857470, "uuid": "d269c0c0-22f0-4f37-906b-46e75a5dea26", "comment": "Malware payload (Mirai)", "value": "ba7dd72ed04bfea4512bd3899c2af17553f4be9b977fd2532974169339e46bfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627857470, "uuid": "aa0642ba-e57a-4c39-8c63-3a58a4fe7cdd", "comment": "Malware payload (Mirai)", "value": "86b82089401fc0c49fdf49aa2fd08a20e26a1f2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627857470, "uuid": "bf55bcff-398d-4102-96ce-fbe74cccecb9", "comment": "Malware payload (Mirai)", "value": "74f9b8dccc29638d68abcede36b38b1569e5a954398cab84b1347a153246a74ab864e9bcd43a9144d939a24c524ebb1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627857470, "uuid": "26b6f859-d368-4af6-b447-6524d02d6463", "value": "T143334B25BA791D53C4E8647A63F7432AB2FA124E20B88F5D3D720F9DFF64580A9071B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627857470, "uuid": "e2be8ea8-5537-4e11-89a8-58f63841b887", "value": "768:hoolq0kR/1NW181Y1aXd5jqxrAqJiLO+rSopo6vEgZ:hob0kR/1NM8mkXDjuJiPrSf6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627857470, "uuid": "b98837a4-e4f0-414f-bd4a-d1ddfc3c6b52", "value": 52776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627857470, "uuid": "2aebd327-967f-40da-8cb3-b35d702f53ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627857470, "uuid": "a7e0f251-ee54-40a0-86b8-494a3f446e64", "value": "6326b06b6996e0ab6860f749cffdde78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feeb6c56-f2f7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Poullight)", "timestamp": 1627843251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627843251, "uuid": "b74513ae-627f-4153-bec8-27e93758be72", "comment": "Malware payload (Poullight)", "value": "87e5df4b2d1ad17687a506394018aeb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627843251, "uuid": "8d75edd2-e909-43ad-a44c-8da34655448b", "comment": "Malware payload (Poullight)", "value": "bb5f523d4b4d9a8bfb0f0e89eff3559d228451476467b7b193e7686031398d3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627843251, "uuid": "b6d38c6a-27e2-4673-84ac-4918567cb613", "comment": "Malware payload (Poullight)", "value": "bfd775b8fc73d85f4127eaa4c3fb91123c5c78ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627843251, "uuid": "74e35a0a-a758-4e76-becf-4ffdb42e0389", "comment": "Malware payload (Poullight)", "value": "0ac19d66346c4f1d439e07225fec675584d104ab60cecf73f101c42a3ddb7b94d0f6f9fa81a88b5eeab8ff4224995dbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627843251, "uuid": "a085c0f0-ec1a-44bc-9f7a-9c58a700ea34", "value": "T1C1A34B7BEBED062DE3AE86BBD4B05D910275F1675503DB4A29C430A90A613CC8E51FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627843251, "uuid": "62fbc588-183d-4215-aa9e-abc3eda934db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627843251, "uuid": "2e541c56-52c9-4ec9-bd9d-d53c243582d0", "value": "1536:GJv5McKmdnrc4TXN1x1vZD8ql6GrUZ5Bx5M9D7wOHUN4ZKNJH:GJeunoMXNf6+E5B/MuO0Ogt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627843251, "uuid": "a0472ee8-1157-4b09-8869-97618a4fb896", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627843251, "uuid": "bc3bb774-8d9c-40ea-b177-19cc7098beb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627843251, "uuid": "ce75a266-4721-4b03-a574-258b20fdbd6a", "value": "87e5df4b2d1ad17687a506394018aeb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47653e68-f275-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627787108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787108, "uuid": "c685dde1-d317-4f1d-a9d2-774c3e90ac33", "comment": "Malware payload (Mirai)", "value": "1abfe7929ced25a5b732a3cf87a961b4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787108, "uuid": "31d259d9-0d2b-45da-b93e-50218a115f7c", "comment": "Malware payload (Mirai)", "value": "bd0bb15dd57501444ab33d78c0940a8ae0e01687f326009bf081f21f03f108e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787108, "uuid": "26bff045-9079-429d-ac05-481593228493", "comment": "Malware payload (Mirai)", "value": "a0e39cbcf77a5bd200aabeb2dd76b2e27419fe92", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787108, "uuid": "15871429-c443-43ad-a157-63f10d7727ac", "comment": "Malware payload (Mirai)", "value": "c61ac42f8253653aca3db88313bfaa229069ad3384286c00447476a9291d02cebe5c4921a0bcf00d96359603acd6f132", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627787108, "uuid": "8203b471-8db3-4698-987f-58365fb72eee", "value": "T1D864E08AEE01AE25E9C016BAFA5F034D73774BACD3DBB111E620C72936DA54B4F76044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627787108, "uuid": "69f42389-5fe2-43ee-878c-64ca9703753e", "value": "6144:p3lOYoaja8xzx/0wsxzSi0Ba77oNsKqqfPqOJ:p1CG/jsxzX0Ba/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627787108, "uuid": "a6b7fa32-46a4-4dcd-9be3-6d42021bdcca", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627787108, "uuid": "dbc6a5ef-9953-4bd2-a3a1-7393be068c38", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627787108, "uuid": "a576c11f-02b2-430e-977a-f5494c14cebf", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d730d2-f2d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627828817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828817, "uuid": "8386c620-5a89-4a27-9aaf-c7b0044bf9a7", "comment": "Malware payload (Mirai)", "value": "a8a7ea25deb8b522c1f0cca10fdbea15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828817, "uuid": "f238a838-2939-4cff-864d-49a8187fbb61", "comment": "Malware payload (Mirai)", "value": "bf0d4c97acbc1edb288254625c25099fbbd2d4842e7b8ee8e06dfa447d86f170", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828817, "uuid": "3a2544b3-511b-4667-9f99-bb1e2df8f643", "comment": "Malware payload (Mirai)", "value": "d89ecb1cf4bc8c38d28e6a5e03e93f4c5d84cb94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828817, "uuid": "1038bfb5-728f-4399-8793-3e1e6d88738e", "comment": "Malware payload (Mirai)", "value": "2afff025d56d3b1e8ea451897c17b1833139e7aa65c70498cea8be13cbfe59e25ffd3d19ab780fa2190d025a8e1c793e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828817, "uuid": "ec8a60ba-52d6-4cd3-b0fe-a2416c23813f", "value": "T12D332B8968121E2CD6D358FD50729F4E9E552321A0A3070FA7ABFDC33D33269EF55988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828817, "uuid": "47428509-a716-4e34-a417-3d84e836fc59", "value": "768:mYuzcClmYrJfIGh6HHaihHHeIXXdauZj0CGeWx3ytvptM7edUo+f1prazDQePbL:mYqcCRrdIC6HHaiFu/eM7edJg1pmzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627828817, "uuid": "5ceaed95-dba1-4aa4-b884-cec78c11618a", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627828817, "uuid": "82601fa4-9507-4d35-8d41-0bb0530a2ba1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828817, "uuid": "62c238e5-b9f6-48c4-a684-76587b82e2f0", "value": "a8a7ea25deb8b522c1f0cca10fdbea15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c337896a-f295-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1627801060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801060, "uuid": "7ad64d8b-bee9-4909-a8e6-67352730d2cc", "comment": "Malware payload (Smoke Loader)", "value": "6d80a854e2fdce6268a336c4d69272e1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801060, "uuid": "651c62a3-7c76-4ef2-bb97-783b907861b9", "comment": "Malware payload (Smoke Loader)", "value": "bf71696e66a738fd23ce41e05b796f8374be7c73dcad393a8933fbbdde7b978d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801060, "uuid": "ca6ed9a9-8a43-4d6e-8b83-f9929338d17a", "comment": "Malware payload (Smoke Loader)", "value": "97e1c246991b8c82911d0d6adfe011959bf97287", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801060, "uuid": "9217d9d8-8cbb-4d9d-b3cf-bad64e3df76c", "comment": "Malware payload (Smoke Loader)", "value": "b92637ad957ddffc60cf7d9998ad5a2c24a2ebba6fe6836b874050adb7566031f129868ba32e8611948cbdf1e4bcaf11", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801060, "uuid": "16b883bd-d45b-4e96-aedb-50e1f1156942", "value": "T1CA44CF513680E472C39109308851C7A13779ACF59A6586073B6867AF7EF33F096BAF4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801060, "uuid": "013bc49c-9919-4334-b3bb-b1b5d8ddf515", "value": "c8b9c145ec19b60e1b1e5259a226415a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801060, "uuid": "69e3c402-2568-40d5-850f-897b4db6b42d", "value": "3072:7FARaM6I0f0dA3x10kF7rbCRRFfaE7T42NUsOxyYTSSNvTCM:2RXWfOAt7SlfaE7T4vEYIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801060, "uuid": "0ca2e758-a4aa-48e4-92e5-28e86d260f83", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801060, "uuid": "ebddc752-e4b2-4750-9e12-2550aae61e5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801060, "uuid": "50e7434a-4d25-41a4-aa66-bc45c46cd825", "value": "6d80a854e2fdce6268a336c4d69272e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4842ea20-f2a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627809444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809444, "uuid": "3573d3ae-aea5-476e-bac5-53d1ac2ba878", "comment": "Malware payload (Gafgyt)", "value": "daa0404ad172d44a386fe6ed479e9456", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809444, "uuid": "c57e2144-ab92-4358-ab5c-1d439d4f0802", "comment": "Malware payload (Gafgyt)", "value": "c078d3dc82ba5583f61c3fe6cd4ef6aa9e5e516b16bee4330a067dc2708dd7d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809444, "uuid": "3befcdfd-62e9-4aec-ac7d-c0bb4aed85a8", "comment": "Malware payload (Gafgyt)", "value": "eea7fe67f23e787f0d62297954cc0f04112d41a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809444, "uuid": "3ac25522-f737-438e-86f0-1dc6ca83b6c8", "comment": "Malware payload (Gafgyt)", "value": "4200b94fabf62c64ca5281a240ef311f8d16752fc5a1f244221623522dedd9dc9bbfbe32563061b55e945865e7be335e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809444, "uuid": "7ad525b8-6ff8-4a5b-a41e-1048294cba3f", "value": "T1F0A308A2F800DFA6F40AEB7604D74B24B630FB650F53562673173967AE762D42823F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809444, "uuid": "4ff9bca4-a06e-4cc0-8f8a-70faf05611e8", "value": "3072:9EPzdRmSx3Lp0qT3pobW5yqrekuzmU9VqFyOfk/X:94dRtx3LplT1yqLuzmU9VqFyOfk/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627809444, "uuid": "af959eb1-ed49-432c-b24e-c0828a8dfe71", "value": 101818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627809444, "uuid": "405faf98-a7dd-4e86-b50b-fddedd487214", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809444, "uuid": "1f38a81f-7df9-4ff3-8e3e-504e56fb2973", "value": "daa0404ad172d44a386fe6ed479e9456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f845287b-f295-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1627801149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801149, "uuid": "4924f718-c911-4563-8a01-d144473dced4", "comment": "Malware payload (AgentTesla)", "value": "34821bfee7748dd682b080ed1c3996d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801149, "uuid": "f6522632-539b-4f5d-9f54-5ef4c0d43051", "comment": "Malware payload (AgentTesla)", "value": "c186924c9e23f60e9dea580f9d3435d36a24c95fc2e4b79c95933cf870650697", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801149, "uuid": "6de75b62-d845-40db-bbce-c1889fe0cfad", "comment": "Malware payload (AgentTesla)", "value": "56498490af347cca113c5075e0653ce420d51926", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801149, "uuid": "9009689d-6cf6-4b68-a076-bc134eda0e1f", "comment": "Malware payload (AgentTesla)", "value": "f943c278d910da5d560e65982169315f0d82eb4caab0ed574235682dcae80d4e72d1208f7df054ae3bf582b04522fb75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801149, "uuid": "a0c01a75-3660-4cb5-9d75-16043a0e7631", "value": "T1A1C402354A45D857C37C53780CAA0D3A1F6451C31062F98AAE8558FD5F3FBB0BEAB1A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801149, "uuid": "16139144-814c-43cc-b4bf-54aafc0eff6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801149, "uuid": "85fabdde-5a40-4a14-831c-4006220fa747", "value": "12288:V48Y65LiZNlOf6zLSx1Tfep53FZBWuDcKbvWg:+6VOTzLSx1TmpJFbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801149, "uuid": "082ae80a-a337-4a4d-ad15-6bf7b196f1d6", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801149, "uuid": "d36e2475-f066-4fc0-8b17-716bfc4e44b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801149, "uuid": "24c39452-2fee-4a26-964d-af86f22be9ad", "value": "34821bfee7748dd682b080ed1c3996d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b868ac3-f2dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627831890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831890, "uuid": "a9aa947d-1bc7-4082-a160-a8f4d8a50e36", "comment": "Malware payload (Gafgyt)", "value": "c88508f18bcff97122e86e701e1000b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831890, "uuid": "6091caf4-2553-4508-85c1-e66c6341a75d", "comment": "Malware payload (Gafgyt)", "value": "c1b776347d0d9d04e94ec9994b0015ea7e9a53bcf9cf246bbd0d714c3f36cd1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831890, "uuid": "07f8180f-bc2c-43df-ab1a-59cb0033b1c5", "comment": "Malware payload (Gafgyt)", "value": "327c5ec05450c2f6224b9920778f8d4c54cd5a27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831890, "uuid": "45b88f9e-3983-4119-96bf-c766ce9f117d", "comment": "Malware payload (Gafgyt)", "value": "76b5b92e2c7b602b0ad472d962cb48803802b556b78e9e002115f111ea484ccee8f1064984957ea44c39a9da64abf91a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831890, "uuid": "75f55d8e-dd47-434e-8bbe-032d421abfbb", "value": "T10FE32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC27995E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831890, "uuid": "5852e09e-6b57-490c-ad4d-62cedb73f59b", "value": "3072:fuNaNpF4uVN++dkhnxkQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChn2QennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627831890, "uuid": "8206c8e3-3a00-41c9-ac5a-da7a6b6481d7", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627831890, "uuid": "441e5f3c-3f0d-445c-bee3-2efee2ec34bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831890, "uuid": "05bd48f8-2af3-4489-9fea-03fa85c6b1fe", "value": "c88508f18bcff97122e86e701e1000b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fa01fb-f296-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1627801309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801309, "uuid": "e9180295-b290-42a5-9d8a-c3af1863656c", "comment": "Malware payload (RaccoonStealer)", "value": "f3595a5df5e76a707e45b3eb6c161ee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801309, "uuid": "74611dd8-5f66-4a31-b788-67a4bebc7262", "comment": "Malware payload (RaccoonStealer)", "value": "c3da65fded89c1b6e0ea8ed263eb3f381e374389de6617ba3f21165ab1cf005d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801309, "uuid": "4b267561-4a75-4bd3-b91c-57540ae9ebab", "comment": "Malware payload (RaccoonStealer)", "value": "a55666d0e28bb8aa4c643c5969c70a1b096fb1a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801309, "uuid": "78a99a97-20da-48fc-9939-e04d1f723dec", "comment": "Malware payload (RaccoonStealer)", "value": "337a3b95202671a63c407ef96e40311747a944fc50dd21d13faa8bce0b158c589c11d16f5ff6c7ea1f9bf52d9b65d957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801309, "uuid": "4aeec8c5-8831-4f9e-8bf9-ebcb6b525db4", "value": "T114D4D030B690C034F4FB12F545B993BDB52E3EA0972491CB92D566EE52386E8DC3139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801309, "uuid": "cbbfde82-d85b-47ef-a10b-b88272b1a305", "value": "4cbc831eb9edfbcf8848c13a7e63cb90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801309, "uuid": "60672280-0152-4ead-9dc0-3dae56804e21", "value": "12288:iINoFLYAm1jWcj59Sx57zrukYkEkNxLMLQRs:2FLS257GL72MEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801309, "uuid": "351589e7-f80e-4ff3-9045-aa19c12ac843", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801309, "uuid": "e0716c85-a6d2-4d17-aa22-7a499d4248af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801309, "uuid": "ec3ced29-d6de-4165-a684-2b14f45750f0", "value": "f3595a5df5e76a707e45b3eb6c161ee6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9aef93-f263-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627779334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627779334, "uuid": "b14221ab-652a-4b8e-b084-0195a4e9616d", "comment": "Malware payload (RedLineStealer)", "value": "8f8df01e4adaf4304431392f2f541adb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627779334, "uuid": "f9d6af56-7539-4f82-a125-f0bf2070bd7d", "comment": "Malware payload (RedLineStealer)", "value": "c4212b60e17b36e660d61ce38b7e9308aaadeaf815c05ab5d1edefed5c80be16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627779334, "uuid": "cf3e6115-61d3-4c42-9536-bf58d7382b1e", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627779334, "uuid": "3e71add5-56e1-4b45-900e-7ac0e65ac9ae", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627779334, "uuid": "415e5350-0207-4e3d-a262-463e3d735201", "value": 3284996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627779334, "uuid": "7ea69b72-1382-4bc0-a6e6-8f1d94a25717", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627779334, "uuid": "a3e229ff-53d9-4cf1-b449-0cd738e3761e", "value": "8f8df01e4adaf4304431392f2f541adb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea4846c-f296-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627801186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801186, "uuid": "483904c0-e34f-4c09-81d5-2523ea775c61", "comment": "Malware payload (SnakeKeylogger)", "value": "be12a12a38cc4f094c8944ed245d801a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801186, "uuid": "5965abc0-4cee-45db-856a-ec457f207f53", "comment": "Malware payload (SnakeKeylogger)", "value": "c45096343494d886b5af190001a970929eb711d8a80515cf2ac1effc6d35a948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801186, "uuid": "3c8ea795-014e-44eb-bb87-c6b515700851", "comment": "Malware payload (SnakeKeylogger)", "value": "c5f044d7dcce9457877362574cf610ae6d46c87b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801186, "uuid": "16093599-e8c8-4ff5-b80c-9af3146a2b4c", "comment": "Malware payload (SnakeKeylogger)", "value": "f4a92b56dafe888a859a1677a4fd3fa6b9f1d441e2a44a3054c8698928834ee1b1d3f3f6716f58f2fcc4a1ad76881cce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801186, "uuid": "a51ec9a4-4fd0-4d57-85ff-bc8050489345", "value": "T12405BF64848CEBBACC5843B50B8D82642DF08E97F4B1D5A03E4A7EF1B1B4D59DB79381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801186, "uuid": "c3d75628-637f-4e81-8220-b98c98908ea2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801186, "uuid": "2f4de92e-75d9-41eb-ab76-926ff8880054", "value": "12288:28C57iS/d348Bi81OzCS/CI5UhAgCxZ78wHWHZ/fiBqlMh/PPFobT:LTS/d3riISqImSgCbQw2HZnzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801186, "uuid": "ee443fda-29c3-40be-bbb4-13cb07f80ac1", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801186, "uuid": "28ceb0f8-2b26-42b3-ab46-3bc41916fa2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801186, "uuid": "f64c6c6f-6095-4ff2-954d-a6cf96444d40", "value": "be12a12a38cc4f094c8944ed245d801a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd469694-f2ec-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1627838416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627838416, "uuid": "41b33c0b-98ad-4ae9-8df5-e18d6739990d", "comment": "Malware payload (DiamondFox)", "value": "f7cded298cdf3671d5be20511ca4fcb1", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627838416, "uuid": "e7679f45-e650-4666-abb9-cc6fe2687b1b", "comment": "Malware payload (DiamondFox)", "value": "c49db28c90989f14866faa6781fc5e6531c8a63d3c3f3d245b4c4d752ce5ebf0", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627838416, "uuid": "9ce87118-907f-43c6-8361-6a93bb4dffd5", "comment": "Malware payload (DiamondFox)", "value": "242e12edbe1a9fd6ba663099c1432df12b9a2064", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627838416, "uuid": "fec80982-5d88-476d-83ed-e882a8f51de7", "comment": "Malware payload (DiamondFox)", "value": "7d23db7b64e011b4ec36ab92ae923a7a2372a491cee41dd4283484e65a59f71e13967fd73311142cbb0dec31ca93da23", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627838416, "uuid": "c643c587-b0cf-4932-982b-0d4ca3191676", "value": "T1EE459E10F652D060ECE200B536A57B7A906E2C38477056EFB7C42E759B326D2BB31B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627838416, "uuid": "45bad9bb-8a0d-4a47-b248-264643c4fc55", "value": "4b1a0cc0d6c71b1f1abf86a8693fc16e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627838416, "uuid": "c563318e-a46e-4cf8-a49e-1cd0869fc304", "value": "24576:Jq5mFG/nW3aTDtFj3RbjBN9fmuyXtw/4TL2lDNY/to4:45fuKT7jxj9foTylD2o4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627838416, "uuid": "fd849c80-cf2f-49a2-bdf7-b699baf13d31", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627838416, "uuid": "5ad17e70-bf98-4571-947c-e501d9929b39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627838416, "uuid": "dc042bc2-465b-431d-92cd-9b75db3e5805", "value": "F7CDED298CDF3671D5BE20511CA4FCB1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c6b9e7-f2d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627828797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828797, "uuid": "8315fc31-326d-4081-99a8-f94d6c46a048", "comment": "Malware payload (Mirai)", "value": "d7c276df7b00f63ae7d7ddcb825f19e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828797, "uuid": "02304b45-aef4-45a9-afa3-a1d4a16048c2", "comment": "Malware payload (Mirai)", "value": "c726d48039d5b5c8f291eda30ebef11c5b7492594c4b6a14987d0cfa121aea14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828797, "uuid": "499433e4-de3a-49b6-a175-c373f0507531", "comment": "Malware payload (Mirai)", "value": "71d756985bec30d825b99e504c7f7413245d9fb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828797, "uuid": "392b0ddf-c5cc-4e0f-847c-4eb7cdea332f", "comment": "Malware payload (Mirai)", "value": "08ec200999b761598a7b3901fad61190209487464927c79284f8d311a7f7d57ca2500d08f0843fbdfddd3670fc49079d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828797, "uuid": "aa0d1158-4f6c-493d-a064-514d947548ff", "value": "T1C66318817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828797, "uuid": "afd9b455-5ce4-4b52-90fd-89fd7fb2de6b", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI84M:GbtexU0r8QCKw2FbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627828797, "uuid": "c6ada71f-cb0e-48a7-9a92-c3356d471ff6", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627828797, "uuid": "5b65e6f9-a232-4c96-b143-a4cf21a14c7c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828797, "uuid": "7028bbe4-b8ab-4263-93a2-a897b48ac0b4", "value": "d7c276df7b00f63ae7d7ddcb825f19e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf72867-f2fb-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627844860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627844860, "uuid": "a313ce9d-0af1-4187-9119-fbd1412c6b9e", "comment": "Malware payload", "value": "1ca18ca1073e6dbba04674f6b456e5da", "object_relation": "md5", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "SteamReplacementsTool", "colour": "#40AB74", "exportable": true, "hide_tag": false }, { "name": "SteamReplacer", "colour": "#629BDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627844860, "uuid": "3c957f3d-66eb-410a-9f7e-0107f3ecff33", "comment": "Malware payload", "value": "cbb798cab543c552bf024b1905f426c6f79e75ab8ab9371039c90917b9114539", "object_relation": "sha256", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "SteamReplacementsTool", "colour": "#40AB74", "exportable": true, "hide_tag": false }, { "name": "SteamReplacer", "colour": "#629BDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627844860, "uuid": "0a6769e0-5c70-4d29-9539-c5a45c01ffdf", "comment": "Malware payload", "value": "0ec9ea395427d36420ed45daf977c07a6a88f6ab", "object_relation": "sha1", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "SteamReplacementsTool", "colour": "#40AB74", "exportable": true, "hide_tag": false }, { "name": "SteamReplacer", "colour": "#629BDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627844860, "uuid": "047039fd-ec6c-46ac-8cbc-707529ffb1ad", "comment": "Malware payload", "value": "f3de51126b6f77f861ba3ee1cb9bf74a68aedd4d182b64abe04c34291069b195c907c0a3a941eea5940f89a58dbba8a1", "object_relation": "sha3-384", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "SteamReplacementsTool", "colour": "#40AB74", "exportable": true, "hide_tag": false }, { "name": "SteamReplacer", "colour": "#629BDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627844860, "uuid": "d33c9618-34e4-4ded-a83b-e59fbcebf5c1", "value": "T10135098073D2784102076777731F72E5E52DC99AB488884EF40DBC98FFB9916E6E9A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627844860, "uuid": "723d0676-b028-47f3-84b4-2df3edb80ccc", "value": "24576:Ox4CyQeIO0uTVDpzNZZCzpZT1OAlroaNuLM2k61BT9RNc9BigBcpQzFZ:OxrywO0uTVDpzNZZkT1OAlroaNgM2j1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627844860, "uuid": "5d83c958-53ee-4f16-873c-ca3e6b055326", "value": 1113708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627844860, "uuid": "85d81c77-aa6c-410c-96e0-f5ec70bd5942", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627844860, "uuid": "0aeed7bd-7721-460e-a45a-4c332c09580a", "value": "FloatChecker.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b9ee5c-f2e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627836013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627836013, "uuid": "68365a09-f2f2-49f3-aab7-256209310274", "comment": "Malware payload (RedLineStealer)", "value": "fc3f82c9200496428652bef9892ed46e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627836013, "uuid": "1b9fe078-99f7-4b4a-b915-af2bb577c3d2", "comment": "Malware payload (RedLineStealer)", "value": "cd2cb1220011afa6a1bfc8f5457bba94964777743247a0b374f1147c9204ed66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627836013, "uuid": "3897ada4-8edb-4f2a-9b88-01c184d8bdf5", "comment": "Malware payload (RedLineStealer)", "value": "884af2a82420b07253fbddbb5081fd7812efe4b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627836013, "uuid": "19ac3ccf-7356-4033-a95d-8526a75b9f62", "comment": "Malware payload (RedLineStealer)", "value": "c7f02b92a1531ba0522d414ff422483732adced45e65428b05bf65ccf1c9d92733417caa0e66a148c0f03452d1a76ca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627836013, "uuid": "9bcacd29-5fd1-499c-81c2-d2ed2149b9aa", "value": "T1E3A33C2163D8D629F7BE0A35B4700524C7F1E48FB011E75B8EC5A4DB2EB6B8229546F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627836013, "uuid": "c343b11e-76f2-4e11-b818-8f06620149d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627836013, "uuid": "28f107d3-1a41-4df3-bb06-55f66098e11f", "value": "1536:x3LNmoceatVGuo43eF5MN/JFbYmbfexvcuQUyyedQ33lqCxXsEWG6ijoiga:xxmocSHmN/J9FgcubyzdhSn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627836013, "uuid": "7b6fbc96-a532-4323-83f2-4c1f3ae85622", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627836013, "uuid": "ad1ae851-9f26-4a29-87d0-1a8a1af4b3d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627836013, "uuid": "50603c2b-ef4f-4ed0-bb9a-5f37298002fc", "value": "fc3f82c9200496428652bef9892ed46e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e516e53-f2ac-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627810715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627810715, "uuid": "e54f02d5-0f35-4e30-9969-f66c14438732", "comment": "Malware payload", "value": "c8231308b468b9cd46f39b0e70c4e3d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627810715, "uuid": "74f96777-8ffe-4313-aed6-db94606351f1", "comment": "Malware payload", "value": "cf3ad75a200d7643ef6855f96baac231d0de7aad33dc7d8b7bd82ece8bf4bdaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627810715, "uuid": "45a65e15-6547-47cd-a7b2-e08cae008c2c", "comment": "Malware payload", "value": "2da4f86d115bf1f377ec86536aa432c81309cbb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627810715, "uuid": "45dbc7eb-9450-4305-a183-f0eebee8dff1", "comment": "Malware payload", "value": "fe6e1f36c02b8f226cd0923fee9e17bca57dc7c9a6867c3b0184b136d875b13ed52e1f3951620865ee2d204af909368d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627810715, "uuid": "6888e8ba-7974-4bec-ab52-a79bdcfd40e3", "value": "T150667C02FCA624F9C6BEE23085A19321BA7178A943313BD35FD4957A2666FD47B3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627810715, "uuid": "759c6d57-3e60-48e8-a3bb-36347c9071ea", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627810715, "uuid": "5b7ed7a8-5066-4ef4-bf3a-aef580e4d70a", "value": "98304:kKJkR00TQfAI2aTI+JSSGm+A1UKqcVoSIxi4SzI:k4kR000fAI2aTI+klgs8BzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627810715, "uuid": "f9454429-1677-4c33-b113-2e4aba6e9ca8", "value": 6990848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627810715, "uuid": "3fcdab6c-2027-4a54-b2cc-038ffe59ecf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627810715, "uuid": "e6f02112-5d37-4de2-b4b2-80b127204b7f", "value": "Go.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e71b31-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627808797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808797, "uuid": "af2fba1b-f5af-4cd0-8a08-967017eb3569", "comment": "Malware payload (Gafgyt)", "value": "8b7c0e1c6ca92e9e8d912daa4557d571", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808797, "uuid": "1a3c5838-7820-4d69-91c1-d4445fa2ec63", "comment": "Malware payload (Gafgyt)", "value": "cf9eb1d8e11653b644273e2476c08727da57a99da4544c40761ee185d4b770fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808797, "uuid": "f7f17cb9-862e-4d92-b773-398836f5c835", "comment": "Malware payload (Gafgyt)", "value": "4a4c300d9a14a62e9addc8c0e5375f49cdd2810c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808797, "uuid": "4ec3dccc-303e-48e7-b678-7bc758624015", "comment": "Malware payload (Gafgyt)", "value": "cd1ca67a4d3bf155c5b6fc009717174a0dc646ff222f10249f9a0ba9096065fd0146fb5c85978b38dc6ecd0555da79e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808797, "uuid": "fe43d8f4-076e-44a9-92a3-2986bc2ad697", "value": "T193733A43A9618FB7C0866AB526B759300B63B8511F4F1B99323CAAF4074F9CDB81F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808797, "uuid": "20e0dc5b-04dd-4767-bf74-97ca7b4b368b", "value": "1536:nuLfI3yqUKlm4L9+aDSOIidCNQgNnmj9VqYLe8f26e:urItblB+abdy/hmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808797, "uuid": "04927128-84f3-4e6d-8b38-11631c66e9c9", "value": 80433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808797, "uuid": "2a4c9ce2-ecbf-4339-8840-403f6c41e23c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808797, "uuid": "2dbe46b6-9cf0-48da-a114-330ecdb99a60", "value": "8b7c0e1c6ca92e9e8d912daa4557d571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44082354-f2a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627809436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809436, "uuid": "9a866668-03b8-43a4-a6e3-2502169d8137", "comment": "Malware payload (Gafgyt)", "value": "7e80d5cab4a289dd675c8fe52c9ab4cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809436, "uuid": "7f1f3710-414d-4a3f-822c-b6efc213ad49", "comment": "Malware payload (Gafgyt)", "value": "d00da8720b32bb4414f67dab7024075ece8b5142b72c74b2e3eab7ff91fe4ba5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809436, "uuid": "c277c61a-dd3b-46eb-bfce-94950d4afb15", "comment": "Malware payload (Gafgyt)", "value": "1749a7555825db5759e271bc2411d4c3359be43a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809436, "uuid": "02f086ee-b344-454a-bfcd-46d74b087d4c", "comment": "Malware payload (Gafgyt)", "value": "e09f010e4e809800df7ab59c551df18c8d795e68f78be7dfe6c32c118c4df27f8a27bd816cc872cba9cea6d55f81c020", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809436, "uuid": "2ba79120-6a31-454f-a011-284d87fbe2e1", "value": "T1B7A31744F8448767C3D327FAE78E439D7735266457D733116A38AEB42BC6B982E29130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809436, "uuid": "da27faa7-af34-46e8-b46d-a4d6a74c910f", "value": "3072:vlXmjWRiQ6wf44YL873GdUmpEqQ45vVXY0X:0ji6qnYL87xmpEqQ45vVXY0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627809436, "uuid": "64c2f759-196c-4a5e-9850-a33938cccb94", "value": 105111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627809436, "uuid": "d2b427ef-dd22-4d85-b2fd-590ca19114d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809436, "uuid": "fb1712c2-84e6-466e-9e35-5af7772a09ee", "value": "7e80d5cab4a289dd675c8fe52c9ab4cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f98beb3-f313-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627854929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854929, "uuid": "0f88348e-f7cb-419e-98d5-ab32700acebb", "comment": "Malware payload (Mirai)", "value": "2796ef1aadac55c011cdf11d35bab8cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854929, "uuid": "37e650cd-7862-4597-b4c5-0c2974143416", "comment": "Malware payload (Mirai)", "value": "d46b228c6ec7cdde3541c5f17c8825d12d9be28bf1cf5a2b7ac8ef48d77a9db3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854929, "uuid": "67182b13-f59a-4f22-977d-32fdea79f59b", "comment": "Malware payload (Mirai)", "value": "2d391d6117c129e1c240002127296b4030aa48b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854929, "uuid": "14606313-7b96-4937-8e6f-1673b98317ab", "comment": "Malware payload (Mirai)", "value": "2128dcdbb35c1112289d5d5a4226dfeb0f992c246209c0361504755a71aca4be25538b92ac57e30bbf5c21a162bba336", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854929, "uuid": "0afd7add-338e-4578-8ad5-f01e4a956447", "value": "T1DDC2F145512CCDF1C4B19532FCA68583BE9B1BBCC83E763332F46BA894E245B4A59A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854929, "uuid": "59fb8555-8ffa-474c-b446-7fdd5b0060e2", "value": "768:qscWgZHCxTcbK7lk0pueEOY/G9q3UELK1:CpZNelJs1rTL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854929, "uuid": "581a7152-49d0-4a0f-9ccf-41146e8fd22a", "value": 27496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854929, "uuid": "a456b574-9215-4f8f-865f-2c8f9f1d713f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854929, "uuid": "6f22e2da-a58f-4528-a192-03bf3d64de66", "value": "2796ef1aadac55c011cdf11d35bab8cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307ce95d-f2a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1627809404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809404, "uuid": "f4151727-4239-413a-b595-2eaee367ecfe", "comment": "Malware payload (DanaBot)", "value": "32184d631a9d9bafeec0c049d0c72c1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809404, "uuid": "a10701d9-0828-4d94-942e-a4f3d4169e22", "comment": "Malware payload (DanaBot)", "value": "d61176ad7367c227cd55914c24fb5584d01b17cef989648c8274665b630ea9aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809404, "uuid": "637f841f-d8b7-4648-9a5b-03b44bb4689e", "comment": "Malware payload (DanaBot)", "value": "a4445127357391313387dde439a1776a1d78e3ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809404, "uuid": "6fc9866a-7c53-4203-916d-62973c4b82cf", "comment": "Malware payload (DanaBot)", "value": "6f955ccb0888811a5b8f75902201133ddbfbec54a4c524c34381b11b2ae6d68fb21387312a3cfd0fac170c096da11725", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809404, "uuid": "a2849256-4990-4c32-b0a2-92ac4f490394", "value": "T1B255337259D38971F598397E14309A11E2717C602522DAEFC6217CCEBA33017BD2A7BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809404, "uuid": "61e40de8-4838-4c7f-a6e9-174ff177bb03", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809404, "uuid": "724a8928-16fb-42e5-bf35-383e3a7e4406", "value": "24576:zFzw+wskQ1Z81YKwMMcVM9ZUxwAnzl2545AVEqyd+JnDce6IO9c30cVr:xzw+wsr1Z81Pwt0VxwAzAcUZ9BO92r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627809404, "uuid": "64c10da3-da09-420d-b521-46fd35102187", "value": 1305463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627809404, "uuid": "e16c9f47-3fcb-489e-b22e-4d7176e2c10d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809404, "uuid": "af1445f2-f907-4f4a-8d0a-97a623f2a6d8", "value": "32184d631a9d9bafeec0c049d0c72c1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2831d76-f313-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627855175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855175, "uuid": "dfe86ac1-67d4-488a-9806-23331da3b0fc", "comment": "Malware payload (RedLineStealer)", "value": "964d27f847238a3ff9b11f21d99aff90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855175, "uuid": "b8959cb0-fffb-470a-8a4d-4037ca67d027", "comment": "Malware payload (RedLineStealer)", "value": "dcaf58a74327239aff106eb7da1f06a9ad9bceeaad4e8a08496fa75f744e8f55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855175, "uuid": "1fdae438-02bd-4860-80f3-0d88e99ce62c", "comment": "Malware payload (RedLineStealer)", "value": "e93362db7119767bf6c13f96bb4fe6fa383c8c7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855175, "uuid": "a2c1bc45-eb13-4c26-80f0-a765e0459be2", "comment": "Malware payload (RedLineStealer)", "value": "deaa689be72c941e9270b64c14590639e21078c24f4a6c006b6d735dce5010212f8109e5cef4960959ba8ac5db1be89d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855175, "uuid": "3a76c50a-87ec-41bd-9227-91452b5d9890", "value": "T16BA33B2163ECDA2DF6BE0A35A4700115C7F1E48FA011E79B4EC7A4DB2E72B8225546F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855175, "uuid": "c928114d-16d0-49cb-904c-f7f849094a50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855175, "uuid": "cd83c4ee-eee4-4a7b-a1e1-e1467ac40917", "value": "1536:EW3LNmocewYT2ycoehFb0a9JFSdsmbfePv1uvUyyedge3pqCxXsECG6ijoigz:TxmoceedJIdha1ucyzd8SnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627855175, "uuid": "b96631c9-aed7-4519-b2f9-9966c7db58f0", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627855175, "uuid": "c704ff04-e5bc-4517-87d8-bda6ccd27543", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855175, "uuid": "51e12b28-ec76-4519-843c-9cf5e9ecc28e", "value": "964d27f847238a3ff9b11f21d99aff90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d731d5-f275-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627787131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787131, "uuid": "d21b1c4e-5e25-4207-a66f-eb2c34d85bab", "comment": "Malware payload (Mirai)", "value": "368d6709df4a6418603d3663c4889d03", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787131, "uuid": "f235a5ef-757c-4314-9b42-f9161cbb7ee1", "comment": "Malware payload (Mirai)", "value": "dd23c3689f03d0c09e61176f6fdea29d6c1a5b81c36d52ddbef24dc17d33d939", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787131, "uuid": "bce37333-ebe1-4fb6-bde2-c3778de6350e", "comment": "Malware payload (Mirai)", "value": "b8de9a8c875c0360f0b3d215c24c3e6b08dda025", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627787131, "uuid": "a12100df-73a0-446e-a06e-f5d9f7b7dc5b", "comment": "Malware payload (Mirai)", "value": "088490dd8c68fdcc962ceef7f931695e3f9c1cedf8bb79ea20a869fb779213a8ef2eacb547c52a534d208a7f6fe73380", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627787131, "uuid": "018adf77-2d33-45b0-aa74-031397815d28", "value": "T19364E08AED01AF65F9C506B9FA5F034973B38BACE3D7B110E620C7143ADE64A4B35584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627787131, "uuid": "1440788e-7b52-4bfb-bb8a-7da8d67ca961", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncVa77oNsKqqfPqOJ:78QpZsKCaiVa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627787131, "uuid": "67b8a6e0-00c0-4205-ac72-5b53e87a1d9c", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627787131, "uuid": "fca57b67-4b47-4d0a-9850-505a98887f14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627787131, "uuid": "e2bd2fe5-8d8d-4289-80e3-28a0038bf47b", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87dd0906-f2f8-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627843481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627843481, "uuid": "2d476ab3-073f-451b-90ba-7105fb4bc525", "comment": "Malware payload", "value": "97b9eb77df52f0e461c4e964b1b7e9e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627843481, "uuid": "a5935c4c-1d9f-4354-8cc2-02a3b366d712", "comment": "Malware payload", "value": "dd72e3501ef90b6ae8178a2d1a56259d9ec196333b963ca2a41acc8fbd7e26c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627843481, "uuid": "cc9b9752-e853-41ea-947c-8e39a85e5199", "comment": "Malware payload", "value": "98abcb24acd86fe78e9f9e6e71e8225ed9ec51af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627843481, "uuid": "3c3f6925-adee-43b6-9be6-72613b55642f", "comment": "Malware payload", "value": "b3e0361f9fc95c7c5f3ad94c7a1fbb9d16f9234317c1d8c0c720f38ecd4386d64f8e015b3ecede7e1d0e5e4b48abedff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627843481, "uuid": "0b4b0507-a3be-42d4-a274-6ab28d800afc", "value": "T19C843B8EA60B929DD40D6E3111370C1BE6B0FC36E376A47E8256377487BB84F9583972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627843481, "uuid": "fabf7c9b-5cc0-4b31-b043-570fbc137b8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627843481, "uuid": "e1088573-1fe2-4686-8bc3-19455fd39040", "value": "3072:fDd1y4Y5TxPlispHyopqI4CXQ56VJohiedP4ARlispHyopqI4CWEOrXQKFaivOzf:K4Y5ThBdyQPnX9+gOBdyQPnWEOrXT49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627843481, "uuid": "1f721126-f012-4ddf-9e37-ccb882846e73", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627843481, "uuid": "194389d1-deed-465a-8c31-cd3d51cec553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627843481, "uuid": "b03df04c-3bbf-499d-8533-f612dd205313", "value": "97b9eb77df52f0e461c4e964b1b7e9e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8e46f4-f296-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1627801347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801347, "uuid": "0d503fc7-d89d-4439-a912-579ef4206d04", "comment": "Malware payload (Formbook)", "value": "cdd987c1a424a820bb9b8adb20507698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801347, "uuid": "21935f80-5f03-4f97-9ef6-a4f9bda3daab", "comment": "Malware payload (Formbook)", "value": "dde0d8980f77e3569f9d6c5e0c439e8dd8e2bba5fa2ae4d029ddcc4c1f3da134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801347, "uuid": "e8bd03ad-168c-4768-8a77-3cd9fc837a4b", "comment": "Malware payload (Formbook)", "value": "f0e3ea9d7cba40e3f893fd6d26b34d696d9dee6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801347, "uuid": "45ae2f73-5cec-42dd-8e96-c914c8adccae", "comment": "Malware payload (Formbook)", "value": "312e6084a8ec7243fc9f381404fe1330fa3951d98be2ed2ef10b353580dc04e55979176057796bab341105b7f0a4ecff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801347, "uuid": "c34ac199-c0ac-470d-afa7-35dad20660b6", "value": "T15E441D2C23FEA719F233FF319FA4A6449FA676B59215DD0D2DC4024B4821D81AEA7D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801347, "uuid": "6b497548-ea96-42e7-844b-217a421de4bf", "value": "3072:zwcRv4TIlZ03RwLrNls9X2Hd4+yBCbSPnZkx54htUfwdn3:zwMv4T+3LrNls9XOd4+QCWPhtH53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801347, "uuid": "a4998498-c07d-4695-987a-915ad1ee396a", "value": 274790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801347, "uuid": "aabb8b32-c394-46b5-9363-fec1f93842f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801347, "uuid": "7ad74860-cec0-4a82-a9cc-30f583cbae87", "value": "cdd987c1a424a820bb9b8adb20507698.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f008b165-f2c0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627819603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627819603, "uuid": "d5a4e195-c52b-468c-997f-79218a178704", "comment": "Malware payload (RedLineStealer)", "value": "a4a306682bf75b4976c3441f5151db97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627819603, "uuid": "356f9cde-3a09-41bf-9e1f-8932da71719e", "comment": "Malware payload (RedLineStealer)", "value": "df462937835934f9edafab767c440457a7416ccc2791955db97d4714a406d5ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627819603, "uuid": "cfd5ce7b-429c-4b61-a0f5-43bddca601cc", "comment": "Malware payload (RedLineStealer)", "value": "2709496b7205c9d10c28c5e069879e95db236a5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627819603, "uuid": "087dc312-40ec-446b-a3d2-84e27770c90e", "comment": "Malware payload (RedLineStealer)", "value": "37875713caafbcc3a72143cede1360e05dcaf251f68cb36cd31585d30cdf55480b5dabb570ded60b077109b0bf97834f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627819603, "uuid": "ad5327ab-dcb2-4e80-b61e-b3a13664a631", "value": "T1C574F1113681C472E36109304865CBA02B79FCB19D784607B75867EF6EF33F1AA7AE46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627819603, "uuid": "f470f95a-6d81-4279-bab2-bb46218c6684", "value": "c8b9c145ec19b60e1b1e5259a226415a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627819603, "uuid": "587e4cb4-30d6-4c5c-81bf-b5b3e910110f", "value": "6144:4CajGoQi5Vzdze6SYCYgDKviJuraE7qCGEYIM:wDB5VBSYd+K6JoORE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627819603, "uuid": "a84499e3-4dfa-4738-bae8-dfd35e2401ef", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627819603, "uuid": "f114e4c1-5274-47d4-83e7-9850339528a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627819603, "uuid": "682c97a5-be78-4f16-8245-e63962dc7541", "value": "a4a306682bf75b4976c3441f5151db97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae99920-f2a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627808804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808804, "uuid": "e38575a8-8392-40c7-94d0-8dc8dc8067df", "comment": "Malware payload (Gafgyt)", "value": "f30b92273a8cae2c568041ae7952d928", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808804, "uuid": "7fcf22f2-1cc6-4cb3-a270-bfd9f58ffa72", "comment": "Malware payload (Gafgyt)", "value": "e05e06888ddc94071bf95e52fcc633afabac2c94c94321098d3d0311a150f306", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808804, "uuid": "43f654ce-6eea-4e04-94c7-c54948ad07ab", "comment": "Malware payload (Gafgyt)", "value": "7b010e7201e948c5a8e980ce550a6ac9b70e78b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627808804, "uuid": "3c034761-52af-44ad-9399-d25c8b9899ed", "comment": "Malware payload (Gafgyt)", "value": "42f0c062126596eb14b74266057f79b8720af6e3dbb1d5a85b24b5d77648a59e61dc8978a3fae2e0e33283b2f15b0948", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808804, "uuid": "f5e20c47-e06c-48d0-8ef0-a5a9d28d0f1e", "value": "T116734B02EB43C7B3C4830BB60297AA590931F96A5E2B9F85F31D7DF4AB124C87217765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808804, "uuid": "21920fa3-d7c4-4b8b-be1c-90c1c3d09d5b", "value": "1536:vnT6kXfEC5WZscuuofK79FO1RZKSzBLBcmLI2VOCjXUfJRk:GkXfERmPuofKZFqZpp+mU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627808804, "uuid": "b111cd80-e3ad-4bce-ac25-9fbfca3779b8", "value": 76648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627808804, "uuid": "5e54071d-8533-4278-8154-8841518d3ebf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627808804, "uuid": "75372a75-d706-4aaa-8ef3-76b0a0c9bc15", "value": "f30b92273a8cae2c568041ae7952d928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5fd103-f2a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627809429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809429, "uuid": "afec7147-90c8-4286-9fc1-ae2798b3ae9f", "comment": "Malware payload (Gafgyt)", "value": "68a081a76fa0c784fd319da7e864b30c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809429, "uuid": "20509723-003f-4516-bd49-20109559b310", "comment": "Malware payload (Gafgyt)", "value": "e0f67b55d703cd3fbb1c0d1bd3731a4e89242e55aebe2ce2eb52f4dea2a46f96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809429, "uuid": "cb38b708-7e4b-4f25-bb99-468e3737786d", "comment": "Malware payload (Gafgyt)", "value": "e5692f178f81c7ed58ebc904cb6ca0dbd47fdbc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809429, "uuid": "87d6372c-e531-43dc-9a6a-2d85d21dd2ba", "comment": "Malware payload (Gafgyt)", "value": "0ad5bd1ca0233d8fc84ca657ba280207cc956b385417b1f658a39cc777345f434da3131723f2b26a19b72e55e08c9cc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809429, "uuid": "6e4a5ca2-0beb-4d3c-a230-40e3aea5b0af", "value": "T149D3A56EFA12EBBEE16C863107F76F70D39531A22AA1D381E16CDA181E7125C1D4F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809429, "uuid": "a42b9422-a7ec-42dc-9b7c-9133aa3b661b", "value": "3072:7yfy/nxNak8f3FTXOFVJ5vUV2/zizybisFejdt1UhBl5tly3G5Ozk6DhB/ZZ9B85:6fnZSZkbJeUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627809429, "uuid": "4642dfe2-952f-46eb-b9ae-6a2939bfcada", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627809429, "uuid": "837ce257-d254-4d6b-8d83-6ccd0e03873e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809429, "uuid": "0b96106c-5202-4e85-a9d8-70e00050be59", "value": "68a081a76fa0c784fd319da7e864b30c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308c624e-f321-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1627860943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627860943, "uuid": "c06db65f-6ade-49bd-9df7-3d3a1e163781", "comment": "Malware payload (BitRAT)", "value": "41965fc5d071ce4b42bba9b7c486f784", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627860943, "uuid": "523cdc57-dd6d-4381-af33-89b9a7f24e07", "comment": "Malware payload (BitRAT)", "value": "e386c831df697e516fedcab1ad8a879ae057a5f4f321a873dcd31e9c6760009e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627860943, "uuid": "362c9b8a-5157-4f35-9eb8-fa7532b55b8b", "comment": "Malware payload (BitRAT)", "value": "e1c90feba42abe5c4ae88d86ae75e021f55afb0b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627860943, "uuid": "51f7f0f0-5b77-4c53-a777-735474190573", "comment": "Malware payload (BitRAT)", "value": "6267bf8dcca3a684716d394bc410246e8fa950438c0a520dcecf21175223ebc101acb2a02dcf77e0e8cf8b3afa9ad7de", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627860943, "uuid": "946b5493-3259-42ef-828a-b389f3b3f867", "value": "T16036CF10AF57DAEFC84FA27FA4641D15567DE212420BE3C7979610B82FCA3838E192D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627860943, "uuid": "2a5ba658-bcc8-4849-b05d-d822f4a080e7", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627860943, "uuid": "014f3fa9-6a78-4f89-b175-f8637477639f", "value": "49152:36PaeNTtXgpSTeCrkJ9rV/FZjRrZHFqtgJIHiSynJpwjIcOJFSNTUyzL41:kagT+4TaWTUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627860943, "uuid": "0705b54e-7916-4ceb-abc4-90b4956fe751", "value": 5140842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627860943, "uuid": "d24921b3-66c5-4f54-ba7f-62e76b3f944d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627860943, "uuid": "79d8cab5-5502-4330-8d60-5f0cf02844eb", "value": "41965FC5D071CE4B42BBA9B7C486F784.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ba99b1-f267-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BlackNET)", "timestamp": 1627781145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627781145, "uuid": "ba2e37bf-1ceb-4bf1-8f0d-20425de35e11", "comment": "Malware payload (BlackNET)", "value": "97cb3fda3cff430377a866d6b437de8f", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627781145, "uuid": "3df906ce-b5bb-4716-ad6c-d634c4198953", "comment": "Malware payload (BlackNET)", "value": "e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627781145, "uuid": "0a8308c7-4442-4920-a276-45df3b5165f1", "comment": "Malware payload (BlackNET)", "value": "2359c8459c1e1dd133c2842b51d2982e63016f92", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627781145, "uuid": "f27ec67d-0b16-4ab3-8db9-6df39535fc02", "comment": "Malware payload (BlackNET)", "value": "9686587eac441b6c22cb4fc0c2b4be420eefa32628dd4cc8ad61407a3f120149aa889b4bf472406fab81ec72f0dffcc6", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627781145, "uuid": "73686f74-4191-4212-beee-2a177868c9e5", "value": "T1EE2402793DE54976C29ECE335CE174209A618835487FA99FEE84D2184999342F3E33BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627781145, "uuid": "3bf2f161-49e3-49f7-9814-b566df76aa56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627781145, "uuid": "b482e4d0-384f-44b5-a8ce-55a03e57d79c", "value": "3072:alaJEgEXbfa9K4Em8wNBiXMhDJv7WehI2135eDRCyqTp0FUSVBOHfHAXTRsPCgfr:BEg4S9KqiSJvthI25ebqqBOKTRsaj2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627781145, "uuid": "cf7775b4-bffa-405b-968d-3349028f718f", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627781145, "uuid": "686ffcae-d709-409e-995a-2b856f3cca46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627781145, "uuid": "9e2c2712-9484-417b-b41a-fada16efc1ce", "value": "E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4e883f-f27d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627790450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627790450, "uuid": "e2a06801-dcc5-4309-9029-2c80d4156c96", "comment": "Malware payload (Mirai)", "value": "685dd868064c2cd6ad8d75df52f17519", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627790450, "uuid": "6d6d7c4e-63aa-402e-bd55-137496cf792a", "comment": "Malware payload (Mirai)", "value": "e7dd3af6aba267fb0269fc0dbdd769cdf40141d13d6d7234916318f258e5d01d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627790450, "uuid": "11999005-b3db-4e97-92ec-93be121c576d", "comment": "Malware payload (Mirai)", "value": "31cab732a758a00b47ce50dd9638fecd50e5c2b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627790450, "uuid": "a18aaf45-f988-45ce-809c-af154de2caa2", "comment": "Malware payload (Mirai)", "value": "8ab207400e03bd526c5764a04c084c8e5de03f702568767907816bc02d820fac9b8d90690cac50b988d84e3e4a00c626", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627790450, "uuid": "762e6b2b-1e2b-4e77-9c09-1174eb9dbe03", "value": "T115640287FB327C0BCB010BB221DB4B9DA97CAA5B83C79091B6C0855F25F61C5B6A12D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627790450, "uuid": "c7f58927-3588-47f1-a754-232ff9cae060", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio:p3lOYoaja8xzx/0wsxzSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627790450, "uuid": "d4dac21c-1edf-47cf-b196-c31d7a6bf3cd", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627790450, "uuid": "3ee82b26-91c4-4a01-af94-264b198ac92e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627790450, "uuid": "f3eefd0d-91f8-4f10-ba78-0de40e089689", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a5c023-f295-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627801109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801109, "uuid": "9e7706f6-edcc-481e-9bd8-4ee5190ce0cf", "comment": "Malware payload", "value": "40a4815d1ab525027145a34b8e99f446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801109, "uuid": "a7541e52-c9af-4428-89d4-6a46c89de9c8", "comment": "Malware payload", "value": "e7e2866ed8e4e76df821c19dee3c8b3c41c282c226152e5b3abc352d2f2a6861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801109, "uuid": "034d1779-adc5-476d-a529-5d9086504f20", "comment": "Malware payload", "value": "ada335e12097f80ead3ace2cc721a65ba3ce03b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801109, "uuid": "74cc9fc0-853c-4778-b29f-670c97cf08ce", "comment": "Malware payload", "value": "b09038f2efae5ebdb0e40684c876a26eb0b1ad78049f7e46c1875991696c75112e0bf8cba72f603d46f309c5a73d5cf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801109, "uuid": "c6597d6d-6f77-4d8d-a901-82af207e69a1", "value": "T1C2C5335239DED05FC0FB8FB1B9E298800994DF8520586F0A513BABA6117BF5DCA6CC74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801109, "uuid": "c5f1b714-9232-48f9-9719-032d83120ede", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801109, "uuid": "1571a994-1a19-4f88-bcfe-6fd25cb01684", "value": "49152:wjKGJkFI3l/N3+td2gdf16J1xKOKxjtTHLVr0Fjkk0fv8gHNDIAVxGpL5NPqhBjy:GUFI1/p+td2Uf1u1xBKlhVr+4k0fBtkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801109, "uuid": "6af9a9d1-0923-41b3-b163-33f29934e5e0", "value": 2722479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801109, "uuid": "58ad3a4f-6b38-40c8-9426-a658ac8edf5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801109, "uuid": "28ac6cc0-0a1b-4fa0-9d88-b732947cc869", "value": "40a4815d1ab525027145a34b8e99f446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc32598-f2af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1627812055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812055, "uuid": "31959ab0-1509-4a1f-8830-78af99268259", "comment": "Malware payload (QuasarRAT)", "value": "b8f6e00e0b83ae7620ba2104c644f485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812055, "uuid": "511a3f8d-f9fc-4e6a-8b84-8809c8478b74", "comment": "Malware payload (QuasarRAT)", "value": "e8ca0270e68c2f29f8e9f6a77fe630a93b08c04573bde4956690f8943e6d10e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812055, "uuid": "92d4ad7f-6f7b-40f2-ae3e-01948292f190", "comment": "Malware payload (QuasarRAT)", "value": "9f1288d7ef5309a95f723ac3067db8f920093c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627812055, "uuid": "4571e0d6-3426-47a9-bea8-bfc9d297a6f7", "comment": "Malware payload (QuasarRAT)", "value": "175dff4d2d5fd0ec88464ea7656fc2ff3af75ac20cad288b4ebaa83630b3363c46062aa2c06cb6f15d5a52eb7668330a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812055, "uuid": "920c2f66-caa6-43f8-95e1-9abf8d32022b", "value": "T1B9B45B8123FC861BE1AE57BDE8B14421ABF4F407A667EB4F4940A1F92C567429E407F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812055, "uuid": "08b3ca9c-1d17-4606-ada8-f39d047157f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812055, "uuid": "7977f295-16eb-444c-bc82-b5a2876bee3c", "value": "12288:YTEgdfYIbg7Y3nHrX4XywpopqYpsjcdX:NUwHE8ywpopRMcdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627812055, "uuid": "941a534e-5e0e-4970-a197-f5e4726e7bd6", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627812055, "uuid": "05b3c374-75ff-4b7d-89f6-977252e4dbb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627812055, "uuid": "c5a7f18a-67db-43ad-b9ef-47073f39ea64", "value": "E8CA0270E68C2F29F8E9F6A77FE630A93B08C04573BDE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263d0771-f313-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627854913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854913, "uuid": "767ed904-f323-4b8f-8e48-d524d06cc839", "comment": "Malware payload (Mirai)", "value": "3b3d104d9ce90d12d3a8245e0a35ce70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854913, "uuid": "fa54bfc0-26bf-4956-95f4-db161528dd29", "comment": "Malware payload (Mirai)", "value": "eb4b7524435a7e2a93e2894bc646f9cd7082b4e8f671d799cdbcd135528291dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854913, "uuid": "d3279514-72f9-43e8-bcbd-c84d1e08aaf9", "comment": "Malware payload (Mirai)", "value": "d369d37fe04af1d44bfc6ec5131dddcc88446cea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627854913, "uuid": "90c4a430-352a-4f8a-8c4d-899b16f62b8f", "comment": "Malware payload (Mirai)", "value": "3cfbe6c9d41bf7b257f617df01fd92f7db19a7d91add5c1a0cf8eb140dabc1841da450d1312259c35117d6052b3ad5dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854913, "uuid": "742bc05d-d5e3-41df-8d73-de54b95fc628", "value": "T17BA2D0615684E0A0DB54383E8CEE84916E1E0ABDF2FE33363C5135E8399E30E35B5693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854913, "uuid": "8c5e9fe9-c7d1-4c36-8d64-5b0d2835522c", "value": "384:VzZKN+SRvuvDUkF/J2ydkY5bpC1aj0SWA5Bai1bgGhymdGUop5hu:1AZWDUK/mY5XVN918Gs3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627854913, "uuid": "b732d5f7-d829-4c4d-be80-0ed7c5ac19ea", "value": 22484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627854913, "uuid": "9a3a6765-df21-4bf2-b321-c368278ff904", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627854913, "uuid": "534bf45c-c4fc-4b42-84ba-d4478f03e995", "value": "3b3d104d9ce90d12d3a8245e0a35ce70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885c0248-f2e5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627835321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835321, "uuid": "c572c8d4-dd11-4067-9805-b7c8a6e72f82", "comment": "Malware payload", "value": "21614cd641f1b0564630a4dffe6c54e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835321, "uuid": "a9000750-e99d-47de-944b-682d7c75feff", "comment": "Malware payload", "value": "eb60897607eb5872e6ed502463d4cdcc888bce8df09352d6708c69d18b3e0005", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835321, "uuid": "964cee16-3b2e-41cc-be64-dda9384353e5", "comment": "Malware payload", "value": "af4b9f04bc93d9b1d2d3fb8a8b32ff789146b175", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627835321, "uuid": "b639acb5-e95e-4e21-ba3f-0e600705a983", "comment": "Malware payload", "value": "498a9d7bf3d26bdeef0cc1217817d126245e589df8cf037316c5b048d8d7ff4983309342379e7baabf0a7b9ae4d92c95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835321, "uuid": "342f2dfd-0e5e-4827-99dc-5e71adec0f46", "value": "T144D52373839B8CF9F857447DA469BA0614DBF98A90F11D2E005F68A6753238330F997B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835321, "uuid": "da7139eb-826e-44d0-9987-7eaa0d77ba5d", "value": "41d2505f208cfce31eb439578f9e7272", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835321, "uuid": "5f7db19e-53c1-4a7d-9ea4-26e05e890528", "value": "49152:TjJbync8SbRnTYSCePIWcQMcdAdGPq1a3EcFdR8GTkCHV/zj8JX6x/Bco7HN:TNOc8mnTqelzC4HXF7NkYrj8t6xKMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627835321, "uuid": "88eb1c50-83bd-4b34-b0ba-1181d572064e", "value": 3011072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627835321, "uuid": "72f82d03-6dc9-4132-aad4-fbc074db641d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627835321, "uuid": "fcf07461-252b-4dd3-ab08-522c721f00e0", "value": "21614cd641f1b0564630a4dffe6c54e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa58604-f314-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627855645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855645, "uuid": "ffb27122-7aea-4f10-8683-deabff050cc9", "comment": "Malware payload (RedLineStealer)", "value": "bd90d76652738c92e4b632d312e5fd04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855645, "uuid": "d3fa4d5b-7091-41f7-9c30-56cf2ee38fdf", "comment": "Malware payload (RedLineStealer)", "value": "ebc23fa946ca40b18f4193c7e616b4628c0f2c3667bd84c8d59eb24cfc3acdee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855645, "uuid": "b0e5113d-96b5-4485-b4a9-3639568615c2", "comment": "Malware payload (RedLineStealer)", "value": "7668b47e4e49e53a1cde80da42d4eda751aa1394", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627855645, "uuid": "5b95fe45-ca87-4360-966e-6cd510d75559", "comment": "Malware payload (RedLineStealer)", "value": "5302c2aa6190826b652e23317a0d4648dd715fd4cb8f66c0e3c55f24224f696df5651fc26bf94d9299787d2938830154", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855645, "uuid": "b114f9c6-493f-4019-84a7-5c878765a4f3", "value": "T1A304BFC09A90B12CF6A767339237BD502BFC2D56AEB583057B44B230AC7345A6E85737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855645, "uuid": "e86a1690-2e6f-4fbd-89a6-dd355b2690fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855645, "uuid": "7c2b092c-78ee-42a4-bdd8-a494cc86007f", "value": "3072:FMrtmmi5gzMy8IRSt8OFnE1HAK2XqcNnPEdh1sgjyYTgYi4pNKDT:FIP4wMfIRSt3nAHAK26cgh15vg74WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627855645, "uuid": "a8816e61-19a4-4602-b3a3-ba68a808d24f", "value": 189936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627855645, "uuid": "a205106d-02fe-4d2b-bbec-9510a107f52f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627855645, "uuid": "e87e4790-7e7a-42eb-b93e-b42478eb5536", "value": "bd90d76652738c92e4b632d312e5fd04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573c295c-f2fe-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627845976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627845976, "uuid": "e28941f9-9583-40d3-adbd-8de2bf1f7738", "comment": "Malware payload", "value": "39a4c90f6c31fdaef907f1e5c8a91285", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627845976, "uuid": "f6756b90-5b14-4e36-b665-6cf92ec3bcde", "comment": "Malware payload", "value": "ebe2bb78d3cbe5e419efba8eb0d6e6107e97556dadaa9323f39cc3c8c1e06e30", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627845976, "uuid": "b1ee0bdf-b919-4f49-9b27-3ca5fa0174f3", "comment": "Malware payload", "value": "1499d85e1fe02400ef38b90e2c1ead0d6a0276c1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627845976, "uuid": "2951d533-88c6-47c7-a306-f8ba7c29d2c2", "comment": "Malware payload", "value": "ce0b58de827d8398f1dc15e5bfb3de938d6681267bc397387f81e28eea702673e8443aab7fa65a0c930aa143fb1caa13", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627845976, "uuid": "d48a7e88-e63b-4df3-a19e-78f5a4a2adce", "value": "T10B35334BB361657DCE893672180F395D039392AD4AF6BC95AD262F140F77BFC2C64228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627845976, "uuid": "120334c4-da12-4e50-8ed0-3aaafca2bd15", "value": "24576:nEmWnJ1MFA2l891qJ7EvJDHnlYEQU4XPC6S98RLPQHuqR:nEcFZlwcJ+9HW/U4X1VPQOqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627845976, "uuid": "10cf87ec-1a40-425c-8fed-dfb84c1fb81e", "value": 1139398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627845976, "uuid": "e8f96592-f077-4675-b4f1-a8d480c52062", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627845976, "uuid": "25fef64f-0b5e-488b-8a36-2a83bd6d553b", "value": "eInvoicing.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0bf14e-f2a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627809450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809450, "uuid": "edeed99b-3820-4660-8223-2f876b13329a", "comment": "Malware payload (Gafgyt)", "value": "e1557d7f50e6844cd877112a5f97c77b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809450, "uuid": "9066126d-fd2f-47a1-b193-fef8e69018f8", "comment": "Malware payload (Gafgyt)", "value": "f0df587242d3574f876a32853e4c77fff350798f41d3f0aec73b589f666c37c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809450, "uuid": "c1b35bf5-2a4e-491b-8f2f-8057854bfba9", "comment": "Malware payload (Gafgyt)", "value": "32972ebe3504e270c3f25853be0e90a8056a179b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809450, "uuid": "b8f65a26-e51f-4ee7-9646-d75b428da9d0", "comment": "Malware payload (Gafgyt)", "value": "b42c96a18dc896061444d8124cb65c27a4611b3cbd784b43e253171401dce7c49fa710174892d63df8bd1028c18cdcab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809450, "uuid": "d18c211b-6261-403a-a341-1656fcc31980", "value": "T142835C49E747CBB3C88306B2029BBA664532F83B5E2E9F45F70D7CB49B124D47266712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809450, "uuid": "1dcd90ee-dfc2-4a37-a43b-eab4dbb19fe3", "value": "1536:oEma7SDXPm8VjWWHTMcqeApHgerShKW6GLdUF5MI5AtpgwsU+aHfV+mLI2VOYjX0:ua7SDXPm8VjWWHTMXLpAeUnBUF5MI5dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627809450, "uuid": "995e3f28-c472-4b4e-a6c2-0f26323829ff", "value": 86409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627809450, "uuid": "f09a7243-54f6-4a26-b22b-0d883e48c09b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809450, "uuid": "f26db37a-7ccf-4968-845b-e8285f448247", "value": "e1557d7f50e6844cd877112a5f97c77b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57e06b5-f2dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1627831558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831558, "uuid": "67a57109-057a-486f-be97-c9956469500c", "comment": "Malware payload (BitRAT)", "value": "f3aaf224ffeaa26e00a6395a3b0a80b5", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831558, "uuid": "e8f1a577-c7fb-460c-8705-a5aa2b42afec", "comment": "Malware payload (BitRAT)", "value": "f1041f8beb103e1f63fa8d5234ed3b5a55a37d1c675755040dbb08836c210a90", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831558, "uuid": "fe4ba2a5-931e-4993-b9a8-e43395e400d5", "comment": "Malware payload (BitRAT)", "value": "0bd9bb2e64578afd1a818a92e37177a01cae68e6", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627831558, "uuid": "46864f59-dba3-43a0-adf1-cebbd030a15d", "comment": "Malware payload (BitRAT)", "value": "8a2bca0e4ee17bfad46461b21055f598de2bb46b83851127dc24a990421d35bea802b4cf749b84a27f023cecd97a6acc", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831558, "uuid": "cf91a960-6e63-443e-8e9d-06998ed881d6", "value": "T1046533E15F1FE73AF6AAC83C79A62D03CC38D152642745067F5CC5BD20FE9A21885C6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831558, "uuid": "e663c0a0-d792-4afd-86a4-b5c1e2e064c2", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831558, "uuid": "a01090d5-cbf0-4376-82c9-0351c874d521", "value": "24576:UndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkz1xKWf:uXDFBU2iIBb0xY/6sUYYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627831558, "uuid": "836ceed9-b430-45da-95f5-2b093648db16", "value": 1511424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627831558, "uuid": "f04c7c2e-98a0-4067-a5ad-f1e8f373856e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627831558, "uuid": "594762be-c30b-431b-ae67-6e480d7c756b", "value": "F3AAF224FFEAA26E00A6395A3B0A80B5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee94c0b-f2d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627829051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829051, "uuid": "4d292dc5-c104-421b-97a2-385ef3040c94", "comment": "Malware payload (Mirai)", "value": "029d922272883a1cb158510b2fad6030", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829051, "uuid": "45b3ecc2-d9b7-430a-965d-c8708d26a4de", "comment": "Malware payload (Mirai)", "value": "f313076b195d4b4a610024f276f09d5cd5bb508a94d6d223049c8a2b3d6f88fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829051, "uuid": "091fbf60-5e2e-446b-9479-e0532ec5c085", "comment": "Malware payload (Mirai)", "value": "6b2216680365020d729b38450528778e2af79f36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627829051, "uuid": "0eae8db6-92bb-4842-a3df-3a029e4bb682", "comment": "Malware payload (Mirai)", "value": "2bf47ae3aa0115ea02499af4ea0bd6615cd2f2ee08c505644236db143796f58d57076b8518c98bb2eb2f47e3bef3ea72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829051, "uuid": "dddbd3a9-3fb4-4264-a70a-7edef411609f", "value": "T1C2539EA5C4AC9D98C6264678F614C839AB23A00C62A33DF6DA53C656841FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829051, "uuid": "6d1ec0c4-6a0b-4c29-937e-6f9797b76206", "value": "1536:K/ue90IlCalyZyuhx+vACs2U/SO/Sfs3zO/QSwtPlCXOi:KGejAGyZyuhxaU/Sjf+iYdtPlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627829051, "uuid": "c1a382ff-6f8c-4b4e-8e98-461f663022d5", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627829051, "uuid": "91e78768-d165-4979-8cb2-0d97ece32bfa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627829051, "uuid": "87433194-de6c-4589-bff0-e04363a797c1", "value": "029d922272883a1cb158510b2fad6030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb1aca2-f295-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1627801128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801128, "uuid": "fcc5f101-9830-4092-8970-c0d66689a14f", "comment": "Malware payload (RaccoonStealer)", "value": "d871831d36241b22b1866d434668ceca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801128, "uuid": "7bddced1-b0b4-4bd4-ba8a-8fb0ba21dcfd", "comment": "Malware payload (RaccoonStealer)", "value": "f3fcb0022c829887c912754d7b26a7c64c4c73a575006aafee3a1f0bb6f74ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801128, "uuid": "3edcc1ae-d6cf-4bc5-8d9b-52a8e138657f", "comment": "Malware payload (RaccoonStealer)", "value": "9338743b26d46e47a80cca66663f183bb735f5fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627801128, "uuid": "55059f5d-f481-4bbc-b776-d94a39ecb223", "comment": "Malware payload (RaccoonStealer)", "value": "e2510d1cfbd2af126019fcf09c6a53e4764c4b2e385ee54f3efab624a9840c91d9e19e20aa79fbdaede3b8e9cbc87c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801128, "uuid": "e2856cb2-5c0e-42bc-b52b-655b48084d69", "value": "T10054AE30A690C039F4FB52F445BAC3BCB92D3A61576451CB92E55AEE52346E8EC3039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801128, "uuid": "1514e68d-6cdd-44b5-9b1e-5d44c6a146a4", "value": "3a882b0a906e4a3ae01bd3c1a3fc4b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801128, "uuid": "41008b2a-99a5-4fc2-aa29-ddac5c726e05", "value": "6144:yBHLXlIoktRtc53lY60EixJsYqDFq67godEBQn2oa/w:sLXlIzG53lYtvsj060oeBQM/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627801128, "uuid": "24959521-07db-4ee3-9944-aa63dda8eedc", "value": 298627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627801128, "uuid": "f472bd6e-266e-4539-8615-7a4881c62d80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627801128, "uuid": "4edd97cc-b59c-499d-8875-6ae1510e875c", "value": "d871831d36241b22b1866d434668ceca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3468cfd0-f2ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1627846347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846347, "uuid": "5f0bfc2e-3d5a-4924-8d3d-9550ca417de0", "comment": "Malware payload (DanaBot)", "value": "10f49a80de7e85fa33959da15d393f29", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846347, "uuid": "1c17a4c7-aecb-45a8-b4e3-7369655db674", "comment": "Malware payload (DanaBot)", "value": "f5fe7311025d620bccb08dcfb69f03c71620351b35ea8635b798ffc62374423a", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846347, "uuid": "6abb077e-ac3a-4834-8ff3-06980e702853", "comment": "Malware payload (DanaBot)", "value": "4c01b7fb9421818af469b46355603a43fd2339e3", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627846347, "uuid": "70faa1ef-4ca8-4070-8fce-f307293b9564", "comment": "Malware payload (DanaBot)", "value": "231f80babe4c7a4b62a5ffa4d23bb790da6d0c0d6d769ad9b63ce6e1cf5950e10e38afc898d2c1ae4f08d088b8483bd8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846347, "uuid": "d0f11590-e9c9-45a5-ac05-57f72e51a3fa", "value": "T1D7452210FE90C875E2512A3014A2C7A25769BC35666981035F6027BB7FF33A167BAF7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846347, "uuid": "fe37cdc3-89d3-469c-9d99-e9f84ad1885b", "value": "11bc5a96dc8b455509d3ea367d443d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846347, "uuid": "95907079-5484-475b-89ea-bf426828ad5a", "value": "24576:BmAFA8YMYUXozd7t7JaHvvHIpXQ1QVmC19XJ03hWWN:Q0A8R4htdYvw21Q950", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627846347, "uuid": "51c23f81-8d57-45e7-bb81-c2b615e9971a", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627846347, "uuid": "5568ecf1-404b-4ec7-bd24-9e42fc5ea636", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627846347, "uuid": "d2f1d34b-27bd-45bd-ba06-ccd8c0dbfad5", "value": "10f49a80de7e85fa33959da15d393f29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1f98ec-f30e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1627852908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627852908, "uuid": "a07ae45b-c1fa-46f5-8bb1-c1a60ac872c0", "comment": "Malware payload", "value": "b1ec396b8bc4531c21ea80ccd4178507", "object_relation": "md5", "Tag": [ { "name": "PowerShellTCPReverseShell", "colour": "#9AB3B8", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627852908, "uuid": "749dfe4f-4832-4cd1-88fe-498f4655d844", "comment": "Malware payload", "value": "f82c9e4205b85ea574128ba2015208ef2d75b18b628361cdc6492100101ee0dd", "object_relation": "sha256", "Tag": [ { "name": "PowerShellTCPReverseShell", "colour": "#9AB3B8", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627852908, "uuid": "11ad726a-06b0-497a-b025-9533937c4b66", "comment": "Malware payload", "value": "ef80c8e65ac14e07b600d1b25f66412a74ce0cd6", "object_relation": "sha1", "Tag": [ { "name": "PowerShellTCPReverseShell", "colour": "#9AB3B8", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627852908, "uuid": "a686be39-94a5-4016-9846-957b1e518f5e", "comment": "Malware payload", "value": "bccbdd425162ab5499e0ec4d52f1181fc226f5e56c63fa912d52ca3a9effbb8f311af4a8c0dcf728782346ad8e7294bf", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellTCPReverseShell", "colour": "#9AB3B8", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627852908, "uuid": "5dd6e1fa-de78-449d-a6e9-e85f5db4b59d", "value": "T1E3014E90EEC9A76D4100378A8466EF8CB0B460263207995236CEC9EC844DC5867742A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627852908, "uuid": "7fe24b06-88d2-40d7-a657-235f1a76dac5", "value": "12:CwmohgZhBifeLW4UxiJyORfE7yARzgxs0hHLknpHbnu9YMQXcBXe74txi64:FmorfeLhUiy+fE7JRzjcLknxbnMY38ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627852908, "uuid": "abc115c0-3fb8-436f-a27e-7f5378363056", "value": 686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627852908, "uuid": "8e3ec334-a7df-4032-b1c8-5b8bb10ff956", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627852908, "uuid": "36c81c25-a6f0-4ee3-af96-27faa280195c", "value": "jcfwG33C.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fda7495-f2a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1627809456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809456, "uuid": "c7c20b5a-860f-45e7-b9ad-a293345de88f", "comment": "Malware payload (Gafgyt)", "value": "b5220cee2b5177a57a6cae86f353c373", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809456, "uuid": "3fca6ba4-e7f7-4658-a6db-fda4b40991c1", "comment": "Malware payload (Gafgyt)", "value": "fa53eced46db3af5eef3444a85ca04a7f7997c70adc28d6127a657fbe5848cdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809456, "uuid": "81e9f13e-e24f-4610-b566-d11b81eb60a4", "comment": "Malware payload (Gafgyt)", "value": "06214d9799ca5d8333d057139f1481b0c9653dfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627809456, "uuid": "ffb81f86-e29d-4632-a6dc-1301ef9b57e3", "comment": "Malware payload (Gafgyt)", "value": "2beb348c3541bd2691817eefed34b6b4d8d67333a9475b2989e99363a8724278fc1b63a921760bd6d001215c095e9030", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809456, "uuid": "73637d75-9abe-4eb8-a10d-d7b84ee4e7ed", "value": "T170C32905E8918767C2E217BAB79E425D33332B6893CB33255938AFB41BC1B9D1E79131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809456, "uuid": "6297e46a-ba35-4809-8444-a4f7bd8b51cf", "value": "3072:Fdce4ah2KVXPi4jvIx+RwD8JH5ZmTQOIsXAqE:/N4ah2KtO+RwDmZmTQOICAqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627809456, "uuid": "2ead8d79-cec9-441a-9c26-0a72ddf4213e", "value": 127529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627809456, "uuid": "0bbfce49-71bb-4ac1-be07-3e76d38656e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627809456, "uuid": "67def4b7-561d-4f4e-8b02-5803e49ccf72", "value": "b5220cee2b5177a57a6cae86f353c373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6b9565-f2c9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1627823199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627823199, "uuid": "f197a937-8eae-4d24-a924-e8534dfee168", "comment": "Malware payload (ArkeiStealer)", "value": "07c35d9283746f816056ba7f4dea056b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627823199, "uuid": "be208419-f3e1-4497-8ba7-87fc7c0be3fa", "comment": "Malware payload (ArkeiStealer)", "value": "fbffacfd342e10055441feff193d815000e7111d5c1bd4c26ffc732d66ce5268", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627823199, "uuid": "b9c8588c-170c-4d09-82cb-589c7f4ad9a0", "comment": "Malware payload (ArkeiStealer)", "value": "0f6b1d78d6b152762238fb45bb99f9ae79536667", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627823199, "uuid": "3b29d49f-1455-4fcd-b32b-68626074a1f0", "comment": "Malware payload (ArkeiStealer)", "value": "9a77cec6337e1d6823cff14e85f094b2c912c2377808990f3e69c6adfffa93fd42ea1657b8ad9fe167848ad582680487", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627823199, "uuid": "57f3f759-f61a-4d60-86e1-2eaf59d175ed", "value": "T115D4029AB3AD15D7CC1E6330972302B39A710D13798B9BD7D9A432580E7BBD53A0E487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627823199, "uuid": "cdd7acbe-796d-4120-9eb3-95788cf6157a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627823199, "uuid": "5313ae11-9d8d-4468-9843-b9c97f5a6c49", "value": "12288:ExOZuX86JY1oowOZ6XxAiVrjJgostVxOnF6gHJKxXon:Es8XfeXv6T7YHEnFfHCXon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627823199, "uuid": "746b98cd-4c9c-4faf-8119-d7d603663a65", "value": 632000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627823199, "uuid": "81717400-b1cf-49aa-8d45-348304384d6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627823199, "uuid": "66ae9a5c-0765-40c2-839d-a5170be0a0a8", "value": "07c35d9283746f816056ba7f4dea056b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6cf8e0-f2d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1627828810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828810, "uuid": "0376faf7-f965-4085-90fa-aaf08fb0a989", "comment": "Malware payload (Mirai)", "value": "179a1266622a3c4155ec3c423f68bbe7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828810, "uuid": "e9a7320f-214e-4e1f-8fc7-dc4b34f28afa", "comment": "Malware payload (Mirai)", "value": "fee6ac80ed74fd0ec315623c07698ca04175c413560f7d4e36d6667c552660de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828810, "uuid": "385bb812-bfca-416f-8674-c609ca074430", "comment": "Malware payload (Mirai)", "value": "c9a7bea2dcf8b1c18fb6124119ba633844fa311c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627828810, "uuid": "eea29d79-56d1-47a9-b175-ad0d24759bf2", "comment": "Malware payload (Mirai)", "value": "7b1be3e138c1d6bc5e7d1eab7e4f446fd267e97553cd3a6654789579d0fb372193238c7920eace85284a6e5ba240554f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828810, "uuid": "b8196643-20ee-4863-94e0-1cfe20e89f91", "value": "T147831981B9809E15C6C5177BFA6F108D331247A9E2DEB353CD145F6477CA82B0E37A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828810, "uuid": "5ac683bb-4f68-421e-92f9-1ab94f7ddb06", "value": "1536:29n7/xkRBFg3yFhk20WtEu+1F4YPjaduBcPYO9mrsplDKZUlQBKXAVan1X+F8JyI:gJTyHknWt/+L4qjmugd9mrsplDKZUlQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627828810, "uuid": "dfb75b5d-9135-4df7-970d-d8fa686351a9", "value": 83072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627828810, "uuid": "b43a700e-cf06-47ac-9d2c-20287d596d3c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627828810, "uuid": "2f183e0e-1db4-467e-8525-c4ca8d996bcd", "value": "179a1266622a3c4155ec3c423f68bbe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }