{ "Event": { "published": true, "date": "2021-11-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-11-14", "timestamp": 1636934581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d90ab7fa-be8f-46a0-b397-be77bd606376", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebc405d-44e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636850548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850548, "uuid": "b394ddc8-8267-4114-8026-b8c0c8244c0a", "comment": "Malware payload (Mirai)", "value": "1069fab84bf4490be432254273b260ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850548, "uuid": "b04a8201-fa68-4983-9396-374732231d65", "comment": "Malware payload (Mirai)", "value": "00d8cebdc8575943f3baf5fb212cf6c3434c623a05367a075cd38253a1c66cd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850548, "uuid": "0a6ad811-e174-4592-822d-ca7a3867b545", "comment": "Malware payload (Mirai)", "value": "3c2fa567ab8e36c3808bf6e3d2f4a5a6ebe0603e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850548, "uuid": "b27f8e7a-dfe1-483f-b9a3-37ce6dd3db7a", "comment": "Malware payload (Mirai)", "value": "fec4007f494b5c0f0d4c557c46246782eb699519fcd84e820937bb9267c06a75132fc73c22096de2e9f2f23c1629ceb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850548, "uuid": "60422dd7-b8e0-47eb-a080-f765e4cbc48b", "value": "T109145D42E9418E13C4E30BB6BA9F105E333167C9DBCAB2128D195FF437C9A8E4D66719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850548, "uuid": "611ba814-fd6f-4e91-8abb-aefd74768a3a", "value": "6144:lEpSUGTTv0+6s4X6chYKpYpg2bJSM/9HdL:mpYYX6chYKpYCi7/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636850548, "uuid": "65f60bd5-0f9e-4ad8-a5ad-8697dd724454", "value": 204531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636850548, "uuid": "8b90b4e4-4389-4cba-8dff-6d118b2fc686", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850548, "uuid": "b984171a-6224-4936-a0f4-71600dd0ab50", "value": "1069fab84bf4490be432254273b260ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5a3848-4549-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636894410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894410, "uuid": "155c3db3-d0ed-42ec-880a-e01435190ae1", "comment": "Malware payload (Mirai)", "value": "b53de9481cf7b89298c2a7dea8788838", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894410, "uuid": "b1b49151-564f-48e7-a9e2-cfce7c089334", "comment": "Malware payload (Mirai)", "value": "0102dae1350a0a64353d5bfa6913ee0fe9c92f0b741cb421291ef13aa00b43f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894410, "uuid": "bcc325ad-3c0a-4cf8-bf2b-8c43e9446c76", "comment": "Malware payload (Mirai)", "value": "e933ec2175d182ec4b3dea7fe055bb1647721b46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894410, "uuid": "739463d1-6215-4f87-9e44-63ed5005ce74", "comment": "Malware payload (Mirai)", "value": "f2c123a7f4d07db4771800ffe4318e170ecb45cc968620c25ffa85eb8548aea52d4254880ffe80c6c209fdc98250e33e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894410, "uuid": "f4e98a9a-ec60-457f-8051-d6177196bc5f", "value": "T1F1B2E18486F706C3CD947271D6CC4BDAABF2F56813195B734A2BB28B67C26061789385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894410, "uuid": "e66c9544-ec97-49c6-b26f-3d7a56c00fb5", "value": "768:w/QOC0Yhn6RODyFF/B3s3ZVITtzVijNeaco4oyLKxw:w/nihnuFF/MctAgoXyL+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636894410, "uuid": "a9587819-c87b-4831-aa70-bbfcf8e8ca31", "value": 24892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636894410, "uuid": "bea4c0c4-4ff8-4143-a5f4-22cca9dd4d03", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894410, "uuid": "83bc0bba-f0aa-44ab-b493-e03510707014", "value": "b53de9481cf7b89298c2a7dea8788838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d554ad9f-4510-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1636869914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636869914, "uuid": "e008dbfc-98df-4569-9f39-83e46383ecaa", "comment": "Malware payload (CoinMiner)", "value": "6e81ee45317cc2ffa45c2f4a813ccc1b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636869914, "uuid": "b89b44fb-6bfe-44c8-ad83-696d25687545", "comment": "Malware payload (CoinMiner)", "value": "0221c396bd17917621bb6bd04a09a07e5e00389c25677bb3af7170cb858a9ea4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636869914, "uuid": "23a6f4dc-6924-4576-89c2-1ebe0444afed", "comment": "Malware payload (CoinMiner)", "value": "12fcde386b0d049af667a32008e5dfa48066a901", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636869914, "uuid": "447e67ad-f83d-4a06-82de-25718d113af7", "comment": "Malware payload (CoinMiner)", "value": "77d893137fe27c079fd1099d00f0ee1a97b9b8c014fd9e2f109dcc1bb809bfa3df814ab32e65ffdf613699d89d975de0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636869914, "uuid": "153ccbc5-0f6b-416f-a41e-42cf6fe45171", "value": "T1919533639E95930CF87C1133B0820D02AB943B5185E0F31D6CCA5BB9657AEB5EFA0D9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636869914, "uuid": "9a452a10-a289-4160-a2bb-c1f975910f97", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636869914, "uuid": "8a85f1f1-139a-4d69-ab38-6f0f8719695e", "value": "49152:9jZPYdDZPBHMWy8SYuMwc8YzzCkO7Du7lNXNi8U5zD9QabN0K:DaP6Wy8JwcDzOvu5NdiDdG20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636869914, "uuid": "6643b353-8b8f-41b5-9bbc-a41f69228c35", "value": 2045690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636869914, "uuid": "e290c183-bbda-4bae-9d62-ebcd2ab8ab2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636869914, "uuid": "ceb2afcc-967c-47e5-8107-47b0409ead8a", "value": "6e81ee45317cc2ffa45c2f4a813ccc1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3533fd2f-459d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636930204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930204, "uuid": "7d5e988d-70b8-45c2-9e42-ec4e4d7218a6", "comment": "Malware payload (Mirai)", "value": "1f10a20a0ab4e9065f089a7a208c2c61", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930204, "uuid": "02c0e3f1-34a3-4581-8d08-6f3900710c63", "comment": "Malware payload (Mirai)", "value": "02d7fcae005e84676d71285aa3cb7e7654082279fe5b6e3f979ed13e94da183a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930204, "uuid": "197d048d-fd8e-48f7-b620-6012a6587cad", "comment": "Malware payload (Mirai)", "value": "7113eb1ab49e1d0b7cf7f3ea3af02077d5e22979", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930204, "uuid": "a9479f6a-6849-4bc1-aae1-360e8527b1d3", "comment": "Malware payload (Mirai)", "value": "2e4a5ec67e887f150ccb81520bbd70cdc7567084c040d8e7af280110f72bfd8108477ccc57708e62268d4ea28efe82a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930204, "uuid": "988439c1-5739-4091-8d92-156fe06ab20a", "value": "T15623F27071DAEE30D262047EE820CC95B29F17FDD6DA9173BA48579419B0412B9ED2F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930204, "uuid": "c656cf7b-ee1f-42ef-a5d2-1c659e7742d8", "value": "768:YZPbYi0j3gaOGYK/ulJjTvFM8H3mQNp59PYUI8q9lcCOAcf0s3Uozc:YZ2U+sVH3x5GKq9GRAcfRzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930204, "uuid": "fffa074e-13da-4709-ad7c-e59bcab0fa30", "value": 45676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930204, "uuid": "7187874b-2bf1-4f79-80c7-aa3fcd550914", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930204, "uuid": "f66d7799-7d3c-423b-83f1-001aa4bf1946", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67966a32-44fd-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636861569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636861569, "uuid": "a9bd9d8b-e4fa-49d5-a064-9bbbaba13e93", "comment": "Malware payload (RaccoonStealer)", "value": "3d64f1b5af7d75994fb3dd11b3b175e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636861569, "uuid": "bd86090a-6b38-4ccf-942c-04caa5794327", "comment": "Malware payload (RaccoonStealer)", "value": "036084777111f92e772c3f0e3375b7a671953536f5526c4850264f8b723e337a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636861569, "uuid": "9b690926-fb8f-4d81-ba51-dd10aa35ad2c", "comment": "Malware payload (RaccoonStealer)", "value": "3694f8b7802d2d447b3e515653982458b61475d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636861569, "uuid": "ba742e37-6c76-41f4-a090-fb8c46993848", "comment": "Malware payload (RaccoonStealer)", "value": "43552cb7c7a62261c0d8da6b9d74e476a7f0a57d018642880a2769df8fe3bdee7ed263e5b1007d384bee2140c9409b4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636861569, "uuid": "a231f6c9-9644-4a6b-b89d-87de21917331", "value": "T1F3A401017AA39C72F58639342DA4C7A19B7AFB325833514E27602E6E1EF32D04A76753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636861569, "uuid": "4b723275-267f-49fe-9888-c2e0218b885c", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636861569, "uuid": "200add89-fb67-4545-b57e-17c53da28399", "value": "12288:JwmXoeSGt3UdV9/RO38lCm9yqXbLF/EQGHWHY:+4SYER/zlCKbOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636861569, "uuid": "354eddaa-50b4-47f0-89cd-9bda849853be", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636861569, "uuid": "c43a7c2b-5fac-4bf0-8984-73a1404500ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636861569, "uuid": "92432cc2-c493-4ea3-9bda-519f55efb8a0", "value": "3d64f1b5af7d75994fb3dd11b3b175e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a24887e-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (TinyNuke)", "timestamp": 1636874351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874351, "uuid": "18bf2995-14a7-443b-a801-1eac1792e760", "comment": "Malware payload (TinyNuke)", "value": "be5c1be0364b3ec5644e1ae66fb1438b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874351, "uuid": "538cd0bf-1c36-4d06-8d79-50998943e4f6", "comment": "Malware payload (TinyNuke)", "value": "037a1190ff15e3ebf4a05b0bea403cf39a93209089894aa6d8cfb46e0e508cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874351, "uuid": "782c483d-16fd-4e2d-b2af-552a0ad9456b", "comment": "Malware payload (TinyNuke)", "value": "c1277d11efdf1b6b0ed251b748f34ef25ddfd3aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874351, "uuid": "9a4f75be-99af-444a-8054-f729c7cf95f5", "comment": "Malware payload (TinyNuke)", "value": "7f3df00f562578514de818021c5376e3d116cc7c0bf1b45d4beea8b7732af0e3086fc3aa80ae16de31112d082e2afdda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874351, "uuid": "72afeb13-950a-4dcf-9b7f-ca33c268e16e", "value": "T108152801BBA15028F9FB16F959BE70789A3DB9E11724E0D762C42AED8624BF47C30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874351, "uuid": "b59e2bbb-f4f3-4532-93e6-6c855f7de93c", "value": "30c6fecafd22fd830d6018c7ac5f43ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874351, "uuid": "d525918d-3180-4dc7-a17d-510aec854650", "value": "12288:LiKrwWDNiieuuBDT/p0GrW5hnHh57Tkp1wRlZ+:n4zW5hnHh5nkp+RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874351, "uuid": "67f2782c-d153-4ef2-a0a4-7d7dcee8ccc9", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874351, "uuid": "46ad2741-2977-4ad0-8903-f28c3a0b64e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874351, "uuid": "a43511e2-53ae-4cbd-989f-75b1024c8d14", "value": "be5c1be0364b3ec5644e1ae66fb1438b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbe4742-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636874411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874411, "uuid": "1b8cd85f-89d1-4d24-ae07-92c3f2299d06", "comment": "Malware payload (RedLineStealer)", "value": "a70df5f0cab9a6a58d218fb4f2ef9aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874411, "uuid": "3166b8a8-553c-4df4-991a-5d894763df96", "comment": "Malware payload (RedLineStealer)", "value": "0384bc178166e6c703d82b4b0c976a697c6ccc9e9c679ec8c5485f45bc4e057b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874411, "uuid": "80a387ed-f832-4471-9bbf-0f903142d34a", "comment": "Malware payload (RedLineStealer)", "value": "d90bf3b4493e6ad834293ea1549e26e10325479d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874411, "uuid": "b28d6871-29dd-4232-8471-0ae77494006f", "comment": "Malware payload (RedLineStealer)", "value": "ad0c91ad3e47a571cf008f6d0fd62d571fcb31885671a4057ea8debd89645ae4d5cfbc56cb804a9fa3164298aa130300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874411, "uuid": "2d58ad13-d317-4200-9acd-9e5a93f8e965", "value": "T12FC52317AF89A62BCD2FD3311A870B02F338E5611ADB5B13799C81352F723C09D1EA95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874411, "uuid": "6e4d6570-078a-48d8-9031-1c69824f364a", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874411, "uuid": "f6c441ac-2bcb-4126-b341-70ac0fa35695", "value": "49152:CeqVcjodaZk4jVxDq1wFeU1WImK4kCHAyApM9EaCSwLt+xQyQMzhWYYOu4+:CeZQUvfEI5wIm8Cgyx9lg+xQr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874411, "uuid": "81777ebb-48aa-4601-9c1e-b378193b03e0", "value": 2687672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874411, "uuid": "9240a7dc-321a-4166-a27d-04ddf44a1b96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874411, "uuid": "6e960fa1-2e1c-416e-9cef-111b9b331861", "value": "a70df5f0cab9a6a58d218fb4f2ef9aec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b654a644-4509-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636866855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636866855, "uuid": "4bfa09d9-49af-4c48-8840-8a9dea189278", "comment": "Malware payload (Mirai)", "value": "61f9e236a0d2a98e17580ae3decba3ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636866855, "uuid": "becdb626-f8fd-4630-b3e4-56b11f0e8c1e", "comment": "Malware payload (Mirai)", "value": "040246037993a8d3a6d8fe8363e854e6159f20840ba6d03a9483891ec206661c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636866855, "uuid": "d18f2359-4386-437e-9965-33b18f5a00ff", "comment": "Malware payload (Mirai)", "value": "2895e6000bdb0c381613cbc2b9cff8d0102a891c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636866855, "uuid": "5875b5ef-d011-417d-920f-c491bc9db8fc", "comment": "Malware payload (Mirai)", "value": "41d1ab00538450298e99087aaee65fe27bb61f18843e7c3f3e0223ad5fcff229bc0750dba12203c10ab82818561357a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636866855, "uuid": "265cd993-9f73-4899-bd56-419ff55688d1", "value": "T184C2D070050975B1F5B08875F728869E3A0657F9E3AFB1B7264F5B3CA8DA0017872E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636866855, "uuid": "f4f0cfe8-7364-4b09-89ad-d60237eaff86", "value": "768:WK/7BdJZz2ZP+EajKLohMgwqwbWs3UozYU:WC7BnZz2ob2/gWvzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636866855, "uuid": "c9c72c85-68f7-4004-99f9-216ead527383", "value": 26268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636866855, "uuid": "ae5cbbcc-f476-4ad7-b1b3-8a669be42679", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636866855, "uuid": "79b32b53-cfc3-422a-88fc-1c0e15b66ff4", "value": "61f9e236a0d2a98e17580ae3decba3ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bec988-454e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636896223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896223, "uuid": "66b21dd0-ed1c-4fc1-bafb-8991b98aafd6", "comment": "Malware payload (RedLineStealer)", "value": "9754ec8f2ce3f36f0a6109e9e133de0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896223, "uuid": "5f1a5d2e-fb63-485b-899c-7cbf833fefe6", "comment": "Malware payload (RedLineStealer)", "value": "0453f9ed4c91eced248cfb6259286dd3a908dc470240dfae4ec4f41b68b9bc29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896223, "uuid": "4f5ed17c-7756-4a27-aba7-049defb18249", "comment": "Malware payload (RedLineStealer)", "value": "b480383e43440e6dd25c12c223c4dc0aa1a2c3f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896223, "uuid": "a4775dea-0dbc-42c8-8250-539ef9e1686d", "comment": "Malware payload (RedLineStealer)", "value": "48af3d5f27a366129e301d595b2a02ff1ae8b14347ecc8548ae838feeb528eafd0847a5c3418a5721d31cc4bb79303c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896223, "uuid": "16f6258b-cd08-45bc-8c88-77b90c980724", "value": "T1A26421323E04F61991B32D3393CF7A12CFDA1BA15E3659873F489B161151882ED77B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896223, "uuid": "211bdf32-e435-40ec-b829-33770ce34392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896223, "uuid": "c35c6865-e51c-479b-b661-6060caa70f03", "value": "6144:EHBHZl3bl7sgTPPf46DMC8svXqnCWUlEw5RPYJqo:EhJ7sgTPn46DMC8svaCWUlJTPYQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636896223, "uuid": "5b5f223e-46f4-47a8-961a-cebf5928e457", "value": 332184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636896223, "uuid": "666ed871-320f-4e1b-b00e-a5941c64394b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896223, "uuid": "75eeb794-f66a-4572-ad22-001af97daf5a", "value": "Fivem_Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a78f605-4565-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636906295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906295, "uuid": "86c05bdb-d4c8-47c2-bee7-3fb9ab0504c6", "comment": "Malware payload (Mirai)", "value": "cb58cda7c9afa39685be3f32afc0f334", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906295, "uuid": "8770d2cd-2d37-4c6b-9378-709e23f0bd46", "comment": "Malware payload (Mirai)", "value": "05614630381eb4318e8ec314b85bef4dda8b3e9254272b363c70b2318b019b9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906295, "uuid": "86e30d6f-d1cd-4d9e-b47a-8c0db0ad4b4d", "comment": "Malware payload (Mirai)", "value": "a89f2c49293c1c4c3224679cbe1789a44a651ebf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906295, "uuid": "a4d97201-4587-447b-8917-c28f8f5d0768", "comment": "Malware payload (Mirai)", "value": "dee3ad40c8fd33c439405a1ef356b75d6ad56f96c87e7d362c29976fd2fc34d9f59d6d0b65665b982abb352e7aedd9ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906295, "uuid": "b8bf91ee-e94d-4233-9ad3-14e1eb4a2582", "value": "T10AC2D03E620E6565CD15A9B556300FA030770FFA59C7EC8B6782C7EBDE460756806B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906295, "uuid": "c14a91db-5da8-48f8-b938-3d4fa8c52157", "value": "768:lfczX2Kwqr1APFFVv3+BabRmlW1WTVl9upXbTBJgGlzDpUYsa:l0nwKwfvuMbARPuVfTVqYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906295, "uuid": "1ecbce33-5c93-4a08-8fc7-88658d0f7e75", "value": 26324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906295, "uuid": "078c692c-64b9-4015-9d0d-4fc902a78012", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906295, "uuid": "49debd52-30d8-420b-9e9b-09ff2d80353a", "value": "cb58cda7c9afa39685be3f32afc0f334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1259ad-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1636874356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874356, "uuid": "c3f122af-e351-4ecd-ac09-6da61c78d248", "comment": "Malware payload (CoinMiner)", "value": "85ef0b629318f502fe3602ba97de74b3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874356, "uuid": "ec45a734-3379-4c31-a125-89ba50d1346e", "comment": "Malware payload (CoinMiner)", "value": "06a2134339a6ff05c2a61e3f796f1c192e9cadc13f8ba5a600e538e89f6c7e4d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874356, "uuid": "7bf9b1d9-bfc5-4357-bf35-7033a05af23d", "comment": "Malware payload (CoinMiner)", "value": "3e0b1644ece53570e0bc5ff4510ee47709507632", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874356, "uuid": "c436648f-d6cf-4715-8f1a-70198305715d", "comment": "Malware payload (CoinMiner)", "value": "1c80cbad4d59962f5ef428bcaa09e446b9a5d522befeb31b02677302e3bb165996b34f3a5c0cf378c42340b6ef95af0a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874356, "uuid": "e47bd2c2-dd74-4013-b13b-7781f820bd84", "value": "T13E8194E3F6AADD3DC11305722EA243253BB183A331424A8EEE9D50FADF42C41640B34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874356, "uuid": "4cafd2a1-321a-4955-8e18-5481f7148434", "value": "4bfde1223391e32fec766cd1d41fa3e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874356, "uuid": "89f4b2b5-e84b-4254-b001-e8af87833930", "value": "48:6ft+ZzWsJ6QU71lWDT1Pe+EqKq3Zv8B13aLlzUR:XZzlgQUhlMT4+1vpkv3aLlYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874356, "uuid": "c3e52d9a-161f-4309-a836-20fe937b1075", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874356, "uuid": "73cc0fab-e641-45e0-b4cc-bc0addc22d4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874356, "uuid": "c5d2ce0f-ac9d-4b41-9489-8566533994ab", "value": "85ef0b629318f502fe3602ba97de74b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781850c3-4513-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636871046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871046, "uuid": "d36a21ba-51a5-41ca-a86b-521bfccdc15a", "comment": "Malware payload", "value": "9e2feafe48e740661095d8710d53ae20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871046, "uuid": "0606ae76-1018-4286-a3ab-7548e6bd646a", "comment": "Malware payload", "value": "06b9c1418f1db6092d2f85eed6f479a667e4901accb6bbe789545c247d588232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871046, "uuid": "ea61c60c-ff81-4d87-919c-3c412e6d551f", "comment": "Malware payload", "value": "612fa3b42129e91023c7e78c6958b64565da20d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871046, "uuid": "8005e681-5590-4bfd-91e3-2da689a7bb76", "comment": "Malware payload", "value": "14f30c6652f4f6ed65bf224e19d094e8cbfde7f3d117c259aa2b35cb936d9ce7feb4fa81a830ff684d82c2ed0cc99754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871046, "uuid": "6a1bf54c-f528-48fa-827e-384f39e591e5", "value": "T1897411437D5DF75C92622F7386CB5A158BABFEF34B3298C71F089A061551A016E2333A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871046, "uuid": "376e2062-dd54-458c-a626-11274c2b6941", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871046, "uuid": "1b6e55ed-f6ce-4d77-bb71-a5f041805bff", "value": "6144:KzTkJm7onrzb4hcsO61vfn0EG2c6Uuq8RQsXKmmnjQ:KzTyNL/40EGB6gUiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636871046, "uuid": "82561c14-7c92-4650-bdd3-57808c3de8db", "value": 354712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636871046, "uuid": "c68432eb-2aa6-4d4a-a642-ac3a480dee7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871046, "uuid": "46aaa400-9f35-4f40-b925-47cce6e4464f", "value": "EuphoriaH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532c6ff4-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636874420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874420, "uuid": "fb97211c-87d2-4e6d-b336-9bc795452663", "comment": "Malware payload (Smoke Loader)", "value": "f3ddba1c79ea1bb09a30f65aa724a960", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874420, "uuid": "cd2b3031-5d58-41eb-adb9-aeb9b32ed7a6", "comment": "Malware payload (Smoke Loader)", "value": "080de1bd51c868a932115e72a7827a3a20bfbca886e312b58e011f31f09d34be", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874420, "uuid": "c44bef49-6dfe-4dff-a2cf-94b08aa48598", "comment": "Malware payload (Smoke Loader)", "value": "432ff51db3f2706b39304cff9e48a9f5bdebcc8c", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874420, "uuid": "900409bc-f16e-4ba1-898f-c05272b46e60", "comment": "Malware payload (Smoke Loader)", "value": "ec072a9d4be1f881776d470c1bcfa06659ae8b63805a00032d5270b968be67ff704769961755a50bccb35917d25c4bd1", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874420, "uuid": "0dbb48e6-22c5-47c3-9ef6-92c0935090c9", "value": "T1B6649E00B7A0C435F4F756F849B693A9B93EBDA1AB3590CF52C526EA96346D0EC30713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874420, "uuid": "f0989fe7-006e-4977-b007-e17a49332afe", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874420, "uuid": "c077f6c7-1f41-44ba-921f-59c09566c179", "value": "3072:ZjVs0aydpyGWpcldDKlHA+q2OLF99xPqetKwnZ0oLGCMDyRbLlmRD/q/Dw6Pd/Es:PP1Kls2Ohzx7DnZ0sGCMD+by/qpd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874420, "uuid": "037b6c80-fce0-4e6d-ae77-9d6c9c73e5fa", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874420, "uuid": "6adab1d9-9d9a-4064-a042-f3bfd3d6a9eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874420, "uuid": "a1c986f5-c1aa-4dd6-ba03-bf149ff174f1", "value": "f3ddba1c79ea1bb09a30f65aa724a960.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6999ddc-4546-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636893055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893055, "uuid": "5ad2fb93-fc59-4637-ae71-2731d7d106ec", "comment": "Malware payload (RaccoonStealer)", "value": "423d618d3941ceeb6ec059b8abc88249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893055, "uuid": "b0d298b5-f2d0-4e6a-a0f2-aca6cbb01b22", "comment": "Malware payload (RaccoonStealer)", "value": "088408d4521923335a966f44b2cb47e1303db2fd804b9e2df4404919d535dc11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893055, "uuid": "c8c362f5-2ea0-4709-bf7d-08b7b8ba52c5", "comment": "Malware payload (RaccoonStealer)", "value": "d5d1327accbb2de7b022cfa227461c949590c956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893055, "uuid": "fa4af757-abd6-4d11-9dfc-f42f56c60c04", "comment": "Malware payload (RaccoonStealer)", "value": "d637aac2616d9036fc89d5eb602cfe0bdd757fa07912e7d2b54dba1abd7c77bb9403967f122b2105e98d2400c914fe8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893055, "uuid": "d5382078-9927-499d-aad8-1573e13437cf", "value": "T1F2B4F0D172D2BE76E0923E30A461CBE016A7B871E5A05512F774B76E2DBF3E04662343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893055, "uuid": "c3dee9cd-4799-4f11-be5c-c88e2f30c879", "value": "d6f1a2cb84dbc438e72cd46aa17d4119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893055, "uuid": "3e44af70-02da-45ae-bbfb-8b107b845289", "value": "12288:N/SBLIYPkcr6kYvYLh+5VHQNbqtw8zbNWjC93Uo79:NqLTPkcr61vYLh+VHQNbywwWjC9ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636893055, "uuid": "6c2e726a-d2aa-421e-814c-c19022e05fc1", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636893055, "uuid": "e177dca5-38e9-45b1-ae9f-4401ffdad216", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893055, "uuid": "721edb45-db60-49c6-a960-ab7e8e4d6c12", "value": "423d618d3941ceeb6ec059b8abc88249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b185c02c-4509-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636866847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636866847, "uuid": "a6bbe679-4f1b-4e19-a695-73450bf08c5f", "comment": "Malware payload (Mirai)", "value": "9226c0677ab0d84d5f10a3bec13fcd2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636866847, "uuid": "85704767-c7e3-4421-a9e1-cc369fc7c943", "comment": "Malware payload (Mirai)", "value": "08ad05d672da6b30a589a547b2e8b0658b558a58212d88082d92a8c84add1ddc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636866847, "uuid": "ffdbe7c1-b9ab-475d-b9d4-4d017447b7f7", "comment": "Malware payload (Mirai)", "value": "d1779d5a727ab9ee29b68a8253f5a067c44ed2bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636866847, "uuid": "93307c63-18b1-45e6-9bf0-cb9a1044dc3c", "comment": "Malware payload (Mirai)", "value": "299709e522160203f42ff6da0dbf84c960545045acf7605dc83619e0fc54c38f0cd56a4eb4d97832c2d5d2f40d9b0388", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636866847, "uuid": "bc6bbd6c-9b7c-4134-a382-d07b09657a05", "value": "T13CC2E1A4D2522994CAFF9FF4DD51FEC237D34F27AAE9C981A063DF501147502A60A1C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636866847, "uuid": "34a8f47a-75ce-4fc5-88b1-faf46636acc9", "value": "768:aLXZeDk1u1ip7bNhgufhzMqEt9l3kLdcd44uVcqgw09M:mkr1g7JhvfhzMqC3kV4u+qgw09M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636866847, "uuid": "0e82bc4d-3636-46ea-9e24-b297d0d30b2f", "value": 28248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636866847, "uuid": "f671091a-2f6a-410f-a2f8-58c5d6f570be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636866847, "uuid": "422fc511-5329-4fe7-b9bd-e6db03d80f36", "value": "9226c0677ab0d84d5f10a3bec13fcd2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce97db8-4547-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636893361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893361, "uuid": "538e495a-3b87-4c0d-8cd5-67e3e72feb89", "comment": "Malware payload (RaccoonStealer)", "value": "b641802986992824c8e5a5d64af0eb8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893361, "uuid": "0a916671-a51d-4704-94dc-e8c14152d4e5", "comment": "Malware payload (RaccoonStealer)", "value": "0968b29bbd4b8fed0ac21df64fd5e7a0012fcb215f1e058549d8636d4a4af240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893361, "uuid": "742eaa2d-62de-4fb3-80a8-f2e4111b6d86", "comment": "Malware payload (RaccoonStealer)", "value": "ccdbcd140452a95252a0f8cd0d219c8f929fe337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893361, "uuid": "9c107658-36d6-45ec-ab42-18b994093f34", "comment": "Malware payload (RaccoonStealer)", "value": "8301edcce5fecd72d358574e249b94e5364d71a3b6c83aa728234c691c7691503a1a016798d3d0d4dbf416121356c5c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893361, "uuid": "17fc35ed-a99b-4717-96e2-d77e986db6ff", "value": "T18A249DC177E18435E19A3E30E4A49BA056EBBC32E570552AF734972E1EB33D05E6230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893361, "uuid": "c48cb6f2-c1a7-413a-befd-8542a83a5fc6", "value": "d6f1a2cb84dbc438e72cd46aa17d4119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893361, "uuid": "43216422-6556-4678-91cd-60fba4977e7a", "value": "6144:e4VAGAFfLF660EExWeFPBy7ITsq7igavwVf:jCGAFf3IS79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636893361, "uuid": "899f37f3-9484-41e3-97b2-897e2d5c3bd5", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636893361, "uuid": "84c357d8-355f-4dd0-a5b0-d7307c8017db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893361, "uuid": "aec06f3e-3dd6-4a45-b231-8d0e3b6018b9", "value": "b641802986992824c8e5a5d64af0eb8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9095c811-4565-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636906306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906306, "uuid": "97e672c6-752b-42c1-a88d-01f74e23929f", "comment": "Malware payload (Mirai)", "value": "8fd7ddbabd36e002243fd46cc15808b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906306, "uuid": "8e871085-7c8f-4db0-8ad6-e58ac0535563", "comment": "Malware payload (Mirai)", "value": "09a5273710b748f3983e7fe2c8594474cabd056d5588f4a2252a94b4968cfa26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906306, "uuid": "60002c5f-1403-4aef-9da2-f229cb165305", "comment": "Malware payload (Mirai)", "value": "8e9110cbe8b1e8eda9536534db515250e2ab68d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906306, "uuid": "b92effb1-dba3-4fd4-93b9-05c3c24a0aa4", "comment": "Malware payload (Mirai)", "value": "283f4453b4406c805f9e0872710dd1f28a2e6dcd79afba01dc4bcbc032c13e70718da22245357dd40d9a5d43a2899595", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906306, "uuid": "337fb4ed-6b95-456c-b6d1-9962c2a3ee05", "value": "T13BB2D073590090A2CAF419B59AE7C78B97625FF880EDB7A78138025C735CCC5D9F5447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906306, "uuid": "7c90d42f-44ff-48ee-bcc8-ba1318e6b5cb", "value": "768:XX9nxn8o9wnBbwvdFKqolg9zOHxbEBifx3UP:Xtn+o9wylpolH2if8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906306, "uuid": "8d5afd2c-2f17-4fe1-9938-42f1396f27f6", "value": 25024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906306, "uuid": "cc658310-b69d-4e34-a790-4d1b135e3cf4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906306, "uuid": "b412318f-8895-4a23-858a-30742dc4a48a", "value": "8fd7ddbabd36e002243fd46cc15808b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1270f4f3-4540-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636890203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890203, "uuid": "596625a0-e09e-4734-82ce-7bf04b4a0eef", "comment": "Malware payload (Mirai)", "value": "3ba678035ad1351391d67a43a01019dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890203, "uuid": "f4cbbcc1-6279-4e66-9324-5f4402f918bb", "comment": "Malware payload (Mirai)", "value": "09f3981a02d0f6a66b202759657067d583a36fcf42753822e46251fd70c45623", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890203, "uuid": "6f1be092-c013-46d6-8fa8-3df3493af977", "comment": "Malware payload (Mirai)", "value": "9aef7897cbbd00b188eb04d4f990a6b6491d5513", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890203, "uuid": "6b6eca8d-76c0-4a35-8dfa-02f5e481d27b", "comment": "Malware payload (Mirai)", "value": "2e6b36ff74d34e8d8ab542b750bb92d007d789618ca0eb61642cf28051e9aa25183d8673e1a453457877422f3e0c85f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890203, "uuid": "98560ad0-417e-4db4-9f9c-a0782b35f255", "value": "T103835D25FD665D27C0D4617B61F38321F1F6534A20B88B1E7DB20E8EBF24A50361B7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890203, "uuid": "55f8a90f-00bd-44f5-abca-1e918cd02c4f", "value": "768:u6fm+qZQwiQq+Q/1LNMoMlqEtzpynKO+NQDsm6HGxQOtHscFrl5E57CE1tWOIT:uKsQw4H/1BMXlqEeYN3HGttH155AtHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636890203, "uuid": "f3a8ca18-ef41-465b-b1ce-9cf1c5baf5f1", "value": 83328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636890203, "uuid": "da5e4c7d-de29-45e3-b775-b0bf9c634508", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890203, "uuid": "0ef335bd-3398-4ec1-9b93-2a200094236a", "value": "3ba678035ad1351391d67a43a01019dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f4e004-45a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636933861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636933861, "uuid": "234536e9-a213-465a-83f8-17c5623b47a8", "comment": "Malware payload (Loki)", "value": "9f72d4b0017fdc237df8501c9580d097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636933861, "uuid": "2a333c23-658b-4450-8de0-ede4f98cec4c", "comment": "Malware payload (Loki)", "value": "0a6dffa7e3fe94bef9865778816468cd9e6ca3065b592d93e33b3d9dc733a992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636933861, "uuid": "0275dbc3-305b-4868-9275-91dcd718c317", "comment": "Malware payload (Loki)", "value": "57a4213fa8fffd1394381e1f023501f599647d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636933861, "uuid": "0ddf3f06-acd9-43cb-b0ac-961ea02d1e84", "comment": "Malware payload (Loki)", "value": "6031a895e9aef0e83908367df2cd0f6ef7a5cd2cf22e32d144bcba64341248c7a2915800f05202c6adc1d360ded43320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636933861, "uuid": "05bedcfd-9581-43bb-8271-d158f199e094", "value": "T1F7A31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636933861, "uuid": "adb06a16-6da2-4b6c-9c13-274969054637", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636933861, "uuid": "03bdffe3-c326-4aa7-b5ce-c1fcb3f88828", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636933861, "uuid": "2230bac0-e9a7-4a87-abec-c78d8570e617", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636933861, "uuid": "4a20162b-ad47-439a-9af6-988d158c6e3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636933861, "uuid": "e2b52019-356b-4ce1-ada7-8d46cd56a84c", "value": "0A6DFFA7E3FE94BEF9865778816468CD9E6CA3065B592.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fb564f-451a-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1636873941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873941, "uuid": "f13ef051-3db1-466f-84e9-a51b5b5db252", "comment": "Malware payload (RemcosRAT)", "value": "784fbedb911e18a12a0178e77448278e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873941, "uuid": "82d5e6d5-6523-4dd3-b377-df14ab62a5a1", "comment": "Malware payload (RemcosRAT)", "value": "0c5302d501f9872ff027d1486416daceb8a5b9af7eefb6268fd78d38bb6c8b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873941, "uuid": "7e9bd5ca-3160-4acb-8185-9c77259b03ec", "comment": "Malware payload (RemcosRAT)", "value": "2d4c7bb0a87353ce78968a7bb6299d2375fb3ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873941, "uuid": "2e8bbfbd-e329-4c23-a471-0ed193bf7256", "comment": "Malware payload (RemcosRAT)", "value": "2e283a7241b8859c70f245cc3c329fe2e537bbecef0d2836b2bdaa09df5795a057113d424c99bfbef16edfbaca65bd59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873941, "uuid": "bf6e362e-4438-4e54-8672-7969c1ae0205", "value": "T19E058D26BF995876E16E09318D0377A9452A7E803B54B8B5B7BD3D08DF383813C2919F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873941, "uuid": "0dd93cac-52bc-48d8-acb7-86989d2a3995", "value": "771d05838293a8356c469b98086d5fef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873941, "uuid": "44503e37-e27c-4b49-8ed6-9ffac29d55d0", "value": "12288:uBI5fjs/RGn87z7htHHqdmKRcdbmfdRa1P2AI5mlQ45DgyYLaSU3dyBL7Uo2jfny:Bwq9NofGKsPArGahFEvOcld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873941, "uuid": "60dea891-bfcf-460a-8b6c-ff182bf17a77", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873941, "uuid": "0b29e97c-6e7e-4e8b-9063-55cbe525e488", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873941, "uuid": "3d4b48eb-6d3f-4b58-8898-c5f83887f0d3", "value": "784fbedb911e18a12a0178e77448278e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd12fa07-4550-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897361, "uuid": "43e7b880-b3f6-46e3-b5bc-58daf62c3b15", "comment": "Malware payload (Mirai)", "value": "f2926c50ca6fcbe86904ed78f16a84fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897361, "uuid": "de8fcec2-84d6-48db-a17f-dc9cdc74f797", "comment": "Malware payload (Mirai)", "value": "0c7b1ef266248ffb21b1223bc699ff5ded0ee18ae5b42cc9738e7425acd93bd7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897361, "uuid": "02fdb8ba-2cfd-4a04-aea8-d7483ce22408", "comment": "Malware payload (Mirai)", "value": "df19420ca3c41daa78cf57a77d27ded5b3b61b64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897361, "uuid": "b8bce10d-afed-48ec-813f-51cd7b8a32ea", "comment": "Malware payload (Mirai)", "value": "cebcf9e3d87add4d17d348d54666d5c5766a1bb7d19929db444076fb923ba09995c8aecdde0c4923e4c4c9a1d57fb3ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897361, "uuid": "a126846b-4e01-420d-837b-035f8c10b274", "value": "T10EE38536B7619E77D80ECE7305A985121C8C998702D92B6FB2B4E51CEB6BC4F08D3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897361, "uuid": "f4d63efa-22e3-46a5-8f78-31b819e4ad21", "value": "3072:dctc9p13lnLU2PiXYqyCcKVyMVGuouTmrThPaLEne7rNb:d9XlnLU2PiIqyZKVRDouTmrThPaLEneN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897361, "uuid": "a0a06504-10de-44db-986a-c4ac4fc9b3a9", "value": 155477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897361, "uuid": "3dc8fcfe-4705-41ed-9e18-720b246417f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897361, "uuid": "115c3619-3859-4fd8-a1c6-390da3acfc77", "value": "f2926c50ca6fcbe86904ed78f16a84fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67040833-450a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636867152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867152, "uuid": "45ddde5f-cc11-4210-b889-0f4f87d434fb", "comment": "Malware payload (Mirai)", "value": "62b848c28647eea22bd0108c271b39c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867152, "uuid": "ce7234e7-b18c-416b-9529-34d39d3a2764", "comment": "Malware payload (Mirai)", "value": "0fc1b19f77df4319c5158572d331e3ed0ebf01a7f7b68ebda34c4fe1cd437cbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867152, "uuid": "f23ea6a6-35c1-4eed-8d2a-f5076c836cdb", "comment": "Malware payload (Mirai)", "value": "0aa65ef4430a0f1b89a7065f89d975dd9784607c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867152, "uuid": "4112b3a2-38ad-4752-be11-4d5a1624e24c", "comment": "Malware payload (Mirai)", "value": "18b8695c2994caf30331d5046d52e1511d2a3e90832a4734d55829d1175e35e323f98a46cb20e732ffb3093d4611703c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867152, "uuid": "dc20a172-4e72-44df-8003-6a89ecf46fa1", "value": "T1DA333A8A64112E6DE9DA9CF981764F0E8E541210B493171FB3BBFDC33933258FE66509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867152, "uuid": "43ad2ae6-75eb-4a7a-970f-abcadaa99256", "value": "768:XuPj1B6PxJK8tXxJq0qpcAGiajC21UCqrPwqLWs2TqOhRol7gSu9+f1prZadIO02:eLX98rqaAGiajCEqVLFF7gSyg1pVa6Fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636867152, "uuid": "fb89be9b-95b1-41f5-a082-9ec6a0dbef77", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636867152, "uuid": "7702d4f7-b7e5-4357-89a8-808f39f1c7bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867152, "uuid": "4a54cd8d-2265-4dd9-aa5d-88361afa3706", "value": "62b848c28647eea22bd0108c271b39c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8d32f9-4545-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636892500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892500, "uuid": "f3b1554c-c36d-4a9a-a320-a73c2a8f022a", "comment": "Malware payload (Mirai)", "value": "871e19415a39c8d056d22513178a5d63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892500, "uuid": "872c3262-430a-4d4e-b279-00d7de43dd8a", "comment": "Malware payload (Mirai)", "value": "10c796b7308ac0b9c38f1caa95c798b2b28c46adaa037a9c3a9ebdd3569824e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892500, "uuid": "d75fbaec-7169-4957-949b-3a5d63f56a20", "comment": "Malware payload (Mirai)", "value": "fb51ce978000ed8b94b2feccfb0b8227e1060552", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892500, "uuid": "b1f0da3f-34dd-49c9-aee3-24a048630ce8", "comment": "Malware payload (Mirai)", "value": "1c8036d9fb1add326558a2357c32c48563b091331a1ab3a0ce2de80071763ce80a90073207ea333de6d1a066019e6754", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892500, "uuid": "34a84a72-57c7-4330-be49-01fd0cd75d06", "value": "T1C5D32B86FB418B17C0D62776BAAF414A3322DB5493DB7306891C5FF43F86A9E0E53606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892500, "uuid": "e13f82da-2ac8-4a14-bf37-085548cdafbc", "value": "3072:JnfjMH9zBhLqUZ2ZJOA91xHUno3GW3sgM/9+T/B:JnfjMdvqG4OA91x0nzW3LM/9+T/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636892500, "uuid": "7a57181d-b7a2-47c0-81fb-5cf4a845acc6", "value": 134589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636892500, "uuid": "8f11c271-0421-4d61-b92d-84b472bbe621", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892500, "uuid": "9502a83f-c6f6-426f-b632-2596b8f878c4", "value": "871e19415a39c8d056d22513178a5d63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349979c6-459d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636930203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930203, "uuid": "c7cb75da-6789-41cf-b61a-9bcba283d1b3", "comment": "Malware payload (Mirai)", "value": "7481cd3fc552e8b430dc1224d3cf24ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930203, "uuid": "228f3247-c139-4083-af15-646b6cf65453", "comment": "Malware payload (Mirai)", "value": "12077f0ab6aa0fc88601ca4a4e09b56195bc47faf8009616febbe13870c453b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930203, "uuid": "30551fa7-71aa-4ed7-9afd-faebf5fd548a", "comment": "Malware payload (Mirai)", "value": "ba6d84a46e2cdd332ff8089051e9dccbd2eab7f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930203, "uuid": "7c02f6d4-9fa7-419f-bb5d-904344e86234", "comment": "Malware payload (Mirai)", "value": "7aedd8949e805a1716771a7991fae2bc86e5e107610e64ec4f36ec1a9d1bd5617a7524a9637fa340bc8a5adc42988e33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930203, "uuid": "24911990-6d85-4399-947b-78f1a7cb0654", "value": "T1336302E17324ACF486F414319FE04CD41EA9CBFBD43E75B5A1D3A28DBE590622B63942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930203, "uuid": "be630f92-614a-4a74-9a97-3f35b25eb12c", "value": "1536:EVKgbIVSTJnOChDaMQ7Jqk1LKnsUCLlas0l1J6U:Esg0STlOC8MCFWJCLH20U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930203, "uuid": "5ce06700-affe-4fed-b428-4ca86bc1986a", "value": 73000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930203, "uuid": "ab306bbc-b644-4db9-bb11-3cb5fd0f7f93", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930203, "uuid": "099c55d4-41e1-4c67-bc4c-d648cfd98de5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9692c55d-4543-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636891713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891713, "uuid": "8f3f1ede-5ff8-4dc2-8d72-6e8f92b53cbe", "comment": "Malware payload (Mirai)", "value": "83303cd611f933f786fe7c1767ffddc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891713, "uuid": "9f274b47-b435-40da-8069-54e7c584ad72", "comment": "Malware payload (Mirai)", "value": "133b37510b0f01f2c354b0c76c59c5f1ec565bcbeda0a35aff9f30311a8ebea1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891713, "uuid": "ba45acf3-6cb1-4a30-85f0-6f3e404e8efe", "comment": "Malware payload (Mirai)", "value": "14acc95beace0a128e29c7d13b2c9d45227277f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891713, "uuid": "698ee36c-7b99-447a-818b-1941be409a44", "comment": "Malware payload (Mirai)", "value": "a786cff972e891baa4f957d8f5df85ccef4d7ba26df0db585dc8cea36922944175b4ef8656df1b54ad962bb1b88bd985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891713, "uuid": "a26cec0d-c595-4915-8127-21fe1757d0ee", "value": "T1F983AE76E06A6DC4C1820338E4985C7C9F13E6C4A3731EF65AD24B5A144BEE8F845BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891713, "uuid": "9f9ba0e2-fdd1-459a-8af3-3e17a911c0ab", "value": "1536:+/ONAz1/0+P/IAzqDvENhVnPUKdloEiS/Cqbk5caUszL29KCRLquEH:+WNQJ3AQVXPUKfoG/Bb8xUszLSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636891713, "uuid": "a9726e4c-5db7-401f-bcac-ce9dd17cd4c4", "value": 83820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636891713, "uuid": "9a604725-9152-4e7e-a457-fb913f83127c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891713, "uuid": "300c9df2-8bd4-42ca-a1e3-d63440e9189f", "value": "83303cd611f933f786fe7c1767ffddc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1391ce1-4550-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897341, "uuid": "1d14f6ab-b575-4773-af0d-77aedef394fb", "comment": "Malware payload (Mirai)", "value": "a6e7c920aadf2517c710c84844e1fcb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897341, "uuid": "c4348f6c-5308-486b-8f17-062e758b87b4", "comment": "Malware payload (Mirai)", "value": "144322facf4179bdd09ee9162bd670ba545dc487ae294b7cdb6dea69dcad6452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897341, "uuid": "35cbfa3e-6b4d-4388-bd38-80c1023c797a", "comment": "Malware payload (Mirai)", "value": "bf2c309ae941c703de2f554b978aa21ef3b45419", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897341, "uuid": "0748f032-168a-4c6e-b7e6-c1dfb5c7f43c", "comment": "Malware payload (Mirai)", "value": "10ac44127a79c3abf7a27628db4e12280c91627e1de1bd79d073133b8bf49a6e8dd866835919673cb531bd6042c871f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897341, "uuid": "60db1066-75ec-4e26-b4b7-261eaca28b6f", "value": "T16FC3C63B67170E23C0CA50B101E34332AEB5DF9734B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897341, "uuid": "c98c45df-4f76-4983-967c-ebe186875d26", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPXa7Cxmm/QMurB12CGNb:SMQplVXnmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897341, "uuid": "d63d9ceb-fd31-4241-98c5-471079065e1d", "value": 129857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897341, "uuid": "35f3138e-c0ef-4428-8118-d29161aff540", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897341, "uuid": "1b6e271a-537d-41aa-90ba-f02205545653", "value": "a6e7c920aadf2517c710c84844e1fcb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1a4ac9-4571-11ec-843c-42010a9c0014", "comment": "Malware payload (LokiLocker)", "timestamp": 1636911477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636911477, "uuid": "10d411b4-0421-4cff-be99-15acf3e40d11", "comment": "Malware payload (LokiLocker)", "value": "8aea251877cb4f5ee6cf357831f8620c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "loki-locker", "colour": "#A7D5DC", "exportable": true, "hide_tag": false }, { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636911477, "uuid": "fa140d6a-a2a0-475f-9db1-2c365f812af1", "comment": "Malware payload (LokiLocker)", "value": "15d7342be36d20ce615647fac9c2277f46b6d19aa54f3cf3d99e49d6ce0486d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "loki-locker", "colour": "#A7D5DC", "exportable": true, "hide_tag": false }, { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636911477, "uuid": "f27645f1-618d-4bbb-ac74-12489b789dd7", "comment": "Malware payload (LokiLocker)", "value": "297eb4dee673ee0bcb7ba1c3849f130e7a0c6805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "loki-locker", "colour": "#A7D5DC", "exportable": true, "hide_tag": false }, { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636911477, "uuid": "aeb34721-8cf2-4f95-ba8a-9f3af7a61065", "comment": "Malware payload (LokiLocker)", "value": "e4c439c9e632791b815f9fc7aadfe281a1cb5d223aa91566e553759ebdddb872c240002c0c31d2907cc1a80681b80522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "loki-locker", "colour": "#A7D5DC", "exportable": true, "hide_tag": false }, { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636911477, "uuid": "6f96404c-2d59-4a2e-82c9-27731e637bff", "value": "T19DA4AF6A97E14D99F2B78B7E8CF1D2304FB3BCD8E720D36E018025D90E32695DA54366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636911477, "uuid": "7dd439c3-9128-4e4d-959a-bdae3eb8f57b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636911477, "uuid": "20597619-4f0e-4a06-b0bf-73112a0834a4", "value": "12288:2L7CimkbsAXtFDDfna4dFrlTT6zncVUJ7vn:Q7z3aqTT6DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636911477, "uuid": "5ffb86f1-ce83-4aca-bde8-a7867bde629b", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636911477, "uuid": "b1a8fb21-8360-4b09-8706-302de7f5deb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636911477, "uuid": "c9f4abe0-30c4-481b-ae33-138676578344", "value": "winlogon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dbc5b5-459d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930239, "uuid": "7fa8af66-ee53-49a8-bc55-37c1054b0d9f", "comment": "Malware payload", "value": "d663f5a1f4c8bf1bacb90324e7a38b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930239, "uuid": "edee6358-4f41-432d-8cad-d0ff4edcf7c0", "comment": "Malware payload", "value": "1791d0763a544911852e4ecde3ea6a0e3cb72aaec45bfae7cea2b1780f285c9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930239, "uuid": "b298cb30-f691-4c00-8efa-4e059296f63c", "comment": "Malware payload", "value": "da0de378bcb909cf82a6a2b5766aff961c9b6bf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930239, "uuid": "0c86f2ef-d48d-4e9f-b0c4-d85af3707c47", "comment": "Malware payload", "value": "2addc6e36491140bbb0daee56586e29621bce316b2d96500ee440a5643e7fb1eedeca298cded6ca48eec226e29ad3f9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930239, "uuid": "771db80a-3b98-401e-817e-b40240e52735", "value": "T1C816D09D321071EFC857D4729EA86C68FB5078BB931B8203942365EDEA1D897DF244F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930239, "uuid": "fbe8f9bf-83b0-4228-bd3f-ca84af60f894", "value": "98304:cdAtLWCiR8p/YPVxtbOxskddgPKmBzaE/+cX:cdAlSyp/YPVfsstKm8E/+cX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930239, "uuid": "fd918cbb-1b8a-4a61-b928-6080750d0284", "value": 4027392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930239, "uuid": "770097b7-2275-4065-ac23-96f8d6df9abc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930239, "uuid": "1be05b20-83a6-4c0b-a2d7-37a218697844", "value": "SecuriteInfo.com.Trojan.GenericKD.47398940.31174.21692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4121d167-44f7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636858928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858928, "uuid": "ee792a82-9de1-466a-a9e4-ae1180a3090b", "comment": "Malware payload (AgentTesla)", "value": "a9a18e24fe81eaadcfaf2fde2b6d40ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858928, "uuid": "acd6bd16-36a3-40ad-9252-6362d79e6812", "comment": "Malware payload (AgentTesla)", "value": "17c6884e69ed53cb079dc2504872451d5e9977876d40074877d4431322ec26df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858928, "uuid": "a695fbaa-961d-4ae4-ad7c-3fe08d2bf476", "comment": "Malware payload (AgentTesla)", "value": "6620a31638b2eeccb0ed477ec2b02a5705610c25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858928, "uuid": "80f70d56-56fb-424b-b457-2eac37a18867", "comment": "Malware payload (AgentTesla)", "value": "82d27533babf45f53e1f442efe264917ab15f0c85d2be70ed9656f3791c0651b3b8c0172c4c4b1d8a5e826bf72a4d2f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858928, "uuid": "3eb4cc7c-681d-4b1c-a3cc-9d3fc8a5e552", "value": "T10BF1C611E7F84236FDBB0A31BC7362509670F712C803DB5E3884761A2D22B54C9E2B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858928, "uuid": "33f2fb90-e368-4163-bfa6-c06848a3817e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858928, "uuid": "77e234b6-4c34-417f-affd-60787c35c3fb", "value": "192:sKdmvlhjiDihobEJ62HLDcogm1SOoY4CzaYFL5tFvNdxGMqgLQATQgQP:RdmdphobZ2rDcogm1SOoY4CzaYFL5tF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858928, "uuid": "790e057d-7e05-45f2-8792-6eddd46661ed", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858928, "uuid": "6fbd1166-8019-463c-98ee-07ce940d236c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858928, "uuid": "94fe0f5b-0e75-49f0-b649-7d3f22943e20", "value": "a9a18e24fe81eaadcfaf2fde2b6d40ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d06f4a-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636874527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874527, "uuid": "522306bd-5d17-4d11-873d-49d3f5cdf0b9", "comment": "Malware payload (RaccoonStealer)", "value": "d076c82fc9fea2b41942c4d547353c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874527, "uuid": "0b18854b-ec4d-4937-8929-a6e6ed1a2e81", "comment": "Malware payload (RaccoonStealer)", "value": "17f034d82769b0c4477038efab7264cf527325f9988f5da5765e7556c7b512da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874527, "uuid": "bb67d4f1-108a-404a-9e09-e0df7bce8052", "comment": "Malware payload (RaccoonStealer)", "value": "93a8104dddf984fc72e387b324cd8e0bf56a66f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874527, "uuid": "b317ed10-25c5-4253-9057-256ac2c97834", "comment": "Malware payload (RaccoonStealer)", "value": "97134576b461a1d4e90f8716b84bdad7c7d19679594c12fa12d25a1320d69667e773f389005e87150c7e65be4cb50a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874527, "uuid": "0e9c4a80-e1d9-4783-9e94-177deeb98597", "value": "T16EC4E00066A1D034F1B776F449B692A5A52FBEE2AB3590CF21C476ED9734AE0ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874527, "uuid": "bd0ed3af-83b4-4e71-abbb-ee6bf6a196bd", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874527, "uuid": "3cd84f85-5d8f-4405-9361-60f1baf9dcf8", "value": "12288:U82gp6o6Qkv5JuIo9vTdAy485N2gb/B7m33zruy:z2goo6Qkv3oJ6R8b2Rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874527, "uuid": "3d2ce20c-677d-4117-b924-c4818c0740ad", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874527, "uuid": "1d7159b2-6459-4059-bd9e-f7b46839fc5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874527, "uuid": "1f461be3-796e-48a3-b21e-f25014424728", "value": "d076c82fc9fea2b41942c4d547353c46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dbb959-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1636874559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874559, "uuid": "2193415b-e22b-4ae5-a968-c927a55c1149", "comment": "Malware payload (DanaBot)", "value": "1747ec2a8bd3d58734dbbcd5f4c76279", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874559, "uuid": "4fb7f172-f3cb-47b3-b168-04c8482d7c5b", "comment": "Malware payload (DanaBot)", "value": "18092c9078d95d5247d36b065c21bdbecd060c93f97d4604f435d9050b3ca4b3", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874559, "uuid": "031b012c-ddcb-490d-9e9a-9462611245a5", "comment": "Malware payload (DanaBot)", "value": "a29497154ae1ad3367883776e4c610bc0bb54f4e", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874559, "uuid": "610a95c2-0a0b-4733-9672-00a879877d3c", "comment": "Malware payload (DanaBot)", "value": "05333181aa320ca8c5818fa009f91050634d84699c32ecc4a1304d14509c4b83da4e33dee9ed79ac1c326a9869441432", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874559, "uuid": "a46f01c6-3691-4f18-a550-f38548297794", "value": "T110958C51B602E726D6A86CB8FC00C5EF14F0BD49FE44D267F6C17F9FA932241A82519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874559, "uuid": "958876a1-f239-4224-bee3-63b262a3a30b", "value": "bb030c245f6212cd80b29115874af9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874559, "uuid": "d55f74c7-30f7-4f04-9d02-a49aa4c920e6", "value": "49152:lQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BAeUqfn8+nFFQCxEsJwKQN:lfaNQh+NUABO/c0Y9AdZUqf8+gqJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874559, "uuid": "99890b42-f666-4551-b098-6866af488daa", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874559, "uuid": "91c99ca5-e0b8-4ce1-b5ca-c86662f4ec2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874559, "uuid": "2006eccd-f409-4be7-94ca-1744bb9668ae", "value": "1747ec2a8bd3d58734dbbcd5f4c76279.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d78d8a-459b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636929296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929296, "uuid": "9bcd3947-8124-41ff-b330-61434871e8d5", "comment": "Malware payload", "value": "22599fe84bd94fb9bfb3deef7132c56d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929296, "uuid": "7785a29c-0099-4c34-80a1-30a1c6bdd2ba", "comment": "Malware payload", "value": "18805a5688a67b9ad33ea6f5c1aca26a3cd499b406c55a7fa0017ff17a38bdd8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929296, "uuid": "4b0e08aa-05a3-4e7d-94b1-ded7c26a0793", "comment": "Malware payload", "value": "269cb4a6f23a83b2e8f6bb11f3180248c7a8469b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929296, "uuid": "e8e5e66c-3fde-4026-95fa-ce0e9418ad45", "comment": "Malware payload", "value": "e3d3407e0d6586d3f70655651cccdf2d0ce2916edb2567dcad194a55defa13a680078b8aa7df2119bd37232cb9d8eb42", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929296, "uuid": "f309e5a2-f64a-4b2f-a3e3-a7f8d55ef9e7", "value": "T11592E161D71E7208C0A37BB26647876A1EE37C25D3D2412234A8B64913979E9F00BF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929296, "uuid": "a6063fce-f9aa-4208-b37e-e94d5bf6591f", "value": "384:K5qmJ8cIkrQrjIilKIfh7Q1HuUv+HPYkmMJzCQo1cIiFqcJA:f3zk8r8ilKUB+v2/a1Js2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636929296, "uuid": "4b4041c0-4fe2-4176-b464-cb270cf5c8a5", "value": 19896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636929296, "uuid": "c2903211-376a-4d35-9e94-d504f3d684b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929296, "uuid": "4300563a-11b0-48e0-85b7-6d1b63d2b1dc", "value": "22599fe84bd94fb9bfb3deef7132c56d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47b4738-4551-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897776, "uuid": "7e35ba3d-a5ac-487c-8dda-f9928ce8414d", "comment": "Malware payload (Mirai)", "value": "12696c906ad69cd1e3d12972792e60b2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897776, "uuid": "81dfcb7d-d3f4-4b8b-aa1e-ddb2472371ec", "comment": "Malware payload (Mirai)", "value": "19293f4596fc7a16cae64af4780bbf57855096fd383018e53eda7862a6e77c80", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897776, "uuid": "9fe49bb3-a24f-4329-a108-223636415b1b", "comment": "Malware payload (Mirai)", "value": "9783d7081ee8e91d5d7dd07df7bc37c14d07f4df", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897776, "uuid": "a8562176-16eb-4ec3-b331-13f85cde3b54", "comment": "Malware payload (Mirai)", "value": "6fe6180baee395e65e8901b433180e9cda1133cd9a4337812174e7a76aad6db3dfd9c69b24c5e435ba68490f6bb03812", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897776, "uuid": "2d2c3e00-51b4-42e2-a20f-6e002fbf1cec", "value": "T133B33B376651C97AC08356F426EBC5729C13BCBB0B32319A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897776, "uuid": "fd0f3b30-2094-4b55-a75b-72a905356914", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAd+T1bm7FnVqfJXoebNb:T9a2aLqkrMQBm7FnVqfJXoebNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897776, "uuid": "56a66f68-bfb2-4b5e-9271-48b068a10178", "value": 116504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897776, "uuid": "ed1933cc-c6c8-4cf6-ad65-e7cf72b4c63d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897776, "uuid": "0c66bb55-721f-4ab6-8c8f-064877c64ecb", "value": "12696c906ad69cd1e3d12972792e60b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b2ae1c-459e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636930796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930796, "uuid": "bc497ec6-f935-4bed-b4b0-acfb723e73c0", "comment": "Malware payload (Gafgyt)", "value": "279cb5f668d22fe70f140c1449079ceb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930796, "uuid": "902ced5b-c90d-4b58-bdc3-f80716f11988", "comment": "Malware payload (Gafgyt)", "value": "1984c45bc9955b05785eba2c38c902c26603ae140f2e8995138a5faa2b73b467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930796, "uuid": "99824e87-0864-46e4-b1db-4457cdbd034e", "comment": "Malware payload (Gafgyt)", "value": "54f338507e9d26a3643cba4cc66c1bfd21ec70c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930796, "uuid": "c63f3022-78fb-4253-8644-345d68d45004", "comment": "Malware payload (Gafgyt)", "value": "2e01931b50adb7bd9106943dabc01907f52852e1f14639050c65bd8f05b3d3e1896761bddd8f9107cfccb155efad6555", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930796, "uuid": "508700f7-9e8f-4d1e-967f-d33fef1d3a22", "value": "T187B33B7DD303C6F3C4470AB21257BA6F4D21F97B493EAA46F328ADB49B268C47125B11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930796, "uuid": "36e3823b-852f-4b4c-ace7-1bd9453fa156", "value": "3072:/Npf9CXpGDhwAfv9gmdJaCek9Fmmq8cYEJBc+hG:/vfKp0ZTdJaCekXmmq8cYEJBc+hG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930796, "uuid": "2eb72d5b-dc7f-4a38-b4c2-70b62d965824", "value": 109494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930796, "uuid": "ddf70f6b-25ad-4311-bb12-3ffd7e566242", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930796, "uuid": "d9c3b66f-b681-4563-b809-94de7f0cc599", "value": "279cb5f668d22fe70f140c1449079ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483d7918-459d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930236, "uuid": "6e3be322-28e8-49f4-813f-1487a2d8c6c6", "comment": "Malware payload", "value": "2b981c5d303d855ff0b7784ea7082860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930236, "uuid": "e4070696-ae37-4242-9709-1dcaa1cfd996", "comment": "Malware payload", "value": "1a320f02f4bb5f3c0464dbf9d3f66939ce25f3683e262dc9326056ab329819cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930236, "uuid": "579ea4cb-42ce-45cb-bae5-017acb5f8be3", "comment": "Malware payload", "value": "72638cba4542e5f56f701d9579ba857d1675ee98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930236, "uuid": "beff367f-b2f5-49fd-966c-85e083b1f250", "comment": "Malware payload", "value": "32097571b5a4434b06a18de6ab7a4b4c55a44149fd1a0e52326c9c36a5b39130828fb760b32b79018fa3d2e24ef04efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930236, "uuid": "db84fe23-e115-4a2e-a4a0-3432be3cd37e", "value": "T1E9B53335E90E5744E592A6336CA4E72EB6EDE21A9FE0D31FDF30C91DC2542E5E23A050", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930236, "uuid": "c6ef287e-e177-4e11-8315-e49a6a10e46e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930236, "uuid": "657738e9-4894-403c-8414-b864857c92ef", "value": "49152:3QY2HBB5mtJ7E4wV3oXbegW25y8Q5xO2FYAldyY/rfGpP44D:30QtYAO2IX5E4YAldyyGpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930236, "uuid": "6d5c985d-bb54-495a-bd98-625c19837f40", "value": 2457088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930236, "uuid": "64478b7e-eb91-41be-b453-8d19e8a52c77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930236, "uuid": "f529aea8-9fc7-4573-92f5-6596af0eb399", "value": "SecuriteInfo.com.Variant.Zusy.406840.12801.25840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94fafec-4550-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897355, "uuid": "10e77a98-ad60-4d8b-acd7-1f377bff5226", "comment": "Malware payload (Mirai)", "value": "c1699795a2fbe43d3a29919e7bdf7b76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897355, "uuid": "34136bd8-6ce2-47d7-9729-5f189d09d332", "comment": "Malware payload (Mirai)", "value": "1a99014331a05bf2cfb1e2014db4f395802e01b692aba19b5ffe3be78b2b1f42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897355, "uuid": "b518b1eb-4037-4285-b1ef-7851277a726e", "comment": "Malware payload (Mirai)", "value": "b16b64ba58a0b613675ce51cd54f1c5f83790787", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897355, "uuid": "217124ab-6b08-4279-8ae4-537e4afef0b7", "comment": "Malware payload (Mirai)", "value": "88a9916172b1e034cceb18689a81f82d271b9ab1aae464ea786314382d3b88be01ccca9bb9650ffb6a3fb7d10914d21d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897355, "uuid": "ceb69171-b0c9-45e1-b5b0-7eb07ac25f66", "value": "T106B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897355, "uuid": "56d56479-c8e2-479d-98ad-a87b153aa47d", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZwcmm/QcuLB126DNb:YuFX0GIk1MHyphLmm/QcuLB126DNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897355, "uuid": "3a13dcdd-7a58-4bef-ae42-f22b7d788bb9", "value": 118091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897355, "uuid": "8bd04923-9c76-4e78-b1f1-6ae06c380125", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897355, "uuid": "ef8a356a-ca12-4e48-bfff-9c6c07d2f67c", "value": "c1699795a2fbe43d3a29919e7bdf7b76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb98efba-4510-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636869978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636869978, "uuid": "c7f82c34-ed98-4bbf-9642-6fc7dd1839e5", "comment": "Malware payload (RaccoonStealer)", "value": "3e2248e6b8b4056a604432a1b3d57d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636869978, "uuid": "7ce15384-c1ed-4250-8f44-803acaeefafd", "comment": "Malware payload (RaccoonStealer)", "value": "1abda6533abb0bc7d91351e49a8033d50748f82c58b2ee7e5c249432a60cd4d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636869978, "uuid": "c0b94187-c606-4486-a209-2516a578fc48", "comment": "Malware payload (RaccoonStealer)", "value": "353e1f4a0cf1bfd54bcaf56b4806b275f12b7efc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636869978, "uuid": "3e391b4d-b9b8-4c75-aa2e-52699e67b6c0", "comment": "Malware payload (RaccoonStealer)", "value": "5900047d22822a4794bbbf50b4c440f01b4090e92aea3a0b8d959d0317a2df27dfa85e0fd87339baadd6e124c7965030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636869978, "uuid": "af3e79a0-5a6b-45c2-97e9-3b111195a2bc", "value": "T1E0A40200B696DCBAF0DF29304978C7A4273AB932287546CA3765021E6FB37D19677317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636869978, "uuid": "e98c3954-fe38-4ed5-8513-5a7d8aac8a2b", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636869978, "uuid": "153bcf29-51cd-4f00-a1d8-dac946df3d6a", "value": "12288:zwmXoeSHpbCUtTQauN04OpBAjZRNGk3P9nQ62cOyMK:s4SHR0nOpBwGo9jkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636869978, "uuid": "f760f887-141e-41e7-8078-d21a16737333", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636869978, "uuid": "ef147025-5595-4764-b736-649e821ca008", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636869978, "uuid": "e637b5a9-11fa-4cb6-960b-e29b9c224fd1", "value": "3e2248e6b8b4056a604432a1b3d57d5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f660ae2a-458b-11ec-843c-42010a9c0014", "comment": "Malware payload (Neurevt)", "timestamp": 1636922797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636922797, "uuid": "e9bc0adf-47cb-42c6-973d-94f1078c2fa2", "comment": "Malware payload (Neurevt)", "value": "41c024a983c2d275508094a92538eb1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636922797, "uuid": "e7b62e91-4c85-42b2-b5f6-d35b0bb7b1fb", "comment": "Malware payload (Neurevt)", "value": "1b2c4ed9193792bfe48a5722705085e2afa7c14fd19512cb280e9750924852b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636922797, "uuid": "6cb97d9a-c500-4a4d-94e5-c9ec66df2359", "comment": "Malware payload (Neurevt)", "value": "eb56e503ab95dfdeeedfa1a6f67a783b602b6f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636922797, "uuid": "de80e81c-b40f-464b-b1ea-075a46749b95", "comment": "Malware payload (Neurevt)", "value": "98aabb2cd43f9111f2bb924fb93b20e111f941fee35e87a879a3972067e6e97c6d2b0ece322a45b3d8865fe65c5265ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636922797, "uuid": "53aa2cb2-26c5-4ae8-b286-d8b2d96442ac", "value": "T11854F1B5235CCE5BF65F6378A6225227F641448DF6B79672C4299380274340C7F1BB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636922797, "uuid": "1c47811b-fcbc-479b-b894-d3682fa04073", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636922797, "uuid": "b9bef9c6-ffc3-4dec-8141-375767e5a68a", "value": "6144:G3eRvQSrr1GH050DzklUV5G2AsVH9giZbJe/m:geBJ/2VG1sVdJbJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636922797, "uuid": "a4306ffa-6603-4107-9d9a-865edd45061e", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636922797, "uuid": "f6998b97-eb9d-4828-9a41-9c9f805165dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636922797, "uuid": "589d93d6-d84f-48fc-8762-0d6ea9886f0d", "value": "1B2C4ED9193792BFE48A5722705085E2AFA7C14FD1951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db14a58-4544-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636892047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892047, "uuid": "fc33376a-ef7b-45bb-8113-2c2a85fa54b9", "comment": "Malware payload (Mirai)", "value": "b8c42497877afa1dfeb14c4ae0223c67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892047, "uuid": "7cfc6ca6-ac8a-4cb9-80bd-6ba8f2d00853", "comment": "Malware payload (Mirai)", "value": "1c407fd5ca5fad72eb177e1f529f8822b44c40173cdc3985d4ad85c88640f140", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892047, "uuid": "cd1e0606-373a-4af3-82d8-45e2ab8010dc", "comment": "Malware payload (Mirai)", "value": "57303d100c47fec239261f0a6a4ae19ad80cd07e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892047, "uuid": "57a952c0-4d99-4c0a-b5c2-b55161ebcda4", "comment": "Malware payload (Mirai)", "value": "1d0e9114bc546d2a2585503fa71edda0110cc1801099e4c8b4fe8b3f086e7f35a32392a1a5bd7da86ef0576a4dc0a4a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892047, "uuid": "dc626f86-56fc-474a-bb0e-417947d7f0cd", "value": "T110439D71C8B8AEA4C20906B4B918C97DDB13E40495E32EF6DB95CA4A8407AFDF0587F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892047, "uuid": "5ad5da45-ab85-49d0-8872-05e5ca9b0546", "value": "1536:0/8AAFgloaT/llUzcKQWfs3ZYhKmVCWe:00AVKQtlUzcyf+ShKmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636892047, "uuid": "d776c927-d807-40bb-83ee-e1a7f8a1d855", "value": 56396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636892047, "uuid": "bdd84678-8f73-462d-a8de-105c2de77ed7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892047, "uuid": "a69f8a52-96c8-4ef5-a42b-bffa736da251", "value": "b8c42497877afa1dfeb14c4ae0223c67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674d42a1-4545-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636892492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892492, "uuid": "7aca2815-6037-42f6-9bfd-0ecdf89e7741", "comment": "Malware payload (Mirai)", "value": "008e38f1166f34aa88f118fa017b9a78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892492, "uuid": "82e4b878-4761-42eb-837a-93a719f46a02", "comment": "Malware payload (Mirai)", "value": "1cb5f6058a79eb7390b34ac5d7db34e8e30c955f40bd53d0f02be535cabad008", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892492, "uuid": "c6337e21-06e9-41bf-b366-8fde10ddc0f7", "comment": "Malware payload (Mirai)", "value": "9c8590baff517e3c1e7b235656675b82473a0ced", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892492, "uuid": "85e72572-c1ee-4d0f-ba23-93e90ae726ca", "comment": "Malware payload (Mirai)", "value": "9dbe3bf1f9b2dd5d8b624b72737791b7a3c00a9c854a55c452dc8edfafde17779fe2be364983462f62f9e3f0b6eb6d8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892492, "uuid": "65ae887a-a6a3-4ce7-b24f-ea4072013f15", "value": "T168533825E9391A16C1E8B17B11F7C315F2E2230D66B4865E7CB60E8EFF14A00A9573B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892492, "uuid": "75e0e288-c460-4613-a25c-d0a7d3044668", "value": "1536:QXpqnHto8lsAg96puaoTArs1f7l6vTt4kZZDFT:QR4IdsvT5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636892492, "uuid": "b1c76a43-fb5a-4ba2-ba85-9ea047988df9", "value": 63552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636892492, "uuid": "9208f56f-3469-4c5c-b60c-049170db89e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892492, "uuid": "eb83fa9e-8b5f-4f4d-85bb-08ae87e574b5", "value": "008e38f1166f34aa88f118fa017b9a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375c8637-451a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636873944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873944, "uuid": "7a11675a-7d54-45f7-bcaf-6d946680db3a", "comment": "Malware payload (RedLineStealer)", "value": "c3bdc1ba0408a859d3a7ca625b345ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873944, "uuid": "78f291bd-f79c-4a83-bfb7-6b7ff61392e6", "comment": "Malware payload (RedLineStealer)", "value": "1cb91d2ee0f25b1a43a243d3b479fcea43cc115b89932d780e5aa5d650375b35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873944, "uuid": "7d5144e0-81ac-4e85-a966-16d3decdafd0", "comment": "Malware payload (RedLineStealer)", "value": "cbfeeafbc7eeddea21337bcdf8e2dcfc19412076", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873944, "uuid": "fa99a0bf-5ec6-4eb5-9885-a14c00ffbf1a", "comment": "Malware payload (RedLineStealer)", "value": "b0c0f0886f2bb306433d7f518ef01586b2b38a45257a817ef5666a7907586f2d9d0369a8180cbce3d2dd7189fa372e86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873944, "uuid": "65e27606-846d-417d-bb93-5e60dfe8a7e8", "value": "T1B764CE025DFAF65CD162FF338FDFEDAD47B61991463249C61A48EA4222125013F27B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873944, "uuid": "f97d08ca-3536-41c6-9e41-7425ebf615f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873944, "uuid": "870c2102-f5c8-4a79-b747-df52ce6cc8ac", "value": "6144:IAKhUFZdjI8S0/EBhNUQlYO/9qDPnwwKuhVf6Z3sK6OG:1yQZ5XBalbGwwthVSZ3n6OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873944, "uuid": "cffb9110-4a5c-4114-a79f-ad32b186bdb0", "value": 329624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873944, "uuid": "2b7f769c-d489-4203-9dff-9485299d50f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873944, "uuid": "86fd26f1-d228-4d1f-9a80-7164d3f75846", "value": "Genhisn Impact hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56341036-4506-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636865406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865406, "uuid": "f0a48e57-eba2-481a-b034-06fced615fe8", "comment": "Malware payload (Mirai)", "value": "649036840541841ee7de5541a2d563dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865406, "uuid": "00ea6754-ef42-41e0-883c-64b66cf94309", "comment": "Malware payload (Mirai)", "value": "1ed40e2753937f29e671c8469037578ffc92c0b7b00bdd57e99e721e23995888", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865406, "uuid": "9596e842-b97e-46a7-8aab-77ccdc4482c7", "comment": "Malware payload (Mirai)", "value": "48d245118269cc2d77d780c27d8456155fbfed8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865406, "uuid": "95f01fbd-29b0-44a2-9774-0f2248d69b0d", "comment": "Malware payload (Mirai)", "value": "b252f84d7ee3c1ff2e47f67f9d5bb6b0a2d1deee4b54f598466b1c0295e18a7c0231e90c4d009e9bc144132a41553b60", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636865406, "uuid": "f36897f8-e99f-444e-8667-aa945181e069", "value": "T1F83301C09608B435CA701C77BD3CAC802D7E0B6E68C2719F862D15FFE4A5087BB65B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636865406, "uuid": "ea878275-b72f-4ba0-8a5d-bdc62eb4abf6", "value": "768:6AWkn5pJ7ZgXHMo45I7ypHb6LTODrMqXJvbB7F1TQkYfjWqBz9q3UELSOs8qMLPP:6sn5pJ7ZWkpkS8QbhFhSByLvV+os8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636865406, "uuid": "6d245d57-aec3-48b4-b46e-3472494066eb", "value": 53616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636865406, "uuid": "1e365bb8-6965-4e38-ac7e-2177b0fc2991", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636865406, "uuid": "d4198a4d-2451-453d-901e-91b86424621f", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cbd322-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1636874582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874582, "uuid": "ebcc3add-eb02-4eaa-bf9d-2a5c78fcb4aa", "comment": "Malware payload (ArkeiStealer)", "value": "2785f4d0d7d3394cd5cb0b363c92b76b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874582, "uuid": "0c727a3e-3a66-4414-83c3-2e306a97c3ca", "comment": "Malware payload (ArkeiStealer)", "value": "1f368d2e053fa7fae72b5afd698ab01e72472eb2596066babb6347d9547a8987", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874582, "uuid": "77e6cfa6-d8b4-4dd9-9244-587755540ff4", "comment": "Malware payload (ArkeiStealer)", "value": "7001340bf80a0200bdc34846bdadb30018894530", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874582, "uuid": "5d683445-33f8-4e84-b258-247ae83cae25", "comment": "Malware payload (ArkeiStealer)", "value": "b488e42383c3891f4573a9966d1b96de7a091ac1e872a6d964802adb9a1efa56cb338fe4380d0d9cd9266a45c2d4d332", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874582, "uuid": "0c62e21a-befa-4126-9f90-24143d783756", "value": "T1FC75CF33F6B24837C53227789C1766549C3ABE012A68588E2FE55F4C5F3E6403B396A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874582, "uuid": "726918c4-5b0b-4eff-9b81-afeed2c2245e", "value": "c90c499be5e32ca363e055fff42e37d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874582, "uuid": "cf0e8cac-6b52-499f-a5ac-ce4a33368d35", "value": "24576:BxkWvVhcEpQzIV2LPsDNUWu6s+4eI6rUg+gybEnlKoHFwbyrVo4euCyHXL+MQc36:Bxlt7QzYwPlWu6gg1nl3lwbyC4RGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874582, "uuid": "41a38d21-86d1-4987-aa9e-337a1b1b89c0", "value": 1659392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874582, "uuid": "250e06c2-2d10-42bc-8c6f-d287583092e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874582, "uuid": "441d8d56-2eb8-4d29-8043-7cee044a5b72", "value": "2785f4d0d7d3394cd5cb0b363c92b76b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7e8665-45a3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636933033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636933033, "uuid": "fad2227b-63b7-4641-b1d0-9da298e3357b", "comment": "Malware payload", "value": "bee283cd65cd826f738265a84899b0f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636933033, "uuid": "6bfe4d32-4438-45e4-8da8-83f10ec4fd0a", "comment": "Malware payload", "value": "1f7d2fb2ea88483fb17e6df444dbd217ca203d8828d29d1c998cd007d1124dbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636933033, "uuid": "2b1b1640-2a61-479c-a2bd-1c220396cedd", "comment": "Malware payload", "value": "3829411cee33ea557809e0648e32ef46d7980074", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636933033, "uuid": "bc10dd00-cfe5-4efb-ad45-8d2c60aa4fe0", "comment": "Malware payload", "value": "0c67146b8286292d01956436b47edb0778a900aee9956d734ccd5fb74b738957dd4e18c92953a6d3e8bd27113d6b8f44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636933033, "uuid": "4bd23855-7218-4ef7-ad4a-6327e033997b", "value": "T1CE248CC176E18C36E19E3E3154648BA0162BBC32D930953AF7B4972E1E723D05EE571E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636933033, "uuid": "2c11ab36-e233-4576-b7ea-06d7adbf55ec", "value": "e26afc83cc50f029d0d1352e4ada9f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636933033, "uuid": "3fa68bda-b166-41f2-8a23-b7fd34c9f832", "value": "3072:U7qwDWvf9UgqRf6+gL/aOB5qfiK5bscVggjcGkNIVqI7sxkgaBChMpZa9uD6VdyV:RvVUgy6VL/ZBK37ITsq7igavwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636933033, "uuid": "afce20a1-5b4c-4264-9be5-760ee8d6217a", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636933033, "uuid": "d0038b52-67c1-4fa8-93dd-f9e51aec160a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636933033, "uuid": "693cc12b-bffc-4da1-b00b-73973e3dda39", "value": "bee283cd65cd826f738265a84899b0f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4de0bc8-4553-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636898662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898662, "uuid": "2c620862-149d-4e3c-8dba-498e72909475", "comment": "Malware payload", "value": "557f326debaaf3a7e8523a2efcd68032", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898662, "uuid": "6178e2b1-04e1-43c6-9f26-f1965e3cba1a", "comment": "Malware payload", "value": "253475cc935af014ede78d7c0b899d560015c6fa820bc5cae78203afc2eebe98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898662, "uuid": "5fd5cdcd-1918-47d0-939a-28a4c1b351b6", "comment": "Malware payload", "value": "3bff709e3a76d9ba5e10550a417cb6dce9e760cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898662, "uuid": "4e7a36a5-f032-4be6-a9e2-25e9e772163d", "comment": "Malware payload", "value": "d57fa683c0b87a5c275269247c11747438dea019fe90a1f4705edd69a35985bb9be7c95b43646e6fbaf432b3d942eb45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898662, "uuid": "6bfc8dc7-51c2-4d9f-9505-d24801e5a85c", "value": "T1EED3E02D748CA5B3D08401F55438A391922DA93216B5C19BBFD85FAE7F316D2C23A36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898662, "uuid": "d9b6bc9f-07bb-46ca-a8ad-2d33921fca2d", "value": "c9456243e54acf05a6457b2b88bab50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898662, "uuid": "e07acea7-9af4-4633-a672-b961c10a3271", "value": "3072:SvIlLO58NhcQbgK4ejYifE5bye2HKNgw/tTaASBogA7BMP5:zLO5STkKQoE5b5mw/tTa9GgEBMP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636898662, "uuid": "7fcffdb9-1f7c-460b-b106-c73924be9d7e", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636898662, "uuid": "4d2082b5-0cc9-4070-9836-2555ca862f95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898662, "uuid": "491f1cab-6bc4-4ba2-b8fb-736ca98731ef", "value": "557f326debaaf3a7e8523a2efcd68032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b91f2a-4518-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636873220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873220, "uuid": "317e83c9-d220-4993-b2ad-c428eb0466d4", "comment": "Malware payload", "value": "be72f225d1595ffe5c22c1f7adc4fc74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873220, "uuid": "378f147b-d3b2-4eb9-aa37-e91a128fd1e3", "comment": "Malware payload", "value": "2585845349d420cec529b285a268b989ba28f135aa5332d3ce9122bbf53b5ce4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873220, "uuid": "f729f4c0-f59c-4b2f-8d48-36d11f685614", "comment": "Malware payload", "value": "14ed85007d7c4b4368d8c101c0e19b337a3dd084", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873220, "uuid": "2a9bef23-4c78-4255-8287-310c4810f90f", "comment": "Malware payload", "value": "4247afd12a1d5e7e88caaec9194c8d8d2cafab84844cca044817141469db3caef13f0161ea93327c03daab1eb64a8480", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873220, "uuid": "3ae0f93b-164c-45bf-b190-2ba35e12d5a6", "value": "T1343559026B697FEEE03E57344025088853F8E5579B72DA0B7FE5A4C71863F418A4EE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873220, "uuid": "cc460a32-4ed7-48df-8a94-ae577fb2087d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873220, "uuid": "7d0be60d-35b4-41b0-8845-c884f1a602e7", "value": "12288:LrbzZfiS0/pqooqeRgKzGVn9CPbGd4nq1ZEB3jwme7wYuM:HfMZRQGhMTGS8gzwmeM/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873220, "uuid": "b3dd7c39-40b9-487c-a056-cf4d79d88e13", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873220, "uuid": "1632f406-a8c0-4849-97ce-6348e9a04891", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873220, "uuid": "ba5369f9-a389-409f-98d7-dcf3fb4018a0", "value": "be72f225d1595ffe5c22c1f7adc4fc74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa4c1bb-451c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636875023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875023, "uuid": "d54fbf7a-6baf-42b4-8ad0-4d27431d8620", "comment": "Malware payload (RedLineStealer)", "value": "f3acc02f5ea2bc46d22802d65c8bb687", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875023, "uuid": "22f3b13d-a846-4d4c-a8dd-4c82dbfcc2bc", "comment": "Malware payload (RedLineStealer)", "value": "26f7c7b83733f91effc4a8b1e30e87a66aba1420d9669ddfc886f9c0aa27bfad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875023, "uuid": "33c04722-28c5-4ded-b2c5-bc30d6cacc73", "comment": "Malware payload (RedLineStealer)", "value": "b47b3f1e927165bbec555e7ef243cfb84ed0be47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875023, "uuid": "180620c6-525d-405e-aea0-e3d8bbc2cbb1", "comment": "Malware payload (RedLineStealer)", "value": "3bc3ed380dbd26da73a279a7558280713959a70c233bafe51253613c2ad13a1ecddcfa716dbdfeacfe8ed69cab964384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875023, "uuid": "f30b4b33-bb28-43c2-baf4-6500e02b8220", "value": "T16A74E0032EFEF758D0B63E334BEB9D5157FA7CE14B32598A1E089B0515529422D23B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875023, "uuid": "109d40c1-4a0b-47d3-a138-c9f6eccf97b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875023, "uuid": "d813453f-b35a-4630-b6cb-20e63631d11f", "value": "6144:4057ultFaw+3HkW5HVZXPgVt/+Z4hBK9A04SyidmD5jOi:F6TEHstmZ4nyeVjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875023, "uuid": "63b88070-fadf-4e19-b31b-53129e885830", "value": 363928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875023, "uuid": "29f06e4b-2c31-45c0-856f-d19baa752695", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875023, "uuid": "7c679c41-bef2-48ba-b6f3-7c20f693da01", "value": "Terror Mod Menu Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4523ba8f-459d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930231, "uuid": "1748dbe9-cc6b-4529-bcb2-6697a9e01c49", "comment": "Malware payload", "value": "4108f630579979cfb8ca2bc73dcbdc07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930231, "uuid": "0da1647f-8df6-4792-852c-92eda7be8a2c", "comment": "Malware payload", "value": "2776a758c38bf9f909a46c0e58dc62a2b5f620e487a06f43aca79ca61d110fe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930231, "uuid": "d6b0c07e-fcfe-4c22-a3d3-9710a40919a2", "comment": "Malware payload", "value": "5d3e9ee3e462dbcf826aa3996c46378effc736a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930231, "uuid": "afb069e7-8ff4-45e6-b9ce-07f823cb08df", "comment": "Malware payload", "value": "f61c95717e350ee30a5871b9489c9500f80fa0854c3a739914128edbb02d855bedab66d878409db69f40959a34d75a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930231, "uuid": "f6c47b03-f9c9-4429-af4d-0a9d3ee44ab5", "value": "T17016E0DD721072EFC857C472DEA82C68EA60787B931F4203941755ADEA4D89BDF284F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930231, "uuid": "dea25610-ea61-4c92-9b71-7e0e31b2e3b1", "value": "98304:E9h+oxMDlS8YL3yv9lkylOGcFkGHjiY52Lu8v39:ELtMDA3Cv9lHOGSNHjiC8v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930231, "uuid": "5eebb1d4-f6e5-4cf1-bd29-29d26b4b98f5", "value": 4271616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930231, "uuid": "b9d8288e-9aaa-4756-9c8c-d216721cd6a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930231, "uuid": "711dab82-67e4-41be-944b-5740237297fb", "value": "SecuriteInfo.com.Trojan.GenericKD.47399276.20832.1140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c788bf1-4543-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636891723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891723, "uuid": "b125f481-7c26-4039-9599-0267e2b3c240", "comment": "Malware payload (Mirai)", "value": "24586fe07bb6a723f72bf39a21ac9646", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891723, "uuid": "f050e4f2-d9ad-431f-bc03-60449c3cd748", "comment": "Malware payload (Mirai)", "value": "27a13f94613c3997013ea64b29277080b3fa5af4ea23a50542ec5d4d0ade538b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891723, "uuid": "8011ca2d-c1a8-4177-b58a-bafb06d31bca", "comment": "Malware payload (Mirai)", "value": "86d625c8862ab0225f42900b08c2927038584147", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891723, "uuid": "8cbfb8f9-d21d-492d-8c63-6ff8408a78c8", "comment": "Malware payload (Mirai)", "value": "296db869a5ec42ff0dc48bcc0ed18b026377d9770112c6a9b9808cf6352a3a9d6695d6c1e55f72fb922807c738ef2f9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891723, "uuid": "f08f16d1-8785-465f-8a5d-bc8eab7a50fc", "value": "T153433A02B3984D4BF5961EB0213F1FE597AFEDA125E4F584690FEB068132E37414EE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891723, "uuid": "a9f8f4e3-b62d-4a5c-ac00-147c6d4b753f", "value": "768:C5Fhl9H4kOxCC3nObR/OC5/+D3fFze0Ordr5iOBcW2AnxbhOXixzsFSjBf/K:MoxWbaDP80+yccBi1sgjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636891723, "uuid": "abdfbc82-b3b2-49ea-bd42-91adde2fc51d", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636891723, "uuid": "8d30706a-f60e-480a-b0ed-d1d7f239e3da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891723, "uuid": "c2de257a-8c52-4261-bb92-5de463b5f643", "value": "24586fe07bb6a723f72bf39a21ac9646", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e41df2-451e-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636875736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875736, "uuid": "3ef8fc41-8f84-4d7c-b610-d723bbd83770", "comment": "Malware payload (Smoke Loader)", "value": "933a9ca6c5425a81adfe5b2fc95754c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875736, "uuid": "982298b2-180f-4c2b-89c7-20c482d2cbbd", "comment": "Malware payload (Smoke Loader)", "value": "2895cb29ca63bc4cf8a36af8e029b8bf14be582273d98d203fafaf8f89db27d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875736, "uuid": "d2bd1b8c-c965-4a32-8cbe-ef6f5b55d899", "comment": "Malware payload (Smoke Loader)", "value": "b3bb30884f8c32cb357edfade6d2c36fa9522269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875736, "uuid": "f53d41e9-7214-4e3c-854b-7facd27a3c41", "comment": "Malware payload (Smoke Loader)", "value": "728f53ae2107df50fc67409125ea631518ae8ce21caa2e0fb47292d02f8203b37aeccb440a37ea7cd719a6383fc871a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875736, "uuid": "b9e92bf1-1b83-44e2-bd1d-ecf2bccddd25", "value": "T1F5648D00B7A0D435F5B666F849B693A8B53F7EA1AB3490CF12D526EE96346D0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875736, "uuid": "d8e9b072-6e9a-4a6e-880e-a962143fe225", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875736, "uuid": "d694a1d0-3948-4938-8213-09383372e440", "value": "6144:C4yscz2VLa1c59FZ0HGV8DR/XeQG6yUvD:u2VLa1c59FZ0HGV8JeQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875736, "uuid": "e36316c3-fe25-4cb9-b0f0-6395baf8e4c2", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875736, "uuid": "b2808d81-83e0-4829-b19f-04ecf4be6a17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875736, "uuid": "d377ee58-ee5c-42f4-9b25-542d0592cfdc", "value": "933a9ca6c5425a81adfe5b2fc95754c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac82430-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636874594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874594, "uuid": "ae4b7214-9462-44db-8105-5a3704208603", "comment": "Malware payload (RedLineStealer)", "value": "0665ba719ccec50da756b5e3048584ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874594, "uuid": "a477a8fe-127f-4da7-901a-dce94bb941c3", "comment": "Malware payload (RedLineStealer)", "value": "291ab20ad023093d78e6cbdee32629fb3c70a6754171253337d568e3752eed5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874594, "uuid": "84d28a0b-cae4-44a9-9909-ee415532d30e", "comment": "Malware payload (RedLineStealer)", "value": "fcf43914e92ee6a1a76c9312038bafee6bb44236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874594, "uuid": "afc579be-8755-4cb9-9169-f486aa56cfa1", "comment": "Malware payload (RedLineStealer)", "value": "63d2454fc05c232b628ed73cbd139f1dadf1a8efc33b6a69872972dbe52e589d07764119cbe01a5bed89e11821c3c92c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874594, "uuid": "d010fc7e-42d5-4dac-a115-379890056126", "value": "T1AC74DF033EA8F66CB056FD7343CB5F594BA73CF14A7259861E49DA0319212826FB3729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874594, "uuid": "0d94fe2e-1662-4976-a410-f9eed23c0cf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874594, "uuid": "6fa1f69b-bb5f-4618-a412-278a14721213", "value": "6144:riU9UKDm7fxx2wTW4vU2vgVVf3G73qz3by5:OKUH7xW4M2I/frzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874594, "uuid": "2f721160-51a3-4865-8544-1162e23248c8", "value": 357784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874594, "uuid": "1bd6ae4b-f416-403d-af2c-0018571c524d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874594, "uuid": "6c7fde13-7f23-440b-8d72-9bff2e989d78", "value": "DullWave.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5726d6a8-4506-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636865407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865407, "uuid": "ecd39a50-475c-4425-a0d8-a9e1314128cf", "comment": "Malware payload (Mirai)", "value": "ebbd986848e3c85e3ac37c23fe113861", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865407, "uuid": "0376bd3a-7f9e-49dd-ac78-a60dff471e22", "comment": "Malware payload (Mirai)", "value": "2a85b7f013d687b553680ea1c687d40ca0e656560c510c34e97b3b217db993f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865407, "uuid": "a5a98bf0-401d-4680-8744-cccaf97b0682", "comment": "Malware payload (Mirai)", "value": "08244fb274a95baf6f999f0353967671ef61bccd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865407, "uuid": "64fe6af2-5d9d-492d-9a6d-0d3663b30f0d", "comment": "Malware payload (Mirai)", "value": "2ee0658fa633cab6a68d4971bff4873fbcb087686a1e1c98d1b2aef3fc73c059be595114d77611ca6a8233216cfb5b68", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636865407, "uuid": "56efe8ba-ad5f-4a50-807b-134785a230af", "value": "T123D2E1F19D34A473C4DC463EDD2CC45B228EA07CE567156AD2C6650268FBB0D79D3B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636865407, "uuid": "1c1e95b7-9fa1-4c68-b0fd-028d37b58ef0", "value": "768:40iH8FHtmpb0eJ7LI8GqRZLYbw+gQvQrMHFbdsNs3Dm8RztKlmqS:4fHwHtmtvJ7Sc/yQMHFH1RztN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636865407, "uuid": "869e9c05-db36-4870-b996-f27b7c6beae9", "value": 29896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636865407, "uuid": "45701952-d9ee-4199-9181-dcd80d73364f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636865407, "uuid": "c8b8ba25-e08e-4d26-b70e-d966c73b403e", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfd23c1-44e5-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636851376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851376, "uuid": "a4bbcb1c-4fd3-47e9-af45-299112c50042", "comment": "Malware payload (RaccoonStealer)", "value": "3b20fb18cd0fa132c032a1799e8d5350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851376, "uuid": "22a9eba3-718f-47d1-8e58-6ceb60fa863d", "comment": "Malware payload (RaccoonStealer)", "value": "2ac90195f9c08180833d92f039cb9c607a13bc021971fbad767e8194d88099d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851376, "uuid": "00fc3046-1c2d-4d1e-8817-8ce3572d4fb1", "comment": "Malware payload (RaccoonStealer)", "value": "e70be116274e3b2256396a85ce1aba23d2284fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851376, "uuid": "04987cdb-8d1a-4c25-a64f-867d527a840e", "comment": "Malware payload (RaccoonStealer)", "value": "a9988abac3ef931d199abe43ce395c7f3bafe8a7c7dd134d7708f49004c29368b8014bb75b49cd2e96cc5cb62e42f176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851376, "uuid": "65dd063f-d813-4fd4-8da7-2b2f06dd8157", "value": "T116C4E000BAE0C035F5B726F94A7993A9B92F7DA1AB3550CF22C526EE56345E0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851376, "uuid": "f1ae4957-f304-4527-90b6-332625fe9657", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851376, "uuid": "0c6ebbe2-567b-45af-bdc0-cef25d82696c", "value": "6144:hmjFKf+ZJgzyi5/UlutKmphrMiODcmdqMor3Rpn8CJO5rQh9+67foC7H27WQHIOv:kjFrZJqRKMt2jW6QT+67foC7H2XIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636851376, "uuid": "ae0370eb-b48a-407c-b14c-e1f4420e5f99", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636851376, "uuid": "517d7f4b-975f-4ff7-992e-b9b4c83fe868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851376, "uuid": "9c65c466-9207-4a34-a0a6-1a927aa503df", "value": "3b20fb18cd0fa132c032a1799e8d5350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3098aa0-457b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636915866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636915866, "uuid": "ee10e80f-bc0a-44c9-a9e2-71fd9f46fd3c", "comment": "Malware payload (RedLineStealer)", "value": "12342feefbbd138773f163504d3c5bd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636915866, "uuid": "5902d3ff-29c5-45c8-9a25-3cee2aebf356", "comment": "Malware payload (RedLineStealer)", "value": "2b18dd26cca7561a072ebdd126d4410cf22070ef9cdffafdb5c7ed4ffc40d08f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636915866, "uuid": "7190ed52-3fe0-48d9-a3d4-491ba18cbe58", "comment": "Malware payload (RedLineStealer)", "value": "f95e88b5dc34a6b28e010780312e2123490966c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636915866, "uuid": "8bb3f298-24b5-43ec-9e7a-3fa2c37b8480", "comment": "Malware payload (RedLineStealer)", "value": "5a978991fc5c36b73f2b170e1bef0a308cd9018179801ab34de180bb27850c628f7cd659e35df0d8d205f2e514449c2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636915866, "uuid": "45d54451-f99e-417e-bb99-813fb3d8f836", "value": "T1C884CF10A7E0C035F6B712F44A7A9378B93F79A1A72490CF62E526DA57716E0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636915866, "uuid": "12306a50-761c-40b6-a94b-1552332cc35b", "value": "5f60c500db75f47142be06e755ed4aae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636915866, "uuid": "9853e5f7-091f-43ce-a3fa-fea53f5dd886", "value": "6144:Ym+5VILWzuApLD4vmHaoduJD5WPGn1khjvdGd/gKawjtAg:oknA/UD5WPGnKFv4IR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636915866, "uuid": "9315dab6-5ca9-459e-a2a3-cc618505ff7f", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636915866, "uuid": "8a377fbb-bf8b-4147-b443-96f83432b0f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636915866, "uuid": "e6becba4-3a9a-471e-affd-f30572f6f819", "value": "12342feefbbd138773f163504d3c5bd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc58773-451b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636874464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874464, "uuid": "8cf64ada-59ca-4a46-afc2-adff263d44e8", "comment": "Malware payload", "value": "aa557208f21ea676ff97d6cee2566ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874464, "uuid": "d23827e2-b03a-4e60-b6b9-ef2e56c344ac", "comment": "Malware payload", "value": "2c38920864774dad1c2f43546ace95b8fb09ccb8439e5d7389639fbc1c9153b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874464, "uuid": "6f62c9d0-77c0-4b68-8a45-49dc531b1f2c", "comment": "Malware payload", "value": "9358a1a5164dbea597583abe1e1bfa2353e7ce2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874464, "uuid": "5675ccb7-9517-47cd-9fc4-0ebb6b6c93b9", "comment": "Malware payload", "value": "0019107685a0b6cf8c76015d15b336e0b05507f2d06feb6fb458d15fd40472c2ac04bcb99c534ffd59c747527c860d2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874464, "uuid": "79f8ac17-ae38-4bf2-8f84-a06b1765adea", "value": "T199437100B2F45F27D7BDA7FA156161100BF264AA75A0F39C4EC6A1EE6566F801F00F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874464, "uuid": "68b43c25-cd4d-48fd-b90f-8353fffc334d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874464, "uuid": "0cd251b3-e7f4-4937-a9d7-80afc9019d00", "value": "768:8NLNCnx3esWefu390ji3cUugBmoK+3dUyqFTpH0vQIVN2dOrjWyBoRJ8HUQ+K:MC0190EmoK4duVHeVNcOrjWyaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874464, "uuid": "31c8af37-a58f-4c05-a1c1-651d8078900c", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874464, "uuid": "d7ecc0e1-0740-4aff-bf16-f7fca111ef63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874464, "uuid": "c8ec5a6f-807b-4ce4-af34-ea0b1da04659", "value": "aa557208f21ea676ff97d6cee2566ffe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11e7be7-4587-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636920963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636920963, "uuid": "f1379d70-68d8-464a-8925-ad587174182e", "comment": "Malware payload (RaccoonStealer)", "value": "485530d4c9d359f1b6810e7438550d3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636920963, "uuid": "d81f68d0-d159-4fd2-b67d-c6c45ec89bcd", "comment": "Malware payload (RaccoonStealer)", "value": "2dbaa3f2ead6dc481674eae6820704e3b6f3be60b9958340cf0a07b893d6e68f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636920963, "uuid": "d0865edc-48ef-4194-8ea8-25c8525751c0", "comment": "Malware payload (RaccoonStealer)", "value": "ca91a653be7c60a018e629f7e0250243e247f5c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636920963, "uuid": "7e5ffbfe-7918-428c-8a45-5bb93e42310d", "comment": "Malware payload (RaccoonStealer)", "value": "be7f5ce98fdc4d2da5e3199c266c869538aadca5afd7a5d8665d6ce0d2ff2eae3b8fd0042a2aaab068db477ba28b5cee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636920963, "uuid": "9e80227e-c556-43f4-a89f-991a2b12bdd7", "value": "T1E0B4F1C1A7E29431E4A23F3099659BA01B6BBC71D834945AB774A72F2E733D09671333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636920963, "uuid": "46b745df-0395-43f0-be5b-4fc4c3a744d8", "value": "9510c947cc2282bdda1a9b4a47d8d006", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636920963, "uuid": "cc23170a-89a0-4cbf-a25f-a01b2c9cc2ae", "value": "6144:3RtLn9JpKIy3iPChEC1Dn6XPKrHq6Vuon2vEULR7fYcy/8rTfR27kH/yTB6L1JAO:33Ln9JpKU0E4GyrHCeKf7TFfy1W1879", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636920963, "uuid": "d82afbd4-c2cd-475b-994c-a04c630aed1d", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636920963, "uuid": "d0eb96f3-9c44-455b-b56b-24a49ef34417", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636920963, "uuid": "48a9f611-d9e9-4a1b-97ad-abc6b7f0997a", "value": "485530d4c9d359f1b6810e7438550d3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649c3f83-4544-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636892058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892058, "uuid": "733a9612-e38b-4244-bf86-a2a715e41497", "comment": "Malware payload (Mirai)", "value": "932769b30d51b46de5384a1cfdde0a6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892058, "uuid": "e497a970-755c-4d3c-a0da-1128d1e62dd7", "comment": "Malware payload (Mirai)", "value": "2f11943e3d3e3c03e6de52c17138036a7c9bb1b506a1e496b5cc27353292e2ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892058, "uuid": "a03fba0c-be51-48eb-8be1-03db6b1362f9", "comment": "Malware payload (Mirai)", "value": "b5cb9604b8902c95ba9a1f826e6a2e821c99e42d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892058, "uuid": "3c489e63-02e2-4fed-a4f7-befb7cd476e7", "comment": "Malware payload (Mirai)", "value": "2ef11aa88dc14aa3b8ae861c76954746ae50d6f993e641ac1782ca4f3cccdd606433fbfdd6ec4408983ed374bb873c37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892058, "uuid": "28f6ed19-fef5-4cf9-b7cc-34a07eeca54d", "value": "T1F0732A86B9519A25C6C516BBFE1F018E33024B98E2DE73238D145FB077CB95F0D67A0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892058, "uuid": "e5ef7fd2-089b-446f-b3ba-425a2eb16ff7", "value": "1536:FRnZKF0ClS1lZGxiqMP0Iq2j+uzVLc1KrNMCHd/zzISiTIRK6Go:t5CFxgsiPhLcsZMCiIRK6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636892058, "uuid": "2ea7cca1-9e46-4527-9498-ce0da7481017", "value": 75052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636892058, "uuid": "2e10764b-a3c4-467d-af38-bcc1583864b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892058, "uuid": "45cf4495-5f3f-4cd7-ac93-a8bf0997cefd", "value": "932769b30d51b46de5384a1cfdde0a6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff58586-4580-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636917686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636917686, "uuid": "a2e90e11-f8c8-4ad7-b59f-b3c339452ca1", "comment": "Malware payload (RedLineStealer)", "value": "2c4d94d76dbd153e4e13d5d179d090b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636917686, "uuid": "8d32f9fd-c9cf-4478-ab16-5353a7c76f73", "comment": "Malware payload (RedLineStealer)", "value": "2f475f00571b3b739cff8c945ec60c76506e99048550b0e7a5632a1c9cbcccb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636917686, "uuid": "a5439657-469c-4c4e-ab56-5312bc3c063d", "comment": "Malware payload (RedLineStealer)", "value": "308db63dc905f4cbabc3c5fb7e1b8c98a4f16516", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636917686, "uuid": "e30b973b-d056-4d80-bc40-351c17a9ae3d", "comment": "Malware payload (RedLineStealer)", "value": "b9905515b99d3d6bd0d3599a043f81fa2741d7d01366d7b5f2b2ac942f5a41f9c4e1da56a06813a5690f8179ebfcb2d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636917686, "uuid": "21b9bd8d-e3dd-49c4-b6b6-0e8d41ff22f3", "value": "T16316337600D1EADCDFD74B305D3E6A8DA190FFF264CD1B9235251983B4BAF212825D2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636917686, "uuid": "c901d436-0e63-4eee-9525-90192453a92c", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636917686, "uuid": "58507d6e-d782-4755-bc6b-cb6489ec37bb", "value": "98304:EKOsUoHIqypI73u90RXKPMTnqMYAv3E+9af:tOsdWX90RaeqMfc+9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636917686, "uuid": "cd4ead34-935a-4ef3-ad6a-5596d508de07", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636917686, "uuid": "b6706482-7c5e-4641-a96f-8f61db514552", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636917686, "uuid": "6986adb5-8fde-40f0-806c-2f96268f21bd", "value": "2c4d94d76dbd153e4e13d5d179d090b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34190edb-459d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636930202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "358b7cef-671a-413b-add8-ed3d2981f270", "comment": "Malware payload (Mirai)", "value": "ca5db8fe2633e30017fa8dc23830e066", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "fb8459bd-0232-4746-8a01-16d5f455368a", "comment": "Malware payload (Mirai)", "value": "303dd148012c4e22e963cf5729d45d767c7ed11628509529b6501e0b7f51f576", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "1ed2569e-8d89-4c7f-a586-0b2de9221f96", "comment": "Malware payload (Mirai)", "value": "522ab8d2156be31e57a99bd2ce8e03f8f6339bea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "bfe883b4-6141-48b4-97fd-b61f5cb2dd0e", "comment": "Malware payload (Mirai)", "value": "603d94ba1a608c3b3d37c18a7399466201d107d3d18a804bbac6565eebd2e5a7cb488e9fc3e6c1104cd682c20cb5003b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930202, "uuid": "54e543bf-f3cf-4691-9c9b-5a2737253db0", "value": "T1C723F19D6342C1DDE92444BC16470F935F6F8BC26570A39AB9137E8B9E40BDB71C26C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930202, "uuid": "dc9a6911-d98a-43b5-bc34-dccd3d14e970", "value": "768:ZngypYu+H/7JxZbKQaZC+l9AVvybgKw3I0yAy5JX3juhJIgo1cKJgGlzDpbuR1JH:lTpFqxZbK/C+XwrK+UnnjCJIgpuVJuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930202, "uuid": "033ffd4a-ba5d-4a6a-84a5-387537f2d6f5", "value": 47812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930202, "uuid": "e1503527-a154-45c7-8d90-dec92d421714", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930202, "uuid": "aa865cb4-8052-4a11-a8ad-96171ff5ce99", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3111e911-451e-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636875651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875651, "uuid": "56df27b8-eeea-4d04-ad8a-766cfa5e78ea", "comment": "Malware payload (Smoke Loader)", "value": "c4be980f1afc82f59ce06f075fadf7cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875651, "uuid": "2f5efd5c-d285-443e-aedb-8121ec7d3483", "comment": "Malware payload (Smoke Loader)", "value": "305c0c524645f5fdebb135076c3c4411a03102c518385852860ea2120093c5f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875651, "uuid": "6ef4184a-4f24-44d6-8482-bcd55bc344a4", "comment": "Malware payload (Smoke Loader)", "value": "f33d343e76c0f1192d826e8296845abf0882b9f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875651, "uuid": "e3c01bbe-978d-4bca-a514-312af6834856", "comment": "Malware payload (Smoke Loader)", "value": "3672b8e278ac7f2bf53561fa38f042240c0c9ead97c56c8210c9994e8a46bcc5e8365361aede2c10046a2ffcd05b3891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875651, "uuid": "816f2ed3-5902-4800-9d64-97b8ba92c6ff", "value": "T107F3AC147BE1D876E5AEA6306473CBB11B7ABC322D70494B2B74162F1EB32D08A75353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875651, "uuid": "801f02d8-784b-4c3b-bcae-0f6f6e655b58", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875651, "uuid": "1db7929b-c231-49ed-9939-3aa808bd2766", "value": "3072:K72BgPRRoVUAbn90gQg9GtcjG8VdpZa9uD6Vdyhk9:iPRRoVUCn9oyGOwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875651, "uuid": "c6915f80-2891-48d9-be4e-bf56eae404c7", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875651, "uuid": "92dfef8b-9ac6-4215-a86b-62bd90d18f50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875651, "uuid": "80aa608a-5032-4553-9a10-e3fa64103c53", "value": "c4be980f1afc82f59ce06f075fadf7cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e7dbf9-44de-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636848091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636848091, "uuid": "9347c4c6-168a-4f60-9285-70c682f41cef", "comment": "Malware payload (RaccoonStealer)", "value": "ffbb7bec9668b5e0496d59b209feebad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636848091, "uuid": "c4efe60b-f1a0-462d-bc37-0d616afccecd", "comment": "Malware payload (RaccoonStealer)", "value": "30a2b243996af346243dacf92e14caf4fc7d2fefaabdc900797f4d5c700be730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636848091, "uuid": "5437fa47-738d-4e4e-bff3-9e21fef96331", "comment": "Malware payload (RaccoonStealer)", "value": "090542335b499fa8a618e6fec6dd62772710996c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636848091, "uuid": "54f6fbda-a51a-409d-81f7-3013754baf0f", "comment": "Malware payload (RaccoonStealer)", "value": "97535f9a1eb8d4fb58e22b03a1afd9533248d0dbaa25469622346f3f7955cd069b9c6fe1627adfd0993e75d2c3d1fde1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636848091, "uuid": "7240beab-5ae0-4dd2-ac36-d5996cdb717e", "value": "T18DC4D100B7A0C035F5B766F849759269B93FBE91AB3491CF22C526EA57346E0EC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636848091, "uuid": "12b8b6ed-018c-4025-8098-f029902226c8", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636848091, "uuid": "f3bbfea1-5ccc-4fc0-bbe6-16528a5edade", "value": "12288:w6bSdpRC2UBKGyt3BXB/lXVtr+faYOf7pINfS4:1bSzk2sO3BFdvr+FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636848091, "uuid": "aefefcad-a380-4b37-875d-aa5d82a43f0c", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636848091, "uuid": "973ec94c-f207-4a71-a9ea-b86e60f2ca5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636848091, "uuid": "c496deee-c952-4f33-961c-56506b4c0274", "value": "ffbb7bec9668b5e0496d59b209feebad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0a1287-44ee-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636855292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855292, "uuid": "e2b31a3c-f00f-45fb-b5d7-01491f0dc123", "comment": "Malware payload (RaccoonStealer)", "value": "700cb40088caecc109b1e58d4ff21e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855292, "uuid": "8afc8020-9cc3-4305-b711-1064b8f6ab14", "comment": "Malware payload (RaccoonStealer)", "value": "30fd5af8455df4fd2846b4460b13dfc13ca93b5b156196fc16f00dd739f8f418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855292, "uuid": "86150f3a-a206-4171-806a-53554f610550", "comment": "Malware payload (RaccoonStealer)", "value": "49511252969983ad0acddcefa9e82d2f7c373e6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855292, "uuid": "b86851a5-bc16-4e78-8a4b-248cec830944", "comment": "Malware payload (RaccoonStealer)", "value": "a55c8ad6f65ee405bb6b723532f6b09d56ca076bec4a53d922ab723d73e40a68054bd820b5097b0b3f82eeaaaa04cb6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855292, "uuid": "8de483ac-bc56-41da-9b3c-c9d2606a815c", "value": "T18AA4021077E1D575E486EA346CB6EB60277ABD326934804F3B84662E2EF32C05B79317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855292, "uuid": "cc6cbb5d-25f7-4daa-b844-36a28d7b25bd", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855292, "uuid": "b3a73fb8-dbdb-46b5-9f45-5dfb68c1a8f8", "value": "12288:RwmXoeSE1sbx0TOak8fD6Rv7iBvkTaZJGZydi:G4SE1sbCVDOK8TavGyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636855292, "uuid": "2221aca4-7463-49fe-96d3-5a485d1d356c", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636855292, "uuid": "592e0208-357b-4c6c-a1dd-1c5e67a00d24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855292, "uuid": "6d206ed3-4bb2-480a-9227-270855c9b931", "value": "700cb40088caecc109b1e58d4ff21e5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7692565f-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1636874479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874479, "uuid": "811adbab-86c4-4d87-95d7-fda7bf9abeeb", "comment": "Malware payload (CoinMiner)", "value": "4a0f69778cc534fc4ed63bc5e4bc946c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874479, "uuid": "56ea0932-75a6-4e41-81eb-c44409021798", "comment": "Malware payload (CoinMiner)", "value": "31f252898ace9fc5e4bccf183ef98c71a3f583dbfd637a64642c74e0490f5446", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874479, "uuid": "0545ba7f-2a3f-46df-ad70-4750d1781141", "comment": "Malware payload (CoinMiner)", "value": "85d6eb512fa07293548445f8236a90988e5b8459", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874479, "uuid": "63347888-b55f-4219-a1ec-67174a83a754", "comment": "Malware payload (CoinMiner)", "value": "82263a7368f70bb091f2e79a30b9ec3ce4186bc18f5c62d92db06386a55ad9ef7c35494518431010c2ed88019362d485", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874479, "uuid": "50188254-fa07-485c-93e7-0262a35b4002", "value": "T1D86533FE920F3E47EA0925303DB49FC958DE45BFA6D0939CC51C58406EF84A2A88957F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874479, "uuid": "3d77973e-4b9b-4316-8621-ee83078d29de", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874479, "uuid": "bc26e3ff-e46e-4525-aae3-3f360bc217f0", "value": "24576:SpVceVnh84bciPmM1QIOHd60hsTOJHpAxMELqPvynfr+8Z4p2fODkqkEaHNYK3pQ:SjZVn+4bc/MUQ0hqWHOpf9Ze2pqNafLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874479, "uuid": "49ec004e-1a07-46a6-8209-32fd822f0c12", "value": 1534408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874479, "uuid": "ae9cadff-17b6-4b39-a4d4-ab3ed5925e68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874479, "uuid": "40275894-39eb-40a3-a4ee-882feff4cf8b", "value": "4a0f69778cc534fc4ed63bc5e4bc946c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725e4e2c-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636874472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874472, "uuid": "b7410389-d610-4f3c-846c-dde8650e5967", "comment": "Malware payload (RedLineStealer)", "value": "79e8c2be36b9fb14ae33b6a0ca26c503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874472, "uuid": "2c0af258-cdeb-4a92-ad34-f225ee07ab8d", "comment": "Malware payload (RedLineStealer)", "value": "321ddd857576b83c4911d7cdd0433537bab88d70d104c57abdfe7f6acec07628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874472, "uuid": "894f3278-84e6-49fd-93fd-f037531312d7", "comment": "Malware payload (RedLineStealer)", "value": "c9c4b989eb4e1153eba6f47f35aa88b0eb09a298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874472, "uuid": "02694bfc-abf8-4be9-8051-8081ded32351", "comment": "Malware payload (RedLineStealer)", "value": "20d54a32709875c83923f9aef2d5259298b412fbb41ff7a1cb4723874535537ad6e2d072970d2fd2056c11a15068854c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874472, "uuid": "12b580b8-c8b8-4d66-833b-5bdb17a433b1", "value": "T1C865336632C5E52BCF0F61F6E9BB30C6E8646765434D225C3876D3CF6B5050AEA824BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874472, "uuid": "f91ca1a1-a58e-4797-95fa-8e54e4c6b2cd", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874472, "uuid": "867680f0-6112-4a4d-b334-a8ca6e874b18", "value": "24576:ySOLsn+Q3JpseXtEk51XoRjM7tLnlGoFQDJoEuzHXo+vlT16DMvBLkEaHNYK3t21:ySOQTLsemy1XisN8of3HXoSlT1xNag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874472, "uuid": "34bc702c-ab9d-4224-a371-b67558a961fb", "value": 1479680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874472, "uuid": "4a925228-8f70-4258-82be-57a2b3881aca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874472, "uuid": "cbd2126d-50a5-4472-9bec-1cd064ff7088", "value": "79e8c2be36b9fb14ae33b6a0ca26c503.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830f9155-4551-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1636897693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897693, "uuid": "42e63012-e546-4656-8620-78fa306d5c7c", "comment": "Malware payload (ArkeiStealer)", "value": "866ca0de37d9f319d2aa21172eb99c91", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897693, "uuid": "15ab0333-5c15-4c6e-aca4-919c96497235", "comment": "Malware payload (ArkeiStealer)", "value": "33ac8440bbd84ee6bac26e63379bbec686e12063434d454dfe2f515c4d911b4d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897693, "uuid": "33d203e3-8e7d-4dfb-ace6-3aceb810dede", "comment": "Malware payload (ArkeiStealer)", "value": "38791772b9d33dd8ba35c6e39594db4d17ab990b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897693, "uuid": "80210ce5-4f6a-430a-823b-b534a28f047d", "comment": "Malware payload (ArkeiStealer)", "value": "bc75ff335aa2b34036895cf66c15985c6814258dcb0430d06bcf02551fe43ddfd3ee835ed1086629c8217c32451f916d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897693, "uuid": "73fa7b50-ec7e-4e53-b4ee-8ec8080f4b18", "value": "T1EEF4F100B692C035F1B656F84A769769B53F7EE2A72988CB23D126EE47746D1EC31303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897693, "uuid": "cf670c94-6db2-46bd-9378-c7acc7f7bc0f", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897693, "uuid": "997ce7ec-fc38-4383-be41-fdc38c1be3e6", "value": "12288:NpIY+KcWauIIxi3vgdHtUgQSd2Vo5PCusslsdMYumJIUSxklmEzgm/is4zN:NpytjIxo4dNUknfTshumJFSGlfs1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897693, "uuid": "66b0cb7e-b3d0-41bd-8984-8517479e2113", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897693, "uuid": "2c917670-b201-4d67-9bdf-2e1d6639e592", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897693, "uuid": "89fb6046-7629-46f2-a0ce-65ec35e7b79f", "value": "866ca0de37d9f319d2aa21172eb99c91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e848829e-451d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636875529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875529, "uuid": "0988a386-c0ba-4317-b72f-87758130d3f8", "comment": "Malware payload (RedLineStealer)", "value": "14ecf8f4dceb09edaa2f1c713421d2db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875529, "uuid": "67722748-e205-4dce-b79c-96f5385cdb55", "comment": "Malware payload (RedLineStealer)", "value": "3534ea31546a9bab53548fec7ac1de10c5f000d3474591c20a965deb2ba95922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875529, "uuid": "6b9cec03-c633-4ec6-b392-485016a09e87", "comment": "Malware payload (RedLineStealer)", "value": "121abe4b0bddc70df38bdb043799ade82dcee2d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875529, "uuid": "3e2a57f9-4e6b-456a-97d4-234b958a9782", "comment": "Malware payload (RedLineStealer)", "value": "ac685c92a11d18b563fda45a3d6eca0fe84ef544ad27ecf733ac5d042a6f4a5b2e2e2099acf01e45b77c54a9c7926ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875529, "uuid": "c25dc894-82dd-4bf7-9c38-96259e17c661", "value": "T1B884F12BEBE90A02D72687762E91E1B41B26FC259601C54727C4BD5B3EB6BD1084337F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875529, "uuid": "e9826302-ba52-4541-90ec-dcdcc14f49af", "value": "3a196462f17f4821d4c80ed2f22a0dfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875529, "uuid": "9bce55ef-ff28-457e-a413-1f6e7d873552", "value": "6144:bU5VXOM350DnTU2HmPVwvfYg1TdVONxHBGJbko+ieaUgAdk1hc1yqer9wA4Fe56B:A5VeM350DnT5yVwv5xJ+orVU7GrT1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875529, "uuid": "5b9a208d-7404-4d8d-b450-bae089d69418", "value": 401864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875529, "uuid": "a779c6ff-4b31-435c-8542-b689ef8c406e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875529, "uuid": "cf4a6999-2bfb-43f9-b104-018f194bc67c", "value": "FortniteCheatV2.5_ByOneTapHacks.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507190f3-453e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636889448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889448, "uuid": "14ef8d3c-1025-49f1-9816-d26279354892", "comment": "Malware payload", "value": "782216c3d9db96da2ef0285daddbdcdb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889448, "uuid": "d6aed1ce-2d10-49b5-9e71-619449162fa4", "comment": "Malware payload", "value": "35484b769bbe6fcbf2c9eb408161c11ccefb0d5a6a78f113a4be092cb5d49c37", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889448, "uuid": "1103ce7b-c9e5-46ad-8dcd-e76115e68143", "comment": "Malware payload", "value": "48cc9651cbfbae23024603ea3c7bd9616be19ace", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889448, "uuid": "c1c5fa71-0a46-41e5-acb2-00c1809681b8", "comment": "Malware payload", "value": "37d2d57762d81a200e232e35550ca0646c51422671a3e1882b6588a172c177677ddfc04679031212e4aa068aab47dd4b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636889448, "uuid": "2f4ef243-a936-4787-93c1-93dd384bd99c", "value": "T1E6E633C893EDE85AC013FCB49630459B84CA82099915BF56E775CE7C6FFAEC08DA9C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636889448, "uuid": "f67cfcc6-cc4e-467e-ad95-b916e873d8d7", "value": "393216:YKxmU1H18e6qVIjf44+VOpwgTKXqgdut2y+v6f8p/cKSRER:YKBWL4gzTKXqR2y+v6fpER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636889448, "uuid": "e43e1f56-cf24-44e2-9e99-dcbc05de794b", "value": 15145442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636889448, "uuid": "cc9883b7-0a6e-4e71-b34d-229d01c4922b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636889448, "uuid": "87ed139d-950e-44c3-ac02-34cae16ce4ee", "value": "\ub77c\uc774\ud504\ud50c\ub798\ub2db.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdfc777-44e6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636851673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851673, "uuid": "b59cc038-4f63-4b28-9aab-3fe89f4a479c", "comment": "Malware payload (RaccoonStealer)", "value": "af6fb9f053874119de9424937ee15d4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851673, "uuid": "64500ccb-fa37-4bb5-abc1-ee0f91486373", "comment": "Malware payload (RaccoonStealer)", "value": "354928b0eda9cd85f543b70deb29a9cd3973244304ede6477c25e64ce2d85ad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851673, "uuid": "e90d1cab-9e74-4d73-ba44-ac628c4ee05c", "comment": "Malware payload (RaccoonStealer)", "value": "7b5e39d8ef9495e0bb9954cd253229b9b136426d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851673, "uuid": "390b87d6-ec58-4dd5-b865-c263de0487e6", "comment": "Malware payload (RaccoonStealer)", "value": "e4248f883c579539fd7baa4a55a0d11beabb9239d1f5cc7d1a77eaaee4be260a6e79bf8e4db420e9a0af4bd5c82837ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851673, "uuid": "d6706fb7-73ab-4f15-bf51-8cef6fb8f244", "value": "T190C4D0007AB1D035F5F226F549759278BA2E7E92A73454CF22C52AEE5B34AE0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851673, "uuid": "23676774-0cd0-4160-a2a8-ae84554fc7dc", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851673, "uuid": "348bbbdb-a40b-499e-a4fe-724e7bb31571", "value": "12288:ATdgTe+6scF0NUYijxUZ58kee9KsV+VSNuR7J1xyg59:AJgTe+6scF0Nuj9LsV+Xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636851673, "uuid": "0fbd1381-268f-49a0-ac22-a579f1aa6323", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636851673, "uuid": "e1a11019-7d4d-4ee4-bfa3-a19eca8fbba2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851673, "uuid": "ef3a0d2f-3743-4889-bf3e-69ba32a873fd", "value": "af6fb9f053874119de9424937ee15d4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7017d21f-4581-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636918277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918277, "uuid": "929a68e0-98e4-4933-9e4d-3948a7f69ac4", "comment": "Malware payload", "value": "9b58b4fa3bec6452d6ff2902342705e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918277, "uuid": "5f51b9aa-dbb6-459a-b04e-d89846ee03c5", "comment": "Malware payload", "value": "35b43cdd49387f567ba9cbf4f31970efa8bc1288822a4af10378b1101b1ac839", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918277, "uuid": "85ed95b7-344a-4d7b-8bc4-69b21d42ff3a", "comment": "Malware payload", "value": "a65ed0fbd6a4b192026382d5c3e53a42920d75bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918277, "uuid": "e66fca45-ec82-4ab8-8d31-7c3f654039ed", "comment": "Malware payload", "value": "162f094ddabe723c70376c3cdc00538d00082d13890b75558b7c30e6e2ae25b8b1af209e4ae2e4184f42dfc700bee9ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918277, "uuid": "af239dc0-877c-4c06-9e30-4dff3a78e583", "value": "T118357D4DE23C9A80F08356B7B74FEBB109382303CEAB31124D5C171B69BD7D1A667A95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918277, "uuid": "603c3636-56f8-4789-8fc7-e3217f2b3e4a", "value": "66d8dadb9645755e83ec25ef5d48edef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918277, "uuid": "dc9642f0-fd76-4028-b6cb-94ca84be6118", "value": "12288:sre2gFTmh2tO7E37uV4kjvG3KYul02Jxjg7jWw4Ks+2L9CDi1cfZDETO95F:fU7Muvoel0KxjUiwzs+2LIW1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636918277, "uuid": "4cc2a743-cb15-48ac-9117-fbccbc5a2a08", "value": 1127024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636918277, "uuid": "4cf804b2-b062-463e-8943-1e03e2881caf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918277, "uuid": "59ea29d0-4249-4fb9-84ea-cb971697b823", "value": "9b58b4fa3bec6452d6ff2902342705e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a759097a-4551-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636897754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897754, "uuid": "b7bec39e-e49e-457d-985f-fe2b2afdd4d9", "comment": "Malware payload (SnakeKeylogger)", "value": "c5a07d20c6083158cd479b0f0a104ade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897754, "uuid": "058c89e8-2a15-4854-8bd2-29103b08daea", "comment": "Malware payload (SnakeKeylogger)", "value": "36b652a48927acff9e7e99be2d2e558f81036a400c1abbeed39d23ea8d3eea8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897754, "uuid": "e58ce929-05bb-44c3-a629-6196671ae067", "comment": "Malware payload (SnakeKeylogger)", "value": "bea2c36010e379276b853fa5a8f7525d6c37035f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897754, "uuid": "eb3f19f7-c45a-4e6e-a860-a422db79053b", "comment": "Malware payload (SnakeKeylogger)", "value": "c8d07ae4d5547fe635c902c2ba25a947277b09a5d888de1917ebcc97c5c4496b18225bfe583a9eb84ce07049f21d7ccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897754, "uuid": "12d5b54c-e9f1-4de9-8510-6fb8abe0c1bc", "value": "T1D2C4706C3ED15FB2ED1DC0318D120A8BBB660F136240E996D7DB25CA8B5F1662DD7C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897754, "uuid": "c1449bad-93e2-4606-a035-0b9290cf7da2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897754, "uuid": "13d80754-e093-4607-9039-b3348d776562", "value": "6144:z9w3f67/0Sndc7PKWdAfBrKC9b7umzrTDeCXFkvOTMU7TEsGbY:e3fKhnqWjumzrvjXFkvOTT7TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897754, "uuid": "d81e006a-211b-4781-b981-d16329180837", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897754, "uuid": "f6c4dbfa-ac26-4363-b9c7-0a7e0122357c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897754, "uuid": "4c608e64-8049-4914-96d1-8839513d57f9", "value": "c5a07d20c6083158cd479b0f0a104ade.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d08be8-454d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636896065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896065, "uuid": "00d015fc-fef6-4027-8a01-33ccc7034591", "comment": "Malware payload (RaccoonStealer)", "value": "2fca4bbbe4df42cae30cab8d56bf5a0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896065, "uuid": "778dca9a-ea86-4498-b7e5-832c567e231d", "comment": "Malware payload (RaccoonStealer)", "value": "37925a2e7e517718f5f2966786a60e7fbd8bc4045f0394a365abde68483f25a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896065, "uuid": "bd333162-b7de-425c-bee3-e3bd8549b2d3", "comment": "Malware payload (RaccoonStealer)", "value": "2bdb5eb75e80a7b1c59d3adabb4f9b1b1a752b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896065, "uuid": "fdab2e76-d85f-475b-a8aa-a6628ba05982", "comment": "Malware payload (RaccoonStealer)", "value": "e62128a6b005398a202d55c669d95df574e32143edc6a2264f3c40a7961292321ee69984e50e663ae6740c128f49f2ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896065, "uuid": "336c9310-3f6b-47dd-b0c0-52fc288bc653", "value": "T1E7B4F0D073A19434E0673D31B96CEAA0062FB871D735955AF7B05B2E2E733D0AA61363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896065, "uuid": "3dde599a-e936-4974-8188-e9e1bcbc5b61", "value": "e26afc83cc50f029d0d1352e4ada9f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896065, "uuid": "98b7e032-250f-4325-8f5a-7b38556f933a", "value": "12288:+FOoXq3vOhXPD6hhPS9Oqvugl45dZu00r79:+TXq3vkGbaUqw3ZJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636896065, "uuid": "c34b5087-9c94-449f-b033-555a1fbef9c4", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636896065, "uuid": "845a1222-03ef-4aaa-9ea2-ed038b0c7271", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896065, "uuid": "7d8f6224-11ee-4bb6-a3e5-57ef1021a4a5", "value": "2fca4bbbe4df42cae30cab8d56bf5a0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e9f644-44e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636849680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849680, "uuid": "de0d7c12-2694-4f51-a318-5cd28b152a23", "comment": "Malware payload (Mirai)", "value": "dd3780d68854900fc99da2d38ebaef3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849680, "uuid": "f58b6a73-e3ba-4d44-bc30-524bd97d6e62", "comment": "Malware payload (Mirai)", "value": "37f3211aee21182bfa4dc9012279d4ed1c44156cd1a9b310ef940bc5e866ed2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849680, "uuid": "cc5f8a5e-1600-452a-ae38-591adbd4d8f4", "comment": "Malware payload (Mirai)", "value": "9e1689bcb4f825b52d35b38fe5e665e0bb56f75c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849680, "uuid": "30444e60-befb-40c7-b039-965645ba83e9", "comment": "Malware payload (Mirai)", "value": "8e9325b71e06b219b163ab212969cfff5746b0b590ab9f473a75a17dd389bbbe05db80b846cf51e521b264cc8bb7410d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849680, "uuid": "3fc72c0d-51b1-4225-a0f7-3ba7960ee287", "value": "T173D3F746EC82AA16EBD21779BD4F746D230077C9EBE93142DD190FB039D9E8B0C9B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849680, "uuid": "610352ad-a179-4f67-a12f-684103adc35c", "value": "1536:s/c7doAiPjj/ybDluMtSNVC/CnBKqxSJ06H8FiV9irwnkgeBIggdJye7vjtajATl:s/yotfya0H+OiZgaIgSJTp4Jhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636849680, "uuid": "aaeae33b-bbcd-44a0-879a-0538d874417d", "value": 132092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636849680, "uuid": "497566b7-1a8d-4001-a9b3-bef54d427582", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849680, "uuid": "17857640-da6e-4526-b5ea-42abd72c64e6", "value": "dd3780d68854900fc99da2d38ebaef3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683ca1ec-4544-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636892065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892065, "uuid": "bacc4748-f756-4df0-b974-e474fa3320d6", "comment": "Malware payload (Mirai)", "value": "76db93dba8941e962ae0941e19731f73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892065, "uuid": "947b11e2-9ebf-400a-9be9-3a8ee7017b3a", "comment": "Malware payload (Mirai)", "value": "38bb32a8cc0dccd26c3e1688c572ea4af72dfae1085136c03b8373f32e79078f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892065, "uuid": "82764a4b-550d-4b97-b521-fb1910a6acf1", "comment": "Malware payload (Mirai)", "value": "f25ad7340ba92d924de9cb3d4450a33022d858af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892065, "uuid": "dbad21e8-357d-46e2-a028-02a0c760ff23", "comment": "Malware payload (Mirai)", "value": "2cce6a1ab02a296c259c74c896a9d598043350a7c149cc0f58a726a9022fad504005bcb69726856e299a07d06b848669", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892065, "uuid": "f6729593-d95d-43eb-98d6-d66d7044222a", "value": "T183433ADAF4026E7CF49BEA7D94624E0EF621623140A21B277377FD837D32264D902D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892065, "uuid": "f45e58a5-22af-4d8b-8b2c-4a92a5d521de", "value": "1536:DOPyArXB7pD67RNWqqJOu6CXUOvkVWuQ7M81g1pywx14AZ7cpYoJ8W:FArjOu6CkOvkX8kp5x1EYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636892065, "uuid": "96b4d0f9-b64b-433b-b1fb-bae5aa950652", "value": 56748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636892065, "uuid": "b33eb8f9-9b3e-475f-ba45-9c2a3441dd72", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892065, "uuid": "17be4970-97ec-44dd-9a3f-e6dfd7ce9c18", "value": "76db93dba8941e962ae0941e19731f73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b461445-4552-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636897922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897922, "uuid": "cf3c32c7-e67f-4c4e-8464-050c9f6f09e0", "comment": "Malware payload", "value": "228b810b87544e2bb90d5bf1190b00c2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897922, "uuid": "d9348cb0-6fcb-4650-bf62-f252266b11c7", "comment": "Malware payload", "value": "39666132c39c61f9266e42d69c3d763e97bcc98ece4188b9373d8e4000714f37", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897922, "uuid": "beccac36-7ad7-4796-9ea2-852ff012b7ec", "comment": "Malware payload", "value": "badcf3ecedf79f572c254652342c8ea875ac6216", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897922, "uuid": "dd8f8df2-2db5-4110-bef4-7567e884aa98", "comment": "Malware payload", "value": "fddcb0588d8e4d3d17be01771e8da72250c45f083461a8183b35581970f9b5762faccff5c1960a406b295fe4df6154f8", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897922, "uuid": "bb626ccc-80df-436e-a6cb-c05a1e269a29", "value": "T1A63170081BC91B21D3728D3B646DF21088757D09ED93DF5D02D050DC24A9200F77AEAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897922, "uuid": "91be6e76-a887-4681-a581-491cf6ebf7c2", "value": "12:85nC3pQVe/4VfgFD6W+feDCBkogZC73+UcIl1lDmIfcI6DmNf3YQVg1:85+pQQXFf+feJo0g3+/E4I0CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897922, "uuid": "c93e907e-bbe7-4869-a1e6-f4a0e7f216d8", "value": 1650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897922, "uuid": "6480a740-3fa7-4b24-a47f-34e61466accf", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897922, "uuid": "55961d85-26a3-4d49-be60-f7573f198f60", "value": "INV-GIG1740718 - GIG1740703 - GIG1740735.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a288d13d-44e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636850501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850501, "uuid": "15da6d4b-e1af-4f73-b7c3-4e7120e77e80", "comment": "Malware payload (Mirai)", "value": "8854c1571145bb8da1ef716213f622b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850501, "uuid": "30bf69b7-ee5e-4bf4-a568-e33cf4eea857", "comment": "Malware payload (Mirai)", "value": "3a0cd47d422ef127b3b064ca72f04fc6dd4870baa7432c9d2131cd79ee41cc7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850501, "uuid": "3de85e90-b8af-4b16-8613-06fcf09c5c98", "comment": "Malware payload (Mirai)", "value": "2f468fd283cf995f239d03dfa2da9b8434e81b0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850501, "uuid": "37956ce6-b575-41f5-8465-41ec8f14a081", "comment": "Malware payload (Mirai)", "value": "72d3165ff145bbffe38982056dcc8a45f83b5391bac1c88b50fa6e82b8590f77317137a0f28d3934815c0d231227f791", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850501, "uuid": "56b67195-5517-4619-8f54-3b62ff3b641d", "value": "T10AD3192474781E62C4D0E57E1BB78E75B2B4368F15E09B4D3F391F8EBA902D4B9489B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850501, "uuid": "bd360419-e5ed-41bf-9124-4e93020ebbd3", "value": "1536:9AQhK1T7ZDvbnQXCJWX1xbSibNOOGPDmHnN/tSGm4LCwYvw5e7XMbT23TO5Z:yEFjewwVaHnN175mbvw5ewHMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636850501, "uuid": "fea2d4be-24f7-4a36-bf51-ea879bc31852", "value": 133200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636850501, "uuid": "4bffb4ea-7be2-47a4-af8d-dd694cf2cbd5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850501, "uuid": "8e1a8ad9-d47b-4792-8b92-f124388dfa11", "value": "8854c1571145bb8da1ef716213f622b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d158acd-451a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636873953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873953, "uuid": "5cec66fd-cb47-4e52-9ceb-8b4253588634", "comment": "Malware payload", "value": "e6c78216e4526d1450faeed47a969c11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873953, "uuid": "65916eb8-9deb-4ffe-9737-5b2d01dca64a", "comment": "Malware payload", "value": "3a3b5bab7905c91585685a1d5832fe31ea0134a5c9d89049879c686a5816bf15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873953, "uuid": "a59ff00a-85fb-47a8-b69d-a2f1df981b13", "comment": "Malware payload", "value": "66dec6ef7db5e8c4068f756c023efdcb0a2eb81c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873953, "uuid": "ef1a4dc2-00e6-43e3-9eb7-3f698626d7f3", "comment": "Malware payload", "value": "f73fe5aa6874a7e88cb104e5c5c2b111e60cd5c667be9c4e7ee9303dd91d4c56ac38a9604c5c81f27527b9b32b8deab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873953, "uuid": "2b021fde-6f26-4f94-b0fc-23fbba3c02c2", "value": "T116658D4AA3A901ECD0ABD278CA529607E7B17C1103309BDF17D55B5A2F23BE15E7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873953, "uuid": "719b4256-ca72-409b-95ff-0ea09420e80f", "value": "0e0b1327b851d652046461e0a8be7593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873953, "uuid": "d049e8e6-6395-4be0-8058-488f66dd3e1a", "value": "24576:LCLwqP0WaBppewqDG9fot7ZQ7NcuVUlJL6RUJsS7dj:LxQNazpPqDG9YZQpcDJLWmDdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873953, "uuid": "39be3016-6ae6-4585-84b8-604ac7bda126", "value": 1422336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873953, "uuid": "f9e2eb9d-3923-42cc-a86e-453ef5ad57cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873953, "uuid": "398cfe9e-6bf8-4d1a-aa67-02c4476d2df1", "value": "e6c78216e4526d1450faeed47a969c11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3701fdf3-4522-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636877379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877379, "uuid": "8228facb-6fce-4b63-8513-44dcbb3c9a36", "comment": "Malware payload", "value": "7aa2b97e89331b98754cd9b6280af0f9", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877379, "uuid": "4b377b45-5afb-4547-ad59-b17e3296e87f", "comment": "Malware payload", "value": "3d93d26bca6930823ec8b92e4b9c738c75b5a9285df077a9ff3bfbd60b5c6b06", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877379, "uuid": "42324a38-da9f-42d7-b5da-354cc4cd023d", "comment": "Malware payload", "value": "b1161768ee3aa0da467a47c3023a382fd9701960", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877379, "uuid": "2d77d588-f25b-4906-a650-801515a0848e", "comment": "Malware payload", "value": "af4604fe9586307e1aef839e97cf7e98e075c509919ace8aa127e6733b485ca839f1dcf8198e6c929219ffee6f22be09", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636877379, "uuid": "b6643bba-bd89-4f7a-9204-a11d0ee874fd", "value": "T11DD0C7454F5560715914D30DF34956DAC00261331586753E11AC0AD8D08DE67B1AAD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636877379, "uuid": "3c0c64fb-47e3-431f-afac-b19dfaf2a381", "value": "6:wRsTR6J9Q6GOR6JDmFB6R6JjHVrXB2RjbL6XVDHwv:kkW9GOWeB6WzRB2RmXVD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636877379, "uuid": "411abdf7-a0ed-4778-ab97-aee025dbf39b", "value": 218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636877379, "uuid": "d5e16e46-6998-4f28-82ab-de57600abe9b", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636877379, "uuid": "c6311631-e389-4cff-8d12-55b818f18e7e", "value": "xxxd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bf2754-4521-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636877191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877191, "uuid": "1046327a-6ee1-4831-82d1-4f3cf0ffd94e", "comment": "Malware payload", "value": "40d3f310031d5c6b3f5545b88cebf3f2", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877191, "uuid": "7062da25-160f-4c08-a831-2045187d533a", "comment": "Malware payload", "value": "3df89eb8ef8d470d3805e688e589989cf28f0f03ce7e6e69a1c32e144e08fb6f", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877191, "uuid": "5c9ce3bb-bd00-4944-86cb-de0b3f1161a9", "comment": "Malware payload", "value": "91169ac47ffff31cb0b05e62e0b9ef733feed267", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877191, "uuid": "ab56992c-7e36-4793-98d9-8cc0e68ef9db", "comment": "Malware payload", "value": "a78478effa36618e3bbd90f605409e572200bf9b312099340b2bf1f14d0a615fc50497fc2b08858810747eadee40153c", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636877191, "uuid": "585ca5fd-79c9-4352-a82e-6bf0d7380547", "value": "T1EB831922B7D59DD902BC6B6A2F3E421664EDAC5045312F4FB90FECBE19B06DC7E52600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636877191, "uuid": "76a847cd-3a07-40ff-a8f1-8c15099c4ae4", "value": "1536:xmWh3LPwBYfSQUhAg7Y2EdJRMmn+I4++4:xmp6fSQU2g7F+JRVF+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636877191, "uuid": "d4df0e9e-debb-4eee-bea2-c6c4858db2c5", "value": 87463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636877191, "uuid": "d28ced9b-9517-4342-aee9-5e098f862cfb", "value": "text/x-php", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636877191, "uuid": "a7def379-3dbc-4322-a739-dd78897f7754", "value": "wp-sign.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f8758a-4554-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636899124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636899124, "uuid": "9bc296cb-a55a-4b02-baef-32a2a3468ea5", "comment": "Malware payload (NanoCore)", "value": "f05e72fff3cdeb404f0509309061c1d3", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636899124, "uuid": "c7186b62-554c-487a-95f3-2585b896f274", "comment": "Malware payload (NanoCore)", "value": "3e12ab92a110cc35ba7ef8f74547342822effd64f7df4a8fb44ef8912cb24bd3", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636899124, "uuid": "a2817f98-f525-40f1-9e23-da6806f2a844", "comment": "Malware payload (NanoCore)", "value": "3f762036493cc0ad20bf06c7c18afd105ece7789", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636899124, "uuid": "5082e865-16ca-43e3-96db-5a72a1be743c", "comment": "Malware payload (NanoCore)", "value": "9709b32860c22fc2db06fb582541eb3faad017fb7e27db2f0290b856ec2bfc4cc2899f03a81bd1de85afa3956875d849", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636899124, "uuid": "53272cba-abe9-459a-ae32-f9f98029dd4a", "value": "T1327423BCDC617522615F5403942C2AF77D09491331EA288F8ED81D2095EE97EFC7E29B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636899124, "uuid": "7c7e5356-8ef0-4b61-bc1a-05200cf22ba6", "value": "6144:eKQVXCgE/09WhZgyMsGcRokHQ4ar82gaPG+VYfGpKXmW0hUocqzqQFshI9ix+R8S:ebrE/MWAyHuggG+4Ge6iocThhIw+3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636899124, "uuid": "76951b45-0b88-46f9-8bee-30aa6ebcc319", "value": 355331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636899124, "uuid": "ee0deef8-e208-48c7-a916-5c366c36c7e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636899124, "uuid": "60bf6a2a-171d-4c22-91b2-47d0a6464b82", "value": "f05e72fff3cdeb404f0509309061c1d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda1aa18-459b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636929574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929574, "uuid": "9896d797-91ad-4a6b-a7d8-4ee1186adbb7", "comment": "Malware payload (Mirai)", "value": "b68ede958eeefdee909bccf364117584", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929574, "uuid": "5945177a-772c-4164-a630-e94ff324684c", "comment": "Malware payload (Mirai)", "value": "416729f913bc76a101f94c3bacb60e7a95fe76e2f6c8121cdbf405fbb45646a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929574, "uuid": "861be85d-d5a1-4a64-aac6-7beaa41322cd", "comment": "Malware payload (Mirai)", "value": "37a5149550c944f5d30edac7ee7c223eaacd6b1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929574, "uuid": "3fc9aefd-9b1a-4ac5-85f3-3deae5d88f47", "comment": "Malware payload (Mirai)", "value": "99ad8ea969f1b8fe9291e1f03067a143a85a56f31a83ecdabc9d0f7422bd39262976f8d55328387d733a3b7427120140", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929574, "uuid": "9b06affe-0158-4cc5-ae12-2e162c336fe8", "value": "T15413F1211B5255B1D2F706B9CF2DD4A63A662A68F1D8B432170652ECF24C4C7B3FD28B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929574, "uuid": "56b7be03-e9e4-4c3f-a896-96a21f41306c", "value": "768:7QjTqr/OdNWbreUIYwLlSMC0Ibxno6orPD46LDP41YQzU0b9as3Uoze:7Qyjne9Lgo3rPvLDA1VQ0bZze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636929574, "uuid": "89e3afc6-2313-4166-9724-378a7136555f", "value": 44204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636929574, "uuid": "46d457a4-ebba-493d-950b-5aaa337e467d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929574, "uuid": "074d0878-abab-4223-9532-cbd284f36cb6", "value": "b68ede958eeefdee909bccf364117584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc5954a-44e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636852188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852188, "uuid": "9af90d73-9a21-42a9-bbfe-f57845d09b1e", "comment": "Malware payload (Mirai)", "value": "0ce634e74b093c976dcad333abc1e778", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852188, "uuid": "fc5d2e4a-252e-4749-9f5c-77ab25651ee2", "comment": "Malware payload (Mirai)", "value": "41c158540cf24dd88bf2a883f3e59feafc883d0bb3c0fa9849d5e3a494ed1c9b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852188, "uuid": "c38c583b-e2e8-4cc5-97e9-60296d6d2df9", "comment": "Malware payload (Mirai)", "value": "973cf5e640745e4361a26a4ab06a4e4dde085312", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852188, "uuid": "772e9e35-4f89-415a-ab08-4f2f935bdb79", "comment": "Malware payload (Mirai)", "value": "8a81e106e9b3a120a53078839f56f999ab6839a6146f952cb25e32d356e5dea0dd1983c93d76fa86bfa941fdb2be287a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852188, "uuid": "921f038f-ce6b-4c76-804b-1421433c17da", "value": "T1BE831985BE82AE16C6C5437BFB1E038D33226398E2ED7213DD156F1177CA92B0E6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852188, "uuid": "e50cbbb0-6c51-4354-812a-f2ba1d5ddf26", "value": "1536:51/TDHp9AMCwgGxmIDafSgyjz9yhMCk9zRlpBAUm8AAb11M4tnvnwbZns:5FDHtgPIcSFz9yh6dxAUztzznwbZns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636852188, "uuid": "97c1e390-ae76-4d7c-9d2f-dcad52c259fe", "value": 83264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636852188, "uuid": "39c9cfb0-5e00-4526-9279-766e69c9d67b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852188, "uuid": "4a9c4976-0841-4dbc-a398-69a56ea12a4c", "value": "arm-20211114-0109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acde903a-4551-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897763, "uuid": "08a1f184-0295-4148-8cb2-a2eafc9feb1b", "comment": "Malware payload (Mirai)", "value": "b0d6bcd0c3368aefe2d92d990b61bbff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897763, "uuid": "3b5da40c-6d90-40ca-9e74-083cb997ed99", "comment": "Malware payload (Mirai)", "value": "41d96b048582c00023f62378824ac52ec1f7ff605ecf4e04400a41c9d559e88e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897763, "uuid": "cc6426d0-520e-4e32-818e-6fb5f3aad4ea", "comment": "Malware payload (Mirai)", "value": "75406eab0b2c441719d80a2411d712cd01e0d66e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897763, "uuid": "949eca7b-a6ec-4cf0-ba15-5e33219310b0", "comment": "Malware payload (Mirai)", "value": "449cce772070a0a58cb3f3908e80f7527e16944d7e4449cfa77aba21f628d52c4846ef200ec1c7413d79f87325bd3628", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897763, "uuid": "d2d00034-a98b-42ac-a928-753fb03a2544", "value": "T1EDB31937A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897763, "uuid": "1c4037ce-ef26-4fa6-b6bc-99d17f528e10", "value": "3072:pC/4rdZHsXsZwwR9ZNSmm/QcuLmH26PNb:pCwrvHwsZwY9ZQmm/QcuLmH26PNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897763, "uuid": "106300ba-7c08-4eb8-9d8f-5edc4c9caa90", "value": 116787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897763, "uuid": "5c386af1-b79f-4648-b9e1-12b992ef871e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897763, "uuid": "01c7d0ff-6fd7-4a4f-9de5-c76a14563b11", "value": "b0d6bcd0c3368aefe2d92d990b61bbff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dde41f3-4516-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636872398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872398, "uuid": "f6d71978-4b09-4d04-a347-b805dd4ba6da", "comment": "Malware payload (RaccoonStealer)", "value": "92f5c4b3a7103788f5fa39c310192a74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872398, "uuid": "87c7f2f7-0c7f-40cf-9f4e-6a0167eccc38", "comment": "Malware payload (RaccoonStealer)", "value": "43ddbe297c264c467ea83551244b4a78436bfbbe588602428183e3b966c7cc82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872398, "uuid": "c4c1c94b-ac66-4779-89a2-838c9ccba52e", "comment": "Malware payload (RaccoonStealer)", "value": "b54e99214dd998c52f41ee91e5724c65ae82bd2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872398, "uuid": "2475237a-c8a9-479d-99ea-26f37fcc2ada", "comment": "Malware payload (RaccoonStealer)", "value": "6c81eb200b6972f2a672a97b03feda663908eb7df3a6b7e32d6b718761270ec299ffe8a5e952ad70fe990ce837c349c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872398, "uuid": "d0aa79f0-c944-47c3-897a-f51ce15bf7c2", "value": "T129249DC0B7D18835E1A23D3098A18BA1162BB871F970553AF777A72FDE723D0867531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872398, "uuid": "c16a8aa9-6a21-44b4-8513-bc225a9278d3", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872398, "uuid": "b372b2f7-cb35-4bc8-8903-3071889edcf2", "value": "3072:f72BgPRRoVU+/EPeZ+YHcuzxw8oVggjcGkNIVqI7sxkgaBChMpZa9uD6Vdyhkq:TPRRoVUyTEYHxw77ITsq7igavwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636872398, "uuid": "8eb3a889-5725-4d2a-8b37-3e76c62f0b9c", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636872398, "uuid": "d5e0ef09-dc87-4924-a7aa-710c0658963b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872398, "uuid": "688f1027-51c1-4a56-b807-90193b622e57", "value": "92f5c4b3a7103788f5fa39c310192a74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c14e23a-4566-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636906593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906593, "uuid": "50075a7d-0f38-443e-bfc9-3af147c339cb", "comment": "Malware payload (Mirai)", "value": "dbfa58873a4357182df17dfca4230b8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906593, "uuid": "42b66705-8d2f-4c05-a528-8e57dd10b552", "comment": "Malware payload (Mirai)", "value": "442519b6e39199bc966afb7474dc4b9e77bbcac2d80f5fc3a4e991700379bf42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906593, "uuid": "0e999504-512e-4400-8e1e-c0c24948399a", "comment": "Malware payload (Mirai)", "value": "b335d839981d415409ec9d88ed1b27c42453b1ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906593, "uuid": "fab37024-247c-4674-9c28-1efddac91fb5", "comment": "Malware payload (Mirai)", "value": "4699bd45cfcdaf867f507e6116a573f665cab85eb942383eba642ee979ee0d9e692d1832b9a3121e6aea9854fa7c06c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906593, "uuid": "cd154873-02ee-4ede-b089-1076292503e9", "value": "T1CFC2D0EE54B02A9DCB5C2939265E4BA06F85A2D1711EE74583106D49B73380BF90D8FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906593, "uuid": "b8e22fc5-d8d6-4b37-9300-1c85d6f06721", "value": "384:LSG80h9tozYV8lYrjWQwIUbLrvdkf3J0mgcxmlGIRpjOi9/Qpk/sOIRWGVCzhMhB:OBzqO6iQwICLrvdkfWcxwGG1/QmRoWMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906593, "uuid": "ec371133-73a7-4357-985a-c891ba680b5b", "value": 27412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906593, "uuid": "791ca76d-980a-4949-ac53-86fb2ae1dcf3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906593, "uuid": "fa2362ac-81c3-41d1-8846-830be90ff134", "value": "dbfa58873a4357182df17dfca4230b8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68e9c50-44ee-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636855313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855313, "uuid": "01a6a1bb-3074-4334-903c-b49f325a9600", "comment": "Malware payload", "value": "00f8ce0a81b8fd53be0f3775cf681fc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855313, "uuid": "872f049a-7a05-4371-896d-1aa7b08a6dec", "comment": "Malware payload", "value": "457366af26a4da0fb951fda087c68b15cc63f0034a588803b4ec6458edb601bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855313, "uuid": "9e5a66cf-522b-4dd2-988d-6a850ff5e841", "comment": "Malware payload", "value": "8adaadb371b1ecdfb4b15bb538549a07e715513f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855313, "uuid": "00d80349-775c-4dac-b2f7-84b8ef14dcb8", "comment": "Malware payload", "value": "4466039b480fa2130ebb11fa20af8f94a1fcbeefb632802c2a3837d6f7f4024707dd587914fd4d3ad96166a51db86bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855313, "uuid": "be566204-8418-4ea6-9554-1c85f863f3e6", "value": "T108F4E14733274516E814B7B1EFBB7B200760B6778A73470BE2D4396D901E3EA7A92712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855313, "uuid": "03b866c3-95c7-4202-9025-f5824136a900", "value": "12288:DoErwZhTKf3PY67FyxrT/eN6a3b0BgnFZvi1Th54o3SZbez3zvMdKp7GGyrf:0EixyD7FQTo6mb0Kn7veTt3SZG3wdHrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636855313, "uuid": "f7137a04-e343-49ca-a190-421f2a7cb040", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636855313, "uuid": "690c047a-0f10-4a89-9d8a-a0bba54c6e67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855313, "uuid": "48ebe9f4-d8a5-4e76-9eec-0ae561ef07a1", "value": "00f8ce0a81b8fd53be0f3775cf681fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc69cb6-44e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636849659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849659, "uuid": "7edf82f7-c25f-47ac-90a9-025c9d10cb72", "comment": "Malware payload (Mirai)", "value": "70c00da94d71052d118b13536c152a9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849659, "uuid": "4a19511a-2e9d-40d4-910c-14a6c112a75c", "comment": "Malware payload (Mirai)", "value": "481b217f42381fa751c51919be63635f0754f649adc5922981400452b373c00d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849659, "uuid": "b9026a45-872f-4056-abd0-416f92a4f674", "comment": "Malware payload (Mirai)", "value": "bd1b930b5cdac16411319d6a30508fea417804b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849659, "uuid": "45a81881-6f21-4d0d-af8e-f6a280a4d823", "comment": "Malware payload (Mirai)", "value": "5684c3f828d2cb2118aa3986f7f2fc637f0e5aa37bd7b4a00b0088a3071224abdb42bd43bbfd056f3e370a50acfc6edd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849659, "uuid": "6b7fc45a-e4e4-4067-add5-1582bede5561", "value": "T193D3D60CE503A1B9EE5B8C34704BFA7FC7116191CD71EDA6EB985B01A937D03A046BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849659, "uuid": "e4d6a436-5c9d-4955-bd90-8e54643ed5bd", "value": "1536:UHpDNsh8GI8s8CTi8J8H81IjZDpHnhtxc7TzmUkn7tjQSsQiSHaYnRLy30PeuJ7g:C8b6uVBtxGTpknRja0rLzxJoQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636849659, "uuid": "e49e8e35-0c4f-445a-a704-c5642c251eb0", "value": 135260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636849659, "uuid": "cb06df2a-eddf-4b32-aa3c-1dd1166bbd78", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849659, "uuid": "43f62ee2-4571-4aa7-a29e-da9b36592e60", "value": "70c00da94d71052d118b13536c152a9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205f5f3d-458e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636923727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923727, "uuid": "b16854f8-0153-44b5-9014-3dcf34e90179", "comment": "Malware payload", "value": "ea4e92c55ba38780f02876d7b23220db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923727, "uuid": "64efe1aa-205c-4764-a138-3786f5381140", "comment": "Malware payload", "value": "4970975b3596048497e4cd865a66e68b017afddc392ce8de6d1b071846908295", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923727, "uuid": "36748bca-74b0-4a48-b270-4c4af8fa57c2", "comment": "Malware payload", "value": "c2828d048a98ae4a0b10a0086569f7923ff880f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923727, "uuid": "90a0e55e-9bcb-4610-868d-7790569011be", "comment": "Malware payload", "value": "e64002e298a8f50393b62f73abc39b8a42e637f0381cce659f25a4096cc67549874e4013ce071f5bf578cd0c0fe2408d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923727, "uuid": "01c2ffca-46d1-4d6d-a06e-eb7b39b397cd", "value": "T10816333A6263F9C2E3A5DA726502E66F447CFC3D85F69603035E490795300399EFB87A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923727, "uuid": "f375e51a-7b4c-46b6-adb6-63509dc358e5", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923727, "uuid": "a82aa684-5819-461b-8083-5d6c8f5e9a93", "value": "98304:Hmye7G3Dj5C/VjFXNQnXssRq39ObeaAx5Wky971lz:Gt7sj4/JFdR4qLLTy971lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636923727, "uuid": "5a6c7ad2-66bb-45a8-b203-a09125d247b1", "value": 4364800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636923727, "uuid": "e6b3db68-9144-4bb8-9142-45d62fd077ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923727, "uuid": "2b0458db-3186-4f1d-9c38-42ceeb79b70d", "value": "ea4e92c55ba38780f02876d7b23220db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486cf6b1-451b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636874402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874402, "uuid": "1aa5e8d4-d63e-48ab-92c5-77a8bc0484f1", "comment": "Malware payload", "value": "7aa7dc1797e0902324acf13aab289ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874402, "uuid": "85c08fc7-8e72-4ff5-aca0-910a840afc64", "comment": "Malware payload", "value": "49b2fd9bdcffa401605b4843d1d979a971cda8c802ca4040912ccf59af59aa40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874402, "uuid": "526778b8-e66a-4aaa-b5ed-d6605ffe0611", "comment": "Malware payload", "value": "9e0489319957fc00992c3fc37e59f60314ea0fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874402, "uuid": "5ebe7b8e-a136-43af-930d-7f3891277e0e", "comment": "Malware payload", "value": "21e4808f3a8bfa8cd3fb7c8bb1177bb6d15174d3cc2cfb41ed5e2cd22e2db39dd0b1332b7ee5b12ef35a042717f879f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874402, "uuid": "cedbece3-f231-48fc-8136-5b47835e30dc", "value": "T19616D0AC761072EFC85BD472DEA85C78EA5038BB931B4503A05315EEEA5C897DF244F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874402, "uuid": "6344823a-27c0-4481-9fc2-8b08f922cbfb", "value": "98304:OBAZLjGaJWv6kWFG8tsvVV0HCeEbGGgiD:1LjRWvQFG8tsv4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874402, "uuid": "a06bbb52-2b77-4f23-bbd6-65ff3f2547f7", "value": 4030464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874402, "uuid": "a64bae44-f562-486b-a12e-b7bf1040e971", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874402, "uuid": "edd6aaff-5552-4dae-b7f4-e2991f92d5f8", "value": "7aa7dc1797e0902324acf13aab289ced.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4de30f9-4515-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1636872114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872114, "uuid": "4363fd07-22d2-4a89-8924-a8ae92589c49", "comment": "Malware payload (njrat)", "value": "bb483e0cb23eaf8faaa78e28b5899211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872114, "uuid": "6dccd315-a480-4cc7-8445-09a841774408", "comment": "Malware payload (njrat)", "value": "4a0f711887436496355320a602ea4141f5fceed48cb960e638d9daaee70dd077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872114, "uuid": "d69b86ff-3335-48a9-82c7-657e2521eb78", "comment": "Malware payload (njrat)", "value": "80d17f4bb56fd99c557fbe72debe057bbf54c7f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872114, "uuid": "de1efdb5-cba2-4de4-b8e4-769028549d72", "comment": "Malware payload (njrat)", "value": "66345169e5cca957b450b264f84533e85d898ed79d0e0b870ee1f5a0d518832afed55217a6568c0addf50ee57799d525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872114, "uuid": "a10afdf1-6121-47f6-9439-a82278ec56a4", "value": "T148C5F10073E48636C1BE12B4B079A3574774A821576ADBCF6BC048ED6DA23D24DB1BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872114, "uuid": "38fed923-1774-4e17-848e-8b8da1130ae9", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872114, "uuid": "63f5dc73-cb30-4101-aae6-b295058bea2f", "value": "49152:Re9YD1EbceR0aln3kLxVo54cl8LH+tkWJ0/llH8PbUEUcU7ynH/:Re9Y5EbceR0alKxcmHgkWJ0/P8ztUcUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636872114, "uuid": "a3271473-e23f-4bcb-abf9-80a87ed783a2", "value": 2609664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636872114, "uuid": "f43cc46d-2b4b-4755-81aa-3f3d96fea97c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872114, "uuid": "c8594428-55d2-4066-9edd-11ea49988688", "value": "BB483E0CB23EAF8FAAA78E28B5899211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67aba5ad-4525-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636878749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878749, "uuid": "f294f6b1-7d75-4f12-b16e-861e0907677c", "comment": "Malware payload", "value": "9b8eca0f3dc9a590487860fc2470fab5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878749, "uuid": "3ddd4405-b153-4559-bb89-d01dc61086b5", "comment": "Malware payload", "value": "4a12d29a59f80a7deb10effbba67169f9898969133ae7c4d94c3d500cc93de5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878749, "uuid": "a054fc23-ad44-47b9-baf4-557cdbe5b974", "comment": "Malware payload", "value": "cf938bed4e2c9cd9b6ba590bafb3092b77183c94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878749, "uuid": "67d5ed1d-d2a6-4300-ba22-94dfb16b064c", "comment": "Malware payload", "value": "c3a0113b29a68ccc619f883cecc23e18bc6095f2db251243681fd7373efdff1c3a6724cb21821b6195b44e37c14dd634", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878749, "uuid": "2393b9de-0375-4974-85cc-b8868c01a404", "value": "T197C401D162D1E575E1523E30A571CEE21B7BB832D630944AB374A32E2AF33D096B6713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878749, "uuid": "0da13c78-6c7c-4899-a8b5-8810243352ff", "value": "832e801673c65f7295cb9eb42f89e133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878749, "uuid": "79fcb47b-3785-4667-99d0-91b65c410ab0", "value": "12288:FZzaSnomVY76KAhnvuLlyk39K2NZuJiTJaa7ithy79:FsSocYrARvuLlR3hZuOJaaG7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636878749, "uuid": "6204f9a5-11a0-4151-9306-d59cf35323cf", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636878749, "uuid": "b9989167-b484-4b84-8e31-9010d7866bfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878749, "uuid": "b09bc5c2-7d3f-4b45-97cc-ff658bf67ff0", "value": "9b8eca0f3dc9a590487860fc2470fab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27656525-451e-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1636875635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875635, "uuid": "1d4c7305-e7a4-42f6-88df-fbcd0ae91bc4", "comment": "Malware payload (DanaBot)", "value": "95c988998171bfddf5b3ffd1bfebc6c4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875635, "uuid": "5e232b2b-49b4-41f5-b19b-2bd1d1a73741", "comment": "Malware payload (DanaBot)", "value": "4bbb987cccaedf7bc55a7de2a7439a9c66746f9836b438a0bd899973c087ed1c", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875635, "uuid": "a8f66004-ad87-4920-b349-cbc494777339", "comment": "Malware payload (DanaBot)", "value": "b068229ce0f92679e7217752b35e4839329494ca", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875635, "uuid": "a1b6599b-a4ac-40dd-af8b-3cc2e3dbb99c", "comment": "Malware payload (DanaBot)", "value": "8dd745ed04e9aeca2f471192838c7fc0b59479053a4a70809160345dc9b45f251860b2057a4740b3f7cd5d958eb75035", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875635, "uuid": "8fd3cc7f-e8b6-47c4-94df-388c6f00a0ab", "value": "T15685230091A38C75F986793096B2CB7A1E7FFC323635824F26452A6D0D736C1A6FA717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875635, "uuid": "c97f0056-1b9d-429d-8c67-aaab4ecd66f6", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875635, "uuid": "d7e61246-fa1f-4c58-a428-0da303d4bc3d", "value": "49152:K4kUo0DTbv0cTwG42BkS3uJXSIwFvI7HdF:HoKbsc8GbBkS3u4di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875635, "uuid": "bd821280-9165-47c9-86a6-110f8cf078c5", "value": 1766912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875635, "uuid": "c819e918-f2a5-4154-80a2-4830c43211d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875635, "uuid": "733c85fe-f782-49fe-99a0-0092192c8771", "value": "95c988998171bfddf5b3ffd1bfebc6c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf81ec38-4512-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636870736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636870736, "uuid": "ababcf8f-0d48-4889-a79b-ac20df3eb3c6", "comment": "Malware payload (RedLineStealer)", "value": "5b8e134e4d6bffcf9ec34ff3639bacbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636870736, "uuid": "b1c89e0e-e6e4-405b-ae4e-b63760c55c4d", "comment": "Malware payload (RedLineStealer)", "value": "4cf588b87b8697aecc8c5c0cc516b3de86b15ea5185191949e54282d6bde34b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636870736, "uuid": "ad62422d-60cc-44e6-957e-7d601be4fabf", "comment": "Malware payload (RedLineStealer)", "value": "db7c27077d976cfc711aba31e02ac45aeed5938b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636870736, "uuid": "d192e4bb-e61d-40d7-885a-b7bc284818ee", "comment": "Malware payload (RedLineStealer)", "value": "0547fe8c772b0e41f35e518c6b713b07f9b99996ab0baac446264c981a5b6270fd6460afd5876b017f3277a231740131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636870736, "uuid": "b28a2104-23e0-415d-8779-5211c3c69090", "value": "T1D46533E81054E9A7D84BAFF4B47AB68BAD40E7217CD8F1ECCB500D43119627BA23C657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636870736, "uuid": "bc2ccb65-1a99-4c8b-ae10-8ac1ff54b939", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636870736, "uuid": "99d0e058-1fb4-481a-abf5-39c25014840b", "value": "24576:nj0blBh7jdCaOV851WzzgBqUrJcsnLazxt3zTYQVMWCG7fRqX6kEaHNYK3E7oy3y:nI5Bpjz51+gBqccs+zfDTv7pK6NauU6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636870736, "uuid": "56daa763-33df-495c-b97b-e9080950e17b", "value": 1447424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636870736, "uuid": "c2e73988-6fdc-4620-b2a7-8eda37a3c229", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636870736, "uuid": "178efaed-7409-4f6e-a475-6aef4fea58b8", "value": "Private Fortnite Cheat V2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c82304b-4520-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1636876664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876664, "uuid": "9d9396d7-7126-4283-bc9b-a49558431a78", "comment": "Malware payload (AZORult)", "value": "c0a96424b843e8e2742540a88bd21f84", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876664, "uuid": "ac3558b4-a5bd-44ba-b2ae-630ae2d4d964", "comment": "Malware payload (AZORult)", "value": "4e188ab7f0b3b75ed614a411e7a3832c5813bf28a640907286265663aa7a75d6", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876664, "uuid": "782e574c-6c01-421b-8284-4654316781e4", "comment": "Malware payload (AZORult)", "value": "435a321868dc95e7c6e1acbeb8befc61ce72f2b6", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876664, "uuid": "d3b74595-1872-4571-a429-87593da0f1a1", "comment": "Malware payload (AZORult)", "value": "1d1cf91b996f7ecd739f95361a014092eae4a4da045499667668c125b20cb9896718038914823988c432d9c640990048", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876664, "uuid": "e8295c53-1dc9-4d64-91e2-ddc16a65b261", "value": "T1B1D3076EFBC18677D02409BC8D45E2B9907975302E391812FBE64F6CD9F96C26A5C2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876664, "uuid": "b2506048-1ed7-4062-81f9-71956f036b4b", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876664, "uuid": "3f3692b3-deb9-4abe-abf3-8df404ed6533", "value": "3072:TrxRaX6raoCoCyz6/mqv1JR+yBtGOeheWgin4Idq:TaZ1tme+1win4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636876664, "uuid": "363bbca5-9aed-42ab-9587-370b6b10bdb3", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636876664, "uuid": "eab8cb01-e5e1-48af-a6dd-b3ca2332c0cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876664, "uuid": "8d535839-8933-4b8b-b823-e03c717e308c", "value": "4E188AB7F0B3B75ED614A411E7A3832C5813BF28A6409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f17946d-4566-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636906598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906598, "uuid": "ef15ce8e-bfca-4f8f-be3f-e20087fc9984", "comment": "Malware payload (Mirai)", "value": "654ac866be5520737e4ad334cd4301f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906598, "uuid": "1656317d-9018-429e-b98b-69553e6d7944", "comment": "Malware payload (Mirai)", "value": "4e3acd7085c31f171d24dfb4de623181cbae89a1c508c4b7bb483e6791dd68c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906598, "uuid": "e25d01b0-a087-4f26-ad1a-cb5ed9566d86", "comment": "Malware payload (Mirai)", "value": "9fb677144b66640fdc4529c004c380e656633ac1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906598, "uuid": "98201f2d-eebc-4d4c-8166-4a0162284c3c", "comment": "Malware payload (Mirai)", "value": "202ae5afcf3ef9e6020a33278427ade334410c556504ddf98b8b3039e301cfc1eb54cb29a1d95baf18284e97bd24fa30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906598, "uuid": "289035c1-40fb-4121-8bd2-da2d072f5396", "value": "T1D6B2E1C40BEB0BC3D651B333B5CD5CD5B373FD91291A9EB14A6B712AB32A3454604E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906598, "uuid": "ea8be30f-b4db-4845-9831-fc7e6142eb8f", "value": "768:P/QOC0Yhn6RODyFeDb8lYfMSOwB8O0/KxS:P/nihnuFn6f3M/+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906598, "uuid": "92253dae-c187-4f4c-8f96-8ff717e56890", "value": 24892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906598, "uuid": "ff42ccb2-b9b8-434d-b7f0-2572a391eb50", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906598, "uuid": "4e68a5d6-88aa-40bb-a7ba-171e10e8ac38", "value": "654ac866be5520737e4ad334cd4301f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad33b57c-44f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636858680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858680, "uuid": "28210215-fd8a-4df5-a927-91ce2b8f36f3", "comment": "Malware payload (Mirai)", "value": "4c70d7c57d72949d0095ff4047401e7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858680, "uuid": "3b587678-45af-4363-9ea1-762f781adede", "comment": "Malware payload (Mirai)", "value": "4e4283a9746b24932d2e43991dcbc89c62ed1b343ca2684435ef2089abf36a02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858680, "uuid": "cf479754-b71e-4449-bfd3-3a2c5aeee5f3", "comment": "Malware payload (Mirai)", "value": "9c5f57b279f66b81c52f1bba437fdda0107b7ca8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858680, "uuid": "1c336d4b-53e7-4709-9967-7e54ae4b4d32", "comment": "Malware payload (Mirai)", "value": "8f30cd20ac169c6efcef2d17de1f82eba58a90765fd5f34cff9639c952896c204a2ae1fd3312113ab5b8940eb9e6631f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858680, "uuid": "5da79fd1-9acb-482d-9b93-b263f88b6142", "value": "T11A3302CCC9831CD2D47781FD4E248F50BC950E5A6CA65C01B521EA8BCE53DBB7827AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858680, "uuid": "8e5dc814-fb3d-4823-8b78-9154292660e0", "value": "768:xZIid12T6DySnYJ8Ib2rfZMdV+upNVJ2O2HhRlZyF5DM+p9RuC5pURbar+cJG8bQ:12H0O+9HbYp9/5p8GaqGwVJuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858680, "uuid": "0821909e-3dad-4772-b0ac-5edd90716ec6", "value": 54708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858680, "uuid": "9cdcb5b3-5681-49c7-a68f-b440e969851c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858680, "uuid": "c0b95afb-ad60-4088-b354-e427fe2d7611", "value": "4c70d7c57d72949d0095ff4047401e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58246d80-4506-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636865409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865409, "uuid": "fcd5951a-87ef-4511-bce0-408470e45c02", "comment": "Malware payload (Mirai)", "value": "0664d53d9fbcbef43e8b567ae75d1a91", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865409, "uuid": "31b5414b-4450-42b9-af17-ae1178c6fd0c", "comment": "Malware payload (Mirai)", "value": "4f7ef5d34cdfb36d4509024904a9ad246fcbd4d0511309092b751888f6d397f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865409, "uuid": "52016efd-7db4-42ba-a53b-52a750ae092d", "comment": "Malware payload (Mirai)", "value": "224f8c1375697b3953d6b850b38f18b5c01d57da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636865409, "uuid": "b8944a07-0ae4-408a-b279-04fd076317bd", "comment": "Malware payload (Mirai)", "value": "4f5a20620da191bf6b70b82e2dfaf6565bdf24323c72b2c51d8ec0506882721481ded707febb61a00e277f5539a017d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636865409, "uuid": "dec6fe9e-b6b2-4772-bb40-d0559a661a1b", "value": "T16AD2E170459550B4C2A04C33D36E48933B3703B9E2F63D8A582A06913EDBB755239A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636865409, "uuid": "738f1a06-8b5f-4918-bc5d-2c5f7ab26190", "value": "768:seaRLnMZ9cgcxPkciObQWC+7azG8YPrRJs3Uoz7:s9KJQkcislB8YPr6z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636865409, "uuid": "f805d7f0-f8f3-4241-912d-8c642c17890b", "value": 29936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636865409, "uuid": "73b51706-b763-497f-a3aa-b13f0bbba14d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636865409, "uuid": "e90233b2-5368-4c0a-a0e1-9c1806e24c2d", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2cd2ea-459c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930113, "uuid": "f3aa3126-a1fb-44ad-92af-5ead0c174164", "comment": "Malware payload", "value": "16c1e1645478b59e7c1ceaa3a802ae77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930113, "uuid": "d4617864-ad2e-45da-b206-1d8da348beb9", "comment": "Malware payload", "value": "51a2b06e192e386443dac75a34d03017e72707e7309427528ce93813bd79fedc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930113, "uuid": "1bed8a5a-69f3-463c-93fa-d3b14bb2ffad", "comment": "Malware payload", "value": "7cfcbb9f109978078ae9f77eef08fc46a93c17f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930113, "uuid": "45dadcb4-8986-40b1-9ca0-e0a7f44487c6", "comment": "Malware payload", "value": "4dc2780c7708c5a3ab5207b992bb834970028f5df8d0b881b2e3415e39b9fd73a43d00193332d959f92385a12f0e48ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930113, "uuid": "788e29ed-af76-418f-8c95-6667e691537d", "value": "T192A2BF2CD244005ADA12C43D9FF507D05EB00FB5A803ACDB365DEA9EDF4A1B5A426EF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930113, "uuid": "48c77bcf-c32f-4ae0-98ae-4e9eab3852df", "value": "384:TpFobTlrgrQYAhK9w3wBKN8f500GwFt/bX84x12BLL4JgGlzDpH7uNj1JbF:9ufykYAhK9qZlw/zXhABLL4JgGlzDpbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930113, "uuid": "1ed3dd0d-e5ea-457e-9e21-88a2abe61fbc", "value": 21440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930113, "uuid": "922d4438-59c6-4318-9288-f25a9115c64d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930113, "uuid": "309d792d-69ae-4e5e-b695-96f587d39357", "value": "16c1e1645478b59e7c1ceaa3a802ae77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2480ec-4582-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636918730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918730, "uuid": "98c2efe1-0095-4c6e-b1ef-dcc5184064df", "comment": "Malware payload", "value": "f4f142a313965b0540d8dd0ee052903a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918730, "uuid": "9c2fbbf6-32ab-4d12-92af-dd0def3b4bec", "comment": "Malware payload", "value": "51df3efd5ca29b397fa1baf171a24512b5b35aaabd1366371e7aceac1f16cc46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918730, "uuid": "07682ba9-2897-476b-b9a6-99e5090872cc", "comment": "Malware payload", "value": "9f519d060e300498e80217e2ce94dc37ebae4d80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918730, "uuid": "2eaa6ced-9d8f-4925-97e1-1bc9c7046793", "comment": "Malware payload", "value": "db9dc748cad24d6440508e8f6ea8bcbc8b284461ad7efd06e1bb360ba003cf8ecee16b4bd46f28b2a50a6d43d86790f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918730, "uuid": "4cf9379f-7858-4e8a-ab9a-45a82ab95696", "value": "T1D536226266020055D0E5C8399537BEE1F2B1165BCE92FC7677CEA9C82F322E4E217C97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918730, "uuid": "c526d8c3-f6c5-4c52-bf04-a0c568099e3a", "value": "f004fffd794021c1fd1973c589ff06fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918730, "uuid": "2c0068d0-39ee-446e-8c6a-2a61aca32ece", "value": "98304:n2Wv9zmpso6ceElXXUrk0fMSWN9sCibzezvFK:nbw605m/WNq3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636918730, "uuid": "3fb82e5c-e657-4a7b-9aed-04ad2c1b2be2", "value": 4892328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636918730, "uuid": "b5c0cc46-eaea-44ec-9c3d-89bc1c32622f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918730, "uuid": "d989358b-7601-4e62-a3c6-d5c40573000a", "value": "f4f142a313965b0540d8dd0ee052903a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93033887-459e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636930791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930791, "uuid": "167f8fa9-6354-43af-95c5-2bb6ab4451dd", "comment": "Malware payload (Gafgyt)", "value": "8673576adcbee57f8c1192c8771dd90b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930791, "uuid": "012272ee-a952-4346-8767-e504597c5c9e", "comment": "Malware payload (Gafgyt)", "value": "51f6b76b7baef25c2e996e53e7b4d4e2997099feef847edc632072555d223316", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930791, "uuid": "e351bae2-6c01-425a-a710-f43217036e4c", "comment": "Malware payload (Gafgyt)", "value": "90c4dfaca67e8ed1140951ff8c707f42395afe37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930791, "uuid": "5d1bc877-4149-4fa6-982a-ce73562d19f0", "comment": "Malware payload (Gafgyt)", "value": "435ec9c0bb3e3323395c355b18ec43803494ced542d286bab9c996835dfbfe43f5dfc8997f24583c0d0d967ffbef5342", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930791, "uuid": "1f3e6c12-851f-46af-8c09-4ff7144ae3c3", "value": "T136145C24C6504B5BC1E3277AF68B424E3B335BB7A7DB33195938DAB43BC17A84D22521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930791, "uuid": "066b1c48-c4ad-4018-9446-cc24d3ee9006", "value": "3072:exdOdPjcvoRnL+FXu7a2RCoQ9KGSYoOmn1N/muYlM/90TZFmUewfxmqPN3:+WgvoRL17a2RCoQQGJmnj/muuM/90HmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930791, "uuid": "7ab4557b-9ff3-4f62-9e06-1f33a9f3722f", "value": 191148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930791, "uuid": "c374bc6c-0d99-4ded-9528-3b71c012cec3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930791, "uuid": "2b69242e-aaee-426c-b4cc-2e7781363e2e", "value": "8673576adcbee57f8c1192c8771dd90b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf04065-451e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636875698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875698, "uuid": "051a971e-e739-4422-96cf-54a813bcb172", "comment": "Malware payload (RedLineStealer)", "value": "4c4a764e270f6525be8fb4b447bc87ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875698, "uuid": "cdedbd8c-c084-4120-81a0-78d5c5f8075e", "comment": "Malware payload (RedLineStealer)", "value": "548b678ec11ee27ece7c30416c41a8c192a7c9a0075ef3043bf8fccb53830690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875698, "uuid": "d47198d5-6920-486b-ad52-1da9a732cf98", "comment": "Malware payload (RedLineStealer)", "value": "f4f62a3c906ab8f0319a490ebe70d1d6c2cc2115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875698, "uuid": "318627ba-0d34-4ae2-9b47-b1b38b8de145", "comment": "Malware payload (RedLineStealer)", "value": "4ceebdf7c8c5f103ce668270053a6dd7ab966fd3c62037f0ff38eef4b80afe614a6fe95d880fc6153ccd13a7f89f3da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875698, "uuid": "016d58c3-b111-4eb7-b038-8db2e19363f1", "value": "T13A163396A319B0BEF57DA13053EE6C89EB72BCC5F3E1319FA6760E0019B905AD2C411D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875698, "uuid": "38716fb5-15b6-4a43-b174-c2c3aa07fec4", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875698, "uuid": "3f8ef9ee-1fc1-45b4-a85d-1c8d2f73c18f", "value": "98304:j/YB9Pyg2+tHLMXPJqJm+fHTuVoXIfcA6w1NSp:rYB9qg2+tHLCJ6uV0IEA6w1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875698, "uuid": "80bba7ed-433c-4bea-a831-426d6ec39c47", "value": 4393472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875698, "uuid": "1ca59c3e-0c24-4a5f-8d7a-8bfc631a9184", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875698, "uuid": "458f1c2c-c560-48da-a265-6ad72200a6de", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bbc8c8-4566-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636906603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906603, "uuid": "69854c9b-f616-4849-b0af-56a1b1307cd7", "comment": "Malware payload (Mirai)", "value": "0ce27ed73b8fabad6a3863f1e86aabab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906603, "uuid": "64d3c15f-b03a-401f-acd1-c9b6d49bc3eb", "comment": "Malware payload (Mirai)", "value": "54b0373382fdfdd6deb894669fa2dace2d1aa1058bb9b114ada927c12df285d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906603, "uuid": "e5aa7e97-c773-4ebf-aa4b-adb7338bebc6", "comment": "Malware payload (Mirai)", "value": "a6edfef1700b256a9fa0a031cc9fc6dd7c4c6d88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906603, "uuid": "97965927-264e-4eee-bf6d-2cb4b9f7c4e6", "comment": "Malware payload (Mirai)", "value": "7ae3b2ee86f2b020e2fbae396bffb0f712f1925e9185fa4d5ec46a7f31310395bb23dbd0fd06f5f43f7499eca8490429", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906603, "uuid": "95fdecf5-6043-44b3-8fc8-6ce53898bb0c", "value": "T11E337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906603, "uuid": "1fcb631e-e3ae-4c1b-bb98-82f076c9618c", "value": "768:jaixFwtLSYAagMo0ebfELvv0X3pyWfs3I9ICJUU/qMCqKomQRCvI:jaQFwtOG/v0XJfs3kICJt/qMF/RCvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906603, "uuid": "7e895e86-6e0e-4fd9-9996-85fdce3b520a", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906603, "uuid": "ddcf6b4d-cccd-4501-a21e-9205c8c2ef4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906603, "uuid": "2393a857-a385-45f8-8b2b-3c5a03ba3db2", "value": "0ce27ed73b8fabad6a3863f1e86aabab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67894402-4520-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636876601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876601, "uuid": "aa308ced-3b1a-42b1-8901-ce05d5938aaa", "comment": "Malware payload (RaccoonStealer)", "value": "7eff0f5b940a4369f71f85c3bf7b0f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876601, "uuid": "258a7296-ff6d-4525-87ce-8371f832c212", "comment": "Malware payload (RaccoonStealer)", "value": "5523638949848b383861e23b4d54caa09d1c7e047fb2293bd3938416339d5b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876601, "uuid": "6a7a9cb9-135d-4699-a549-ba4feac62d9a", "comment": "Malware payload (RaccoonStealer)", "value": "e1cf8d6fbdf6ff77a8f0391b472fa2752acadf90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876601, "uuid": "9a12616d-3c58-496b-a356-1ee1a036e1ac", "comment": "Malware payload (RaccoonStealer)", "value": "5cbef06e8f55727e40eed2d168956af37f12ba7f60d162f617f9e3f09f505e7544ec536a3c3571cbd2a040e802eb5be0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876601, "uuid": "17d25592-d582-438c-ba2f-510f569e3a72", "value": "T143B401F26BF2C431D0657D30A9A6C7A0472BB872D530911AF3B4A75E2E733D09A76706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876601, "uuid": "6f2e0074-dcb2-4ed5-9615-922ae3568db3", "value": "cba5ab921edb2daa29ddf7f914128d13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876601, "uuid": "aa217e10-6689-4fa9-853f-3c8604ae8f6c", "value": "12288:CAOuo9Q+l1H/gQ4o8q6YPK70DkYo62D3lpsmSj2v79:uVQU1HC0xikto6Glpl95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636876601, "uuid": "3338f60d-54e7-4254-afbe-d9e4f819e6c0", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636876601, "uuid": "74614b4c-d4fa-4b90-af17-3634d80957e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876601, "uuid": "7fadfe2f-361e-48b5-9bbb-699789b57559", "value": "7eff0f5b940a4369f71f85c3bf7b0f0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50ed5b0-459e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930821, "uuid": "1dcca195-0eac-46c3-8a8c-f74619013f8b", "comment": "Malware payload", "value": "0db3251c697b3c254c36b60edcf4a63f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930821, "uuid": "0564d04b-f123-44c0-b38f-2a737b717a39", "comment": "Malware payload", "value": "56d95c1cd46ef865ddd40b8af168e5e0a6b362a6ae3978527aba9e6c5582d14f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930821, "uuid": "79e0900f-b8fe-45c0-a279-07e989cea14e", "comment": "Malware payload", "value": "8e8331dac118e1f43d0cd6b0cb7bebe9d9afdfdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930821, "uuid": "5fbc42f8-1d13-454c-b948-c3cc18e06ea2", "comment": "Malware payload", "value": "bd3d2720193f7020a6a4ced8756f35c00333715875d1d188dff5b1ef00f0d8ec22a4cead369731acfd78f1b87eb6d293", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930821, "uuid": "6cf9c04f-4a2c-4fe2-aef4-061e10097d94", "value": "T123330F9D722132DFE857C8729EA85CB4EA5464BB836B4213E0A315EDDE0C997DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930821, "uuid": "22b32a27-15cf-4fe1-998c-1ac5a902f1d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930821, "uuid": "78df374a-435c-4203-90a9-6ae112b83478", "value": "768:Qv2sRn6fm2ZDpafh1k+gVCpBkKgmknSopreMF4XV5psrYMR:Qes1Km29gfh1OVCIKPk5reCKSrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930821, "uuid": "9aeebe47-aa87-4d7b-a440-c2ec741abc00", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930821, "uuid": "48eda22f-24ab-4c0c-8db7-68bd89f77ee3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930821, "uuid": "7c3c47b5-298c-4bcd-b5a3-0d6f4aa83ef6", "value": "0db3251c697b3c254c36b60edcf4a63f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd13676-451c-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1636874978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874978, "uuid": "d9b92b17-129e-4486-b5a6-afb7df0065b4", "comment": "Malware payload (CobaltStrike)", "value": "d711217ffdfa60c0101a4e900b7a0e1a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874978, "uuid": "371eabdf-ad49-4572-bdb8-765517b3d38a", "comment": "Malware payload (CobaltStrike)", "value": "5781fd1c6b3917e6de3875016bb24cd37c75b282281b4feaedef78a524e85fce", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874978, "uuid": "eeb4289d-0cee-42a1-a4f6-bd08712a803e", "comment": "Malware payload (CobaltStrike)", "value": "ec928736f14a2e52507ca5e306992e83cf0c4ec5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874978, "uuid": "9342fc5a-1aed-4435-8cca-c0314b76c0ef", "comment": "Malware payload (CobaltStrike)", "value": "e59ba4089bb0fea4e3c64058fd3d1902f315d18c579acf09aba61a5b8c702f99af87b3cd8af2728555da51f8bcf62fe5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874978, "uuid": "f9f8b3b7-ff22-481d-b574-db32238d6356", "value": "T138264B03F89150EDE0AED230C6A6D252BA71B8944B3023D72F51EBB52B76FD46E79311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874978, "uuid": "2d560c55-f4b8-42e7-80a8-f4b3d6519fc1", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874978, "uuid": "d5954249-c31e-4040-8131-c4d338b83896", "value": "49152:yedam8aawXkXTrb/TXvO90dL3BmAFd4A64nsfJDsCymhs6jXl7bbxMHKsM3/dHwU:yed/a2/64p3L0suwU3cCVR8n0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874978, "uuid": "90325584-23ad-4b19-b259-9d23131135ab", "value": 4592640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874978, "uuid": "d23726c9-8ca6-4823-8c4a-233811957877", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874978, "uuid": "b8ee68de-6075-4852-8644-b1d95af5d124", "value": "d711217ffdfa60c0101a4e900b7a0e1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4d53be-451d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636875299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875299, "uuid": "bc79a87d-08ff-4525-b095-de13ab33eeaa", "comment": "Malware payload", "value": "5fe6efedf5b16b05f59a0d5939a513b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875299, "uuid": "f34e08cb-5ecc-456a-a765-7c73d7db3c06", "comment": "Malware payload", "value": "57de84ac2faa2a05fc3e52fb79ae165e2825308fec4d86e30cc2c0c9984b089a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875299, "uuid": "8fa0d29f-c545-4938-8644-c45650d34585", "comment": "Malware payload", "value": "0f128e7d96403fb9cd0a8bcb2a894f95abc81691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875299, "uuid": "3dd36711-686e-4ce3-8d9c-dfbe1f90b2a4", "comment": "Malware payload", "value": "fbf062168a5c4a16cea1182d2b80d18b9e5a3501f394306277285671a0ecf536ad2558e2e983112981c2fba1d4fa9743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875299, "uuid": "89ea3104-daaa-43e8-bda8-c3d152422bc9", "value": "T11EF4E012370B0546E5286B759AB33B124310ADB955729307EEF0752EF03E7BE3AD9316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875299, "uuid": "7d0cf49e-a429-4e59-a986-5f80544c7607", "value": "12288:L8GZC/4Ct57oWN26bWXU8J+kvtyQVw+imK0BXmIVCtCBuZzEZlfVSm5x2U:L8x/4CtRU6bmU8J+sgQVHiaXRVCY8Z4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875299, "uuid": "847bae68-a896-4224-8cd2-39830c73572b", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875299, "uuid": "0fd4df15-5cf6-4425-9c3d-c4aeda3927eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875299, "uuid": "d02f850c-051f-40a8-b8bc-c5c9ffa0d4f1", "value": "5fe6efedf5b16b05f59a0d5939a513b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f55957-45a0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636931541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931541, "uuid": "28093db8-b956-409b-bc7b-1eae706f91b6", "comment": "Malware payload (Gafgyt)", "value": "5527d133569fa91784be517bd243ebd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931541, "uuid": "3eb8ba3b-23aa-4d47-b3e4-47d50902510f", "comment": "Malware payload (Gafgyt)", "value": "5838d1edd964b599ee7d0e4e74ed4367f60139d79200c97ffbfcb48ccb1675bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931541, "uuid": "fea4e044-8331-4480-a299-29fa895b5031", "comment": "Malware payload (Gafgyt)", "value": "d1dfb05af3d48fa0752a6156df06963fe15722dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931541, "uuid": "d56b850b-88d1-4c85-b7c8-cb060bc4bbe5", "comment": "Malware payload (Gafgyt)", "value": "3afd3ee4dd5ce7c7461bcb4ae3c7ecad378b2d6bcaaa9e868edf93545c39b58278ae53c6cdb6c792eb40743fe7d2e18b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931541, "uuid": "3d252bd9-1e0f-4469-be15-6215043a340e", "value": "T1C0D31B64F904875BC2D227FAF74A028D3F3517BBA7DB33255A38AD742BC17A81D29160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931541, "uuid": "d5935730-7929-41a6-8993-130f6ba7ec74", "value": "3072:S9anziJELNmYTLbjjubQu9misFtBa6pImPtzaQYhIAELKNO:SsiJE4YTObQu9mD+mPtzaQYhIAELKNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636931541, "uuid": "65a2473c-8e0e-4c5d-8cf4-a34697adff1c", "value": 138740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636931541, "uuid": "34cddf3b-7e1b-4c08-ad66-2991667baf1d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931541, "uuid": "3bc5e7b1-4275-417a-b319-6a20f53506e3", "value": "5527d133569fa91784be517bd243ebd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f6a07d-4562-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636904941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636904941, "uuid": "7eabf857-c40b-4e23-838b-6abbb1c17d93", "comment": "Malware payload (RedLineStealer)", "value": "60772ab816ff660abbe13f426a57005d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636904941, "uuid": "6c5b0f94-27e1-40c3-b33e-ca1593dc1501", "comment": "Malware payload (RedLineStealer)", "value": "58e99ba13662b546377d579a67887867fc5184a5af2633d0b1dfa9257e1ed2b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636904941, "uuid": "ef1715ff-c0ea-40a6-b8c5-ebc56b098f3f", "comment": "Malware payload (RedLineStealer)", "value": "4a94dedf54c6692f21fe7daf3a8a34a842811b3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636904941, "uuid": "1a3081c9-f00f-4fd4-9784-397200c87d39", "comment": "Malware payload (RedLineStealer)", "value": "41892916d5006bd1f28c7b0e50b27cd39d97222c90b7704cd7329b35aed61409e7d6f4987c9f2331aefa243f5e249c80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636904941, "uuid": "3f889599-f1a5-4727-86eb-fd68bb07e421", "value": "T14CA33A5437CC8A05E6FF0F706CB5111883F0E5936412EB5F4DC954EA2E67B81AA62AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636904941, "uuid": "60ae29ff-db9c-4cdf-8a4c-4779b4ee910a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636904941, "uuid": "309f1d7b-5a19-4fff-8b15-d890d80e0dfa", "value": "3072:FDy7D4w34Re3bfH46KdtTK9R1LLLnLj53NSI9vYwUt:+4U4Re3bfH4JmGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636904941, "uuid": "a5c80454-0fdf-4ca1-ab6a-912956f5567a", "value": 106736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636904941, "uuid": "106116fd-83bc-4b5e-a806-02a4202037a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636904941, "uuid": "26285394-d978-41a9-859b-afb35f14be7e", "value": "SecuriteInfo.com.Trojan.PWS.Steam.21709.4627.15782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c988e42d-454f-11ec-843c-42010a9c0014", "comment": "Malware payload (Amadey)", "timestamp": 1636896952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896952, "uuid": "b7cf5149-6b52-4462-9679-1e2d9d0df3fd", "comment": "Malware payload (Amadey)", "value": "d1448a7cd7fcf240c520f3838fe18976", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896952, "uuid": "9d079601-eec6-4755-85f7-31b16e10c719", "comment": "Malware payload (Amadey)", "value": "59716b314ba0d53b7e8de32a73af01b7b383834bf038c3bcaa8f7d07afc8b280", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896952, "uuid": "9441f083-1bf8-4d1e-a561-c71d35e28258", "comment": "Malware payload (Amadey)", "value": "9c48ef300ab266e6c1d6d05e3baa5247b8eb2ecb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896952, "uuid": "03274a2a-0bd8-4fb0-9da8-cbb4ed4d3bbe", "comment": "Malware payload (Amadey)", "value": "4feb438bb16043d7b9a48a976cef00afe7a4b42dfbf2f386f9dae50bf8fbdf2781a30869794a1291ca59be9332e3f564", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896952, "uuid": "e079ba42-f3d8-436b-a6b4-498ebbf11e43", "value": "T1087633203FD998A4C6901432EF8477FA1EFA8BB41C39C9D373590D4D9F619A2D22B257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896952, "uuid": "9e51290b-09ea-497a-916a-644b9c2c5722", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896952, "uuid": "1753e4b2-7a77-4890-a3f2-e66f9b5829fd", "value": "196608:xRLUCgQ8auK7AWV9ATCD+g/qWU314s6FMlnsbc1Mqwxef:xRdgQ8auUs+qWU1lj0qyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636896952, "uuid": "29d0702e-a67d-4c3f-9ec5-7040d689c511", "value": 7550815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636896952, "uuid": "bb855d49-52ff-497b-bd79-ecb11937a2ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896952, "uuid": "de22d232-cdb8-4073-95dd-9d09bcf9c258", "value": "59716B314BA0D53B7E8DE32A73AF01B7B383834BF038C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c258d92a-44e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636850555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850555, "uuid": "b3f5e4c6-5624-4366-992d-00e898050156", "comment": "Malware payload (Mirai)", "value": "b3e6da55f107352761bac9782297b6ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850555, "uuid": "fac39e12-3a77-4492-8e25-b6c1bccec89b", "comment": "Malware payload (Mirai)", "value": "5a9d16831440acad3e0b2d6392bad1cf5906bc0bc4bc767c8503923b68b850ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850555, "uuid": "dbdc6da4-e608-493d-aa47-a98c20019b72", "comment": "Malware payload (Mirai)", "value": "f51f096173acbba8315583b204094b36b600c470", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850555, "uuid": "bbca1064-a8ea-40f6-b08d-99297265eebc", "comment": "Malware payload (Mirai)", "value": "c667d58ef3a9b98c55d2327b32d68fea5d65e46575c4bc6d80db134455b36fae052083349bd5f2071c637a2ebb7afddf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850555, "uuid": "e322baa8-ac0b-4665-9f5d-10c4b1c5a241", "value": "T116944A8A2781CC4CDE8E4DF472D48FF5DDA04AC0B02A05D675ADFEB2E9421E4DD69D28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850555, "uuid": "5dc42a7d-452b-4c33-be84-560b9689da5a", "value": "1536:S9gLDhwiQkNFfqsJu4Y6mcabZkRW2awPclNOuj/0v174D8Gdi2DR8qa84/iDIjqU:S9QuaNFTJdReZCfM2VDwnN4ChsHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636850555, "uuid": "510843b9-e39b-46cb-be46-9e5b94ccfbd4", "value": 440448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636850555, "uuid": "c3f47447-81e0-4e1f-955f-9d2107f5eb8d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850555, "uuid": "1c9888a5-c33f-4880-b4de-94d550b58381", "value": "b3e6da55f107352761bac9782297b6ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953d174a-459c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636929936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929936, "uuid": "bffa811a-02e8-445e-b19b-dad6d4ca0f1d", "comment": "Malware payload (RaccoonStealer)", "value": "5dfde4765064d71a850d1e4c56980083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929936, "uuid": "cc7de021-2a80-452a-b843-4735afccb454", "comment": "Malware payload (RaccoonStealer)", "value": "5c57f5d5d9d42c5a30f32903119b88500449c275a9d933ba146542a489e990cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929936, "uuid": "23f73b61-b1fc-4e60-b7c0-d02c44167a59", "comment": "Malware payload (RaccoonStealer)", "value": "2fa8107641e0974bc44b87a2abfe495434a6968a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929936, "uuid": "afccd18a-4aca-47bc-be82-094af6a7dfd3", "comment": "Malware payload (RaccoonStealer)", "value": "f637593ead81b140153469a3af4a08605a934dd49f793fffd6b18cd57255e95cbaf9409f86b2d27835de72d46b829994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929936, "uuid": "cc8a6195-b087-4737-9231-4a46a8c8d59f", "value": "T13EB4F1C16BA1B436E1E23D3098A4DAB5367BB831D470550AF3719B2E2E733D186B5B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929936, "uuid": "4c99cfa9-7f42-4228-8ebd-1a8bf5e004e8", "value": "9510c947cc2282bdda1a9b4a47d8d006", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929936, "uuid": "92a8642b-2a8f-4083-bcf4-b30640d9cd36", "value": "6144:BttLX1jfvMqek2LhBI4imdoWG3P/RaYQ9eaBweEKrKRaiNJnhi/7ITsq7igavwVf:BzLX1AkWhBGWG0YQ9eUElRaiNJnhQ79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636929936, "uuid": "44d86daa-86db-420c-8681-bdc3fb1d226e", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636929936, "uuid": "6c8edf85-4a08-421b-9119-d39841c5dbae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929936, "uuid": "6503a621-3dfc-4b9a-bb43-671bc033f5d6", "value": "5dfde4765064d71a850d1e4c56980083.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b49338-44e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636849654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849654, "uuid": "98fefa17-e5b3-44dd-8dc6-be9051e2e953", "comment": "Malware payload (Mirai)", "value": "bfb3ffe1af727262a29da2338d4d8952", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849654, "uuid": "ce909020-d56f-4ea2-b8a6-b66755e7fb68", "comment": "Malware payload (Mirai)", "value": "5cdbeccdd4e92fe82186c4969b8ff3ab99033367cc47413d7d7277dea48ee5ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849654, "uuid": "dd9db03e-17ff-40e0-bba3-cd2266b9134d", "comment": "Malware payload (Mirai)", "value": "9d2d49ec17460d3ee541f9a96165acc719b5d564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849654, "uuid": "2d0a636e-d200-4e18-b928-9556a42aa0d7", "comment": "Malware payload (Mirai)", "value": "23cb11209220b7e1aea4951aa7a03eae6f6b2ac03877d61963d543d7fbc22d72f6bef611e18ee1bdf3c275f29e4cc52f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849654, "uuid": "deabc1b6-8fdc-4db2-9fa0-4cacf8627e2d", "value": "T182F34F0D7E365FBDFFFE413987F71B10A64933991AE1C189C0BCB902697420A641EB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849654, "uuid": "b802a111-9621-488f-9cc8-3b734239e64e", "value": "3072:DUSntOvzIqkK1ScFWyFT5PKvBJI/kOWbAVIewAKZzu9mr773/l/X0rs:htObIqf1ScMvBJI/kRbAVIewAKZzu9m1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636849654, "uuid": "20d1ceee-fbce-4da2-8759-41189629e176", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636849654, "uuid": "69d27082-8c21-4959-8569-08a1d8dcb140", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849654, "uuid": "cb0b08ca-5a28-4f75-ae8f-a27c59de4170", "value": "bfb3ffe1af727262a29da2338d4d8952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5316c8e8-451e-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636875708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875708, "uuid": "63796432-6b05-4c48-8f1e-a827066235d4", "comment": "Malware payload (Smoke Loader)", "value": "5d19eccbb0bf4966e0299e03ad75a009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875708, "uuid": "b6dec333-c21e-48d5-8488-1933dd3f4e91", "comment": "Malware payload (Smoke Loader)", "value": "5dcbc7f0e894b1830f58e2449e85e4666a303594b18abd1c61e6614218ca5199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875708, "uuid": "961637b4-80e2-4e48-bd62-159e58dfe496", "comment": "Malware payload (Smoke Loader)", "value": "81ed326d69804ac679fd27411fc487925414bff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875708, "uuid": "a5aa70af-e760-485a-b32a-7de8327f77b8", "comment": "Malware payload (Smoke Loader)", "value": "a29c4d54f13d644256640ca30cb03c65b448675b03cc75c4d147e9ee695fa3005e27baf179945eec31b4d6b8033e672e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875708, "uuid": "cc421d96-ff6a-48c1-aa6f-ad72f2c7de74", "value": "T1C4646D00BBA0C435F5B716F849B69369F92E7DA1AB3590CF22C526EE96346D0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875708, "uuid": "1b68502a-3b95-4841-b846-757725e0807f", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875708, "uuid": "3928a0c9-deb7-4a51-8145-5940a55f0e9b", "value": "6144:E9t3Kd78AL+CaXWhidIIfLjg93Y0j7/mk+NRXo:034+CaXWhidIIfLjg9R/mdXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875708, "uuid": "f7fe6281-b99d-4aa1-8103-e8264701b869", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875708, "uuid": "be0b37a2-c1fa-4b96-a17c-d263cfc07526", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875708, "uuid": "64f7c6e1-cc24-44da-b540-b3e652f3658b", "value": "5d19eccbb0bf4966e0299e03ad75a009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7598b6fc-451c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636874907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874907, "uuid": "96ec51a1-1e2c-4dfe-819f-01f6f3fa76a2", "comment": "Malware payload (RedLineStealer)", "value": "0ced83a3703eae93e827781c2efde6a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874907, "uuid": "e6c62aeb-df8b-43ad-b560-64c20f071cf8", "comment": "Malware payload (RedLineStealer)", "value": "5dcd38118af84171cab2eb277d81b20d0b3a7266033c7f03dbc11990aac1fc9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874907, "uuid": "d8e8cd96-1683-41eb-a637-d90024a18d82", "comment": "Malware payload (RedLineStealer)", "value": "511af97eae26a5227416c71ebadf96a0a327df86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874907, "uuid": "25c94d76-f185-402a-8f7d-72c1ed5c8295", "comment": "Malware payload (RedLineStealer)", "value": "2dc8dbb742f51d2900bac56656f3053521a5f4dbf116760f447066319e8d734d8cbca480b3b1f34967541380d510971e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874907, "uuid": "12e5e0e8-21c8-47f7-9a03-fbae1f610592", "value": "T1F284D0225F6CF618D0F37D3757CB6A750FB62EE68A3249A51F089A015310D826E3377A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874907, "uuid": "3f800b47-81d5-4e59-994c-2b2c0e6632d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874907, "uuid": "ccd9c508-a86a-4b58-95f4-d5515e0a17eb", "value": "6144:H8nXBYiCY+PoLuuIPV7XY+yhVrzjTdcZ1vPuT66WAmmt+ARVw8V:H8BYhHPX2rzjTuvl0+eX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874907, "uuid": "63785422-c42b-4eb2-90e4-f1577a3701f0", "value": 375192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874907, "uuid": "01e67b23-46e9-4295-9a53-9643a219a65c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874907, "uuid": "b8008f94-13aa-4077-b911-66a9c5e30f17", "value": "GTAInjector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb153dd7-454b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636895317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895317, "uuid": "3db23fd2-d144-44d3-9934-e9a04a428039", "comment": "Malware payload (Mirai)", "value": "6ba19a7cc1e2c6bfd80638bbd4bf65a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895317, "uuid": "5a7768e7-8d0f-4678-b1de-c06214c7fb3c", "comment": "Malware payload (Mirai)", "value": "5e8c6da1760b794949ae7e97caa1291885136e64651f2961fbdbdd33bc35cc71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895317, "uuid": "f665b1a9-83a4-4355-b57f-d728c5ed74e7", "comment": "Malware payload (Mirai)", "value": "a933e47a9b54249b35ea6dc5a547f46ffecdd159", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895317, "uuid": "8ed51a02-25f8-431e-a2ff-6072a4eafd7a", "comment": "Malware payload (Mirai)", "value": "b7fce1f0c2d723a81de9f2ed83a0f493c6f9d17e78c468aee6e23c6e67881ab474675c0aee6842b2f1fa1333c443532b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636895317, "uuid": "f27bcc10-32d9-4a86-b65d-af23daffe455", "value": "T10A23F1E3DC8650B3E7AA4DA9E6F40721B35E5C5CD5053022362E46F4BE16A0CDF3A46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636895317, "uuid": "e17b4af1-3d93-4744-98ee-01fc3c0b478b", "value": "768:rPqoipZhy3js6lxl7LxbtQmYUtFR0lkWSi0q3UIjrmzZh/fjxIYU8kRN:rPOsDlxl71lebjri7TdU8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636895317, "uuid": "8094f534-1589-45da-a37e-6fe61059fc12", "value": 48580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636895317, "uuid": "03e2bd7b-9412-4d58-93eb-3c680cc3ffc5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636895317, "uuid": "0c8706e5-e2d3-46c7-bc4f-13ed5e1d67d1", "value": "6ba19a7cc1e2c6bfd80638bbd4bf65a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fc531d-451e-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636875720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875720, "uuid": "5c152d27-178d-4f5b-8334-2b790f2e510f", "comment": "Malware payload (Smoke Loader)", "value": "d2f2bbd66e36c9c27c2ba79b9d78560f", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875720, "uuid": "5b8b354c-762f-4e85-85e4-8041d46fe415", "comment": "Malware payload (Smoke Loader)", "value": "5ff88df448d441ea0f85ade6525f77b56a946c05837881a35c583911eeff90f8", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875720, "uuid": "fd7e8979-4ec7-482f-8b7a-e47e9efd240d", "comment": "Malware payload (Smoke Loader)", "value": "97056a8891c0b8f0ba9051d126e3020719ec18a7", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875720, "uuid": "6bda7593-beae-410e-8e62-7c00a1184a07", "comment": "Malware payload (Smoke Loader)", "value": "67ebef214f3355edfd34bb5e06b461612f779f3367af214eaf25c9d57c53feb6b8c23889b1eb1b79c8cad68f0e40a576", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875720, "uuid": "2c8720fc-5bdb-4bd0-b457-51abf8ce8632", "value": "T1F1648E10B7E0C435F5B722F945B693A9B92E7DA1AB3490CF52D526EE86346E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875720, "uuid": "4ab1f2ed-0482-42c3-9492-bc31d6c1a554", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875720, "uuid": "9238b95e-9829-4e4b-ab87-be6a4d08930b", "value": "6144:OuqDrTunzvLa5B2RL7pwNNZ0QGaVD4/2PQMoHtc:5qD/uzv+B2RL7pwNNZ0QGaVJPQHtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875720, "uuid": "159a6307-abe6-485c-9000-7be8ea76aa49", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875720, "uuid": "f48f8adb-1342-4926-86d6-c104d3e94a47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875720, "uuid": "e99d0db0-b0dc-49af-a603-0ba3cb475713", "value": "d2f2bbd66e36c9c27c2ba79b9d78560f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370c0eaf-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636874373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874373, "uuid": "6f4fcfdb-7e4f-4b7b-aed6-23086430e696", "comment": "Malware payload (RedLineStealer)", "value": "7fbfc1a54805507e008a8f1e36dcf102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874373, "uuid": "cdfdfa0a-7493-469e-b048-8d6068410b98", "comment": "Malware payload (RedLineStealer)", "value": "6077f0663a7475cff6c26539fca712b3300c21d81a9439b3f76900457532c401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874373, "uuid": "757e4a68-f7b9-4528-b487-e2ff1b26c8ee", "comment": "Malware payload (RedLineStealer)", "value": "766905ec560da4feb0ff107dad8d989d4f8864c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874373, "uuid": "c587773e-ff12-472b-847c-777590498b46", "comment": "Malware payload (RedLineStealer)", "value": "e2f1f3416b34334868cde4ea90e07c54ceffe6184cf408a3dc606d990a0833254978830251b547acb4dd4dcb78c6933c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874373, "uuid": "6d7bf0d0-d203-4f66-a719-1efcbd271ffc", "value": "T14065335BB980B63CC9DD0BB1EB1B0FC9B74508B06CCCC09B99B3611D8D688876D596DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874373, "uuid": "d1730b1b-df60-4bb0-ad8f-b77e56958ad6", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874373, "uuid": "69449343-52cb-4670-8b1e-89fb1fbbde5d", "value": "24576:M/TeAlvEGApRiEJwDzF9SBFJasYipEyAvFhfk9Y7N9sFoVUkEaHNYK3y7oy3NVzl:AXlERiEJazeFJagCyATs9Y7N96kUNaAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874373, "uuid": "f11c4132-553c-4626-a9da-710204d34b0a", "value": 1414656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874373, "uuid": "2b14d1e2-facd-424b-9c8d-f2184b78f5b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874373, "uuid": "e300b025-548d-4c3c-9dfa-8440e5f8c386", "value": "FN_Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5f694c-450b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636867486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867486, "uuid": "10f486ae-373b-4022-91c5-bed9ef238579", "comment": "Malware payload (Mirai)", "value": "51fdc96094975b723f13b91d56227ab8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867486, "uuid": "619416d1-0f3f-4b11-b37c-ce8458fe43e7", "comment": "Malware payload (Mirai)", "value": "60e6ffc46c4456bf34a3a1cb8c138cdba493ac6f8a8255e12d524ba6e57e0c74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867486, "uuid": "ced918ff-9a1b-4a37-ae85-4fac7b85f424", "comment": "Malware payload (Mirai)", "value": "4397c9d828b0dd8d2648cebcc9fe2134c48125e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867486, "uuid": "559028c7-b940-44ef-b36a-d4fc4174f214", "comment": "Malware payload (Mirai)", "value": "90b19c5394e06630e29b6cf2ab54aac074b304bec21a1b23849267914f6cdbb4803a4505431329d0388894bcd7a6d3cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867486, "uuid": "f5da0817-20a6-4ae2-adf9-70a92f6947dd", "value": "T133539EB5C5A8BD98CF699278B61488389723900555E33DFAE781C7A6D00BEECF04D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867486, "uuid": "c41fc9a8-eef1-41c4-b14a-a10adb7aa8c3", "value": "1536:7aK/iivQhuniwt4gVuNosja1Rpeycfs3QtLok1cY3CJna:7rqiBiOVia1RGf+Kn1cY3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636867486, "uuid": "f57c4819-3d1e-43f7-bae3-3117ca3b0cf2", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636867486, "uuid": "3178cbc3-e932-49a2-9ffd-8671c5b41270", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867486, "uuid": "7e7359cd-e829-4e05-9d50-11c2649913c8", "value": "51fdc96094975b723f13b91d56227ab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48db4c93-44f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636858941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858941, "uuid": "c9ed72af-bafa-4d87-b0f9-da6c4ca9f2b4", "comment": "Malware payload (Mirai)", "value": "6a71084954f6d7af95205475f9a90705", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858941, "uuid": "b83e033a-fb73-4391-8241-65388c9dfcca", "comment": "Malware payload (Mirai)", "value": "61693703c593240497c86fb96a856fe55c5fa10d96eafd4607f71fbce3130f33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858941, "uuid": "45570263-a835-4cf6-b9a1-c64c44f619be", "comment": "Malware payload (Mirai)", "value": "096f55f487f19bcbcba8eb1805742e2d47c64e8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858941, "uuid": "bdf91af7-952b-45ef-868c-a1929c1a3765", "comment": "Malware payload (Mirai)", "value": "3fd1d33debfc9cc7da068143d66875880c5234413d970d3eb9a9b516fdac5b2fd10bb7e7ef5d0432d2a35112472f5e64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858941, "uuid": "88ab9496-dec3-4ac2-a95f-9192d812f2e6", "value": "T1D2330130D324A92EDFFD54A46D136944AFF00A5A7FEBF4EAB185C7A22303153D568C92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858941, "uuid": "18a041b1-5f76-4725-ba71-ad4b13a69965", "value": "1536:6Qg+7LeuIahFWWoF2cznm0O6e4u+qgw09z:vgELeuIaloC6e4u+qgwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858941, "uuid": "0b6c094f-55c1-4572-bec9-085798268a36", "value": 51456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858941, "uuid": "57f283b0-9e41-45a6-8cb2-d65b0f6b0ed4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858941, "uuid": "ea501fcb-de82-4d15-8ab1-5c76beaad6b5", "value": "6a71084954f6d7af95205475f9a90705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b290e3d-4581-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1636918269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918269, "uuid": "0439efbb-73ff-488f-bc94-52ca2d39e9b3", "comment": "Malware payload (CryptBot)", "value": "1037068cf9de3dfab780b1311ec94a0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918269, "uuid": "b7db7fd6-d6c5-4b79-9d8f-abc97c841308", "comment": "Malware payload (CryptBot)", "value": "6319b895e7a61947bfa702bf9f092d585f76a983666bbceb8d6dcbabe50e330d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918269, "uuid": "e67bc52e-b433-4b2d-9aec-ecd3953ce442", "comment": "Malware payload (CryptBot)", "value": "743b15e12a70fdd2d5decd85cbbe62616c714b1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636918269, "uuid": "76d7c997-a6ca-473a-a7b1-4d5e2d5357a8", "comment": "Malware payload (CryptBot)", "value": "91cb43b172a4b3b65eeace900b7b1cf78e6ef4a391c1e92d70c7708ad1b4504457b1d638266eee9d150f1cf5a6c9a856", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918269, "uuid": "5c229b25-e6f8-4d39-84bf-f482009d1ee3", "value": "T17D74DFC176A09875E4523D3258258BA10B2BBA39F870CD4AF734679F1EB33D1AA71353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918269, "uuid": "f81c7566-bd87-4092-ba3c-f1afb3ad0bdc", "value": "9510c947cc2282bdda1a9b4a47d8d006", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918269, "uuid": "ab6d11dc-3c84-483b-99cd-3d27877a8de6", "value": "6144:oWyNxVjdUiUhXkChhjCx9uzeButjC7ITsq7igavwVf:oWy/VjdUicphhOxonk79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636918269, "uuid": "a7f7a142-1c54-4a90-9a92-9640dc812df4", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636918269, "uuid": "8e154e4e-e167-4f3c-bda0-547aa0617e6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636918269, "uuid": "5bfaadbb-d97e-4a6c-8e63-270c4099915f", "value": "1037068cf9de3dfab780b1311ec94a0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb869e3-451d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636875513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875513, "uuid": "0bd335cd-0635-4b23-9b8f-76b67985f363", "comment": "Malware payload", "value": "0cb3a5356936e7cc7f47c34c2d51ae78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875513, "uuid": "c3666a62-371b-4220-b727-5016a2cebff1", "comment": "Malware payload", "value": "65306b70bd88d657a33d55f76885d366e812374321397726eaf8981a8773e04e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875513, "uuid": "5035ffc2-f211-4e33-9e38-3d70f8f80a00", "comment": "Malware payload", "value": "34dabdee08944c41fffee9bf070caca01a1c4f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875513, "uuid": "c0559bf3-3697-485c-b653-b10a2e9c68cc", "comment": "Malware payload", "value": "dd8735c060e20b0fd85c81e980c9ba6ebf95bbb60021f95afd23801caf874b1608101246a6dd711cf779ebf0f2cf234f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875513, "uuid": "4561e9be-feeb-4add-b426-b87ff17bc05f", "value": "T1A9658D4AA3A901ECD0ABD278CA529607E7B17C1103309BDF17D55B5A2F23BE15E7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875513, "uuid": "6f01b780-4e7c-4e2f-a6a1-5e243733a40d", "value": "0e0b1327b851d652046461e0a8be7593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875513, "uuid": "632c2c8c-27bc-40b5-91e4-8e6b7763ad19", "value": "24576:LCLwqP0WaBppewqDG9fot7ZQ7NcuVUlJL6RUJsS7dj:LxQNazpPqDG9YZQpcDJLWmDdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875513, "uuid": "7acd764c-addf-457f-98bb-fe9f4a5fa1ec", "value": 1422336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875513, "uuid": "e5740db6-1d98-46f4-a0d9-b58937a8cb91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875513, "uuid": "c5684df5-1b62-40d1-b412-bc60fce9df80", "value": "0cb3a5356936e7cc7f47c34c2d51ae78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5d2526-454e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636896237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896237, "uuid": "0f6d2269-f79c-4130-a96a-b8deb700bbf6", "comment": "Malware payload (RedLineStealer)", "value": "8297de07eccb0c209b87e9dd821eb315", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896237, "uuid": "684a21e6-fd92-4e0c-bf26-72b4f0116b8b", "comment": "Malware payload (RedLineStealer)", "value": "6581b943d65255540daad040aaf2707d57dc132390e42e04d4c7bd136ed401d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896237, "uuid": "5f2dd0df-0407-4f78-89b0-70a7cfbcf49b", "comment": "Malware payload (RedLineStealer)", "value": "7fd8e7dd31b695274f544b1338b6c17af8f7c102", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896237, "uuid": "dd8de394-830b-4760-a0f2-a265178ccb52", "comment": "Malware payload (RedLineStealer)", "value": "1386a4a8c1159fd3d62268d12197a9130f7371bd32256bf71f10e9ac1356aa91fff291607ee2a583cfa215291cb94f72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896237, "uuid": "7f8b5d6e-bc96-480a-86bb-28b3e27b129c", "value": "T1B7F533072F88F533ED6FD7B4AA530705F336D02227A54783B2AD422A2FE63819D4D659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896237, "uuid": "8a6e4e68-f1f6-40cc-a3d6-78350b0f5806", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896237, "uuid": "39d4d474-70ec-4d93-b830-71ec140e2c8d", "value": "98304:DdWjtqiQveM/R6rF2FO4fT7IrqdtVgAjX:DdWjtqiae0ArMF9w2SAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636896237, "uuid": "e86179d9-2525-4a3a-8d69-1e02f8ccc328", "value": 3496120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636896237, "uuid": "5c77fc16-10fc-4fc8-b913-dd06b056fe3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896237, "uuid": "1e774b2b-4f39-4156-8e2b-a434d0398827", "value": "8297de07eccb0c209b87e9dd821eb315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5d9822-453f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636889949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889949, "uuid": "1ee3e658-3449-4494-883b-ee2d51a4bff2", "comment": "Malware payload", "value": "757059cda9fbf1c234b7b5b19e847dfb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889949, "uuid": "aa6448f7-3eb3-4f2e-a59f-d39b5a47f506", "comment": "Malware payload", "value": "65ac7e30500436fede3ed17a3fc9599d9ae049e4b3d3e7c80dc759084ba6d826", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889949, "uuid": "bd1443cf-acd8-4b1d-a4ee-2d96d2823708", "comment": "Malware payload", "value": "60bd88b1af62a06ce7ce0a09b083d21e4dfa0578", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889949, "uuid": "a3140736-488d-49c4-a6d7-493365d86334", "comment": "Malware payload", "value": "be05b2a558d5c44d78630048b4447e3aae7363f84645fc919f8729ac6145785df71baef5d3d983daa798192b15ff827b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636889949, "uuid": "87f8c736-2b92-4b37-a05a-8669471f2152", "value": "T155333B1FE1A21C673663E2D5C4AF0FC75A09A263B74E760F256CAFAC02DF8183589175", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636889949, "uuid": "00a53dd9-546c-4ff0-a715-b21e86b180a5", "value": "1536:iZC02uL2H4RRgfc9WfRjfR23Rcnj696t666iZ:iE0RS4Wc9jCnmcs/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636889949, "uuid": "94dacbbd-2612-490d-b6ca-279034e9dea5", "value": 52677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636889949, "uuid": "a8802534-23d9-47bc-9b06-ab5a68cf255f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636889949, "uuid": "3bb8ebf6-99c7-4964-88cc-6827b565d202", "value": "20170203_671786823d3f486e8e6c55a5371cfe3b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21db8553-4505-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636864888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636864888, "uuid": "fe43f5ef-151f-40b0-83f7-29f2a68b1e21", "comment": "Malware payload (RaccoonStealer)", "value": "1032e43ef6e65285926c4d7fe21299b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636864888, "uuid": "23bb2091-e962-43e6-89cc-563b5a9cc0d7", "comment": "Malware payload (RaccoonStealer)", "value": "65ebd52ba08105df32e2427168357d33c7deca9feed6d78540fa38aafc8e8277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636864888, "uuid": "f2debe64-2d2a-4b37-b4f9-6f0fa0c8cd6d", "comment": "Malware payload (RaccoonStealer)", "value": "019b6c26f68d31389ab385b1029a24c0f70ec74a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636864888, "uuid": "e068137f-5c5b-4fab-bd14-6714b0334794", "comment": "Malware payload (RaccoonStealer)", "value": "f06a6d7219802b64be77fb75740a9a3daa996771da623cc5deb64c8153b0070f12f73efa96ca7fafc2913ed6e23ec8e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636864888, "uuid": "6c1c8b18-9580-415c-acdd-a076a0221530", "value": "T1E1A402003BE2D43AE3AA26306964C7B02BE6BE7215B551473B549B6E1EB33D0C767353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636864888, "uuid": "21c2d122-ad5f-491d-89d6-e2c519afb38a", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636864888, "uuid": "42729623-b01e-4e38-9d76-61237785e554", "value": "12288:EwmXoeS8eMZPbINerPKrPwkK5Vuzef/VoaJdRJJ:D4SUINUrknzQVoaJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636864888, "uuid": "d91e899d-0b9b-4a6f-ba90-6791b09cf3c1", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636864888, "uuid": "a9b1e004-db32-461d-ac05-eb80a0859ca0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636864888, "uuid": "319a0a2c-079d-45a8-8c74-b4f0f3d06472", "value": "1032e43ef6e65285926c4d7fe21299b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc2b11b-4552-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636898117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898117, "uuid": "d51ceee6-72e5-4418-aa41-c50a64e6cc94", "comment": "Malware payload (Mirai)", "value": "56156e912549ac793074cd2a760d2024", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898117, "uuid": "141c12ea-115b-4e2d-8da8-50a0f2dac580", "comment": "Malware payload (Mirai)", "value": "6638e36a1e14f43ba2a51a2c8f656d3283a3338d00b282ee7af6ea4b75366fd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898117, "uuid": "a7b17ef8-49c4-42ad-8c85-6b9e8c53f55d", "comment": "Malware payload (Mirai)", "value": "96340e141219c198967709c680f82693250cc253", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898117, "uuid": "5425deeb-9274-4de9-bd5e-186641a1df82", "comment": "Malware payload (Mirai)", "value": "e1f5689dba678c36978f74d6fd281b2b8bbb62990a5afa7cefdc2c875bc115f0040369daa394a9be999be347e6239cf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898117, "uuid": "20da1d50-198a-4d4e-bcf9-d15c6e07d4a8", "value": "T14CC3E630E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898117, "uuid": "13c36a5d-935e-43c9-9485-aaf21e3e5149", "value": "3072:4jDy/+mh1vtbPIKaebEcUPium7/L7QsvmGugiNb:mOJ1vxfaeblYm7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636898117, "uuid": "ffde9591-762b-4299-bccf-bde4d06bcba4", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636898117, "uuid": "8e45e0c9-3799-4795-8bc9-82effdca0b90", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898117, "uuid": "a64a28b7-7cb1-4863-9ae6-3a574ec20f4e", "value": "56156e912549ac793074cd2a760d2024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c445a56-4540-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636890246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890246, "uuid": "634fc92a-6347-498e-b502-4059b94cdc25", "comment": "Malware payload", "value": "eb6f19e59b24b55aff4724dae5cdbb75", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890246, "uuid": "8267e3a7-7c92-4f34-bf7b-de054ed6fe8f", "comment": "Malware payload", "value": "66bada0de2e0040b92adef6e7cc174068e8d4fa2b67375e3198fd7613de92630", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890246, "uuid": "d862e5c4-91b6-4ab7-8a0a-8052e90bb307", "comment": "Malware payload", "value": "3d8045bf03a59dab715dc338fc090fa3e20b3d3b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890246, "uuid": "7e04f842-c028-4aa5-a995-f41fcfb3083c", "comment": "Malware payload", "value": "709516fb07181a7bf850c1c3fe06bf7ce91015d2e1e75f55aa7caefb908e81b2ba007c5b85d5b3d6e1046231dabfc9f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890246, "uuid": "8d6ac845-9c2f-4930-aa74-aa9a6fdeaf6b", "value": "T10F236E999BAD0E279527510208CC01D99DCF8631F6D8D88E7D6CF97914CC4ABA2EF63C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890246, "uuid": "4b532e55-491d-4ad2-8ef7-2daca5ced41d", "value": "768:jupCHr2ga28om0URVWcXdFQ0RjJpeEZ/qoi3RUFyHRk8YX1xEzSLrzr0vgX+:jDva2NUR1JpVFBnxEBvgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636890246, "uuid": "cbcb4a44-df48-4d1f-95b4-e093c6afdf8f", "value": 47931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636890246, "uuid": "a432e4ce-03a1-469e-856b-3cf434dfb190", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890246, "uuid": "7b20f71a-13ee-480b-800e-56d9cc75a123", "value": "20170206_07542265c4814fc1988ce537ba2c9255.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eba5391-450c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636867863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867863, "uuid": "44d5e409-4b8c-4728-b48e-e724b0d7707b", "comment": "Malware payload (RaccoonStealer)", "value": "1b0430b909f4b677edbddf3094c2e3dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867863, "uuid": "57a6e1f3-4e8d-4aa3-9b8f-d9b190f8df27", "comment": "Malware payload (RaccoonStealer)", "value": "6712966fb71efdd915b841784b4291038c230ce956ec0f3cc21b8010aa2b5097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867863, "uuid": "9d54be93-3732-4354-8488-d40f56218816", "comment": "Malware payload (RaccoonStealer)", "value": "46b73fe505ed3e2e768c8930c629dd03f40b1065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867863, "uuid": "1e71e3e5-0588-4210-9dab-1b0279e153ea", "comment": "Malware payload (RaccoonStealer)", "value": "720714789020f4ac14814868c595e8fead7664a6e52ba9d28b86afdbb36056e4b5dbf309da6d4201b4596ed831403d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867863, "uuid": "6c42da70-7a3c-4cad-8898-f8cced814e29", "value": "T1FDA40110B7E2843AD0592634A975C7611B2AFC32173D509A3B45E77E2FB37D0CA2A793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867863, "uuid": "4129b092-0175-47f2-9936-a39d1077ec17", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867863, "uuid": "b29c10e3-d5cb-4583-99bd-3048f1f1570e", "value": "6144:Gz8XWXoeSd34anzXe4eM/w4CYSBxYzaiXAYYh6nFqDSHrOm+y8DlBB689YyO9XWv:GwmXoeSWan7x1OfkBY8HLOdh1wGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636867863, "uuid": "da6c417c-e8c8-402a-9f2f-0ce7c4bc73d9", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636867863, "uuid": "ab71dc59-433a-4782-bd0b-6eafdcce20ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867863, "uuid": "b13dbf9e-23e6-43f4-be48-b47aa6060751", "value": "1b0430b909f4b677edbddf3094c2e3dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc1ee73-459a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636928955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636928955, "uuid": "ffc989b9-046c-4f4c-aaa2-b3b1684a3104", "comment": "Malware payload", "value": "396d957fc59bd51b085872e385bb413a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636928955, "uuid": "e32aa2f1-aee2-457a-bf57-36488913c23b", "comment": "Malware payload", "value": "681452f4c265ce5eecd48deb2f003fb6b2a736e2863e1b02ce980ae95f929b45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636928955, "uuid": "9276319e-f9d9-48c4-ac2c-d30febcb0626", "comment": "Malware payload", "value": "62e2fca4011db0101fc8c54264784a4ab135c396", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636928955, "uuid": "4a6661e6-bf3a-4e47-8a59-7b74f01de841", "comment": "Malware payload", "value": "cbcf387f5b031d5a332614d27770797079c4c6cd9a1de71aac5b47fb64e76bbdc11e2774571d71c42d22680967ba23e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636928955, "uuid": "11885d40-27cb-4182-b2fa-e42f5ada9155", "value": "T142A2BFCDB2AD358BDADE5E7A408F2BF1EE94E090376E5F8D53518C886624A43F05A035", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636928955, "uuid": "fc8029d1-3744-4973-8044-2febf5adb6f0", "value": "384:KW+A7KnSuNW9ih82XKt4l8SiWbRqvXqQ9y+YRWGVCz0NvSi:4MKnvNW/37+BQk+4WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636928955, "uuid": "8d74efe1-b391-48bf-9aae-e72c363361a1", "value": 21572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636928955, "uuid": "fa3b0748-0eee-4442-8755-6fad63c06264", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636928955, "uuid": "1354d98f-8f42-4dac-bbf2-ba640df41e01", "value": "396d957fc59bd51b085872e385bb413a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e1880c-4566-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636906588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906588, "uuid": "0bf8cbbd-4509-4ac3-a743-ae0f93b687ca", "comment": "Malware payload (Mirai)", "value": "2cd6ec5ab3906a15f27730e93b3729a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906588, "uuid": "59f2051a-c52c-46c0-ae4b-5a7437ab3b5f", "comment": "Malware payload (Mirai)", "value": "68e2de88ce0392f51eb8382fb6375a9f9879e96018bef507aaafce0a0b433046", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906588, "uuid": "f38a06d1-042e-4111-a647-00f81f8fa60b", "comment": "Malware payload (Mirai)", "value": "151bd732dfc0b22e01a585f5b64fe65f343f99d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906588, "uuid": "2e371c54-c3c3-436a-a9d7-86e1784b3afd", "comment": "Malware payload (Mirai)", "value": "0ea6de85eb01fc45dfc17e08d2b3c9e55ca4698cdf6842a4ea2d80b05edd0f0c5b8477e04e8d63c0096e15532d1e62cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906588, "uuid": "9afadd53-1cda-440f-bbea-0101ee183b75", "value": "T14F333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906588, "uuid": "eea882e1-3352-48d9-9e33-cbce32c83925", "value": "768:8CeKEfhe5Xdrbej7IcfFMQ/5MdgFHj0iPuvWeffpqmUJTXr6Lu380DI:dsfIBZeHtJrFj0imvppqmUJP6Lc85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906588, "uuid": "8129ef32-5a93-4533-a8e3-75bdaf2084dd", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906588, "uuid": "a4a68060-34f0-44f8-a809-54d964217484", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906588, "uuid": "10fb9956-aeb6-49e8-a779-9b4933a58dfd", "value": "2cd6ec5ab3906a15f27730e93b3729a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94f4f58-44f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636858673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858673, "uuid": "141c0c19-9048-4d60-bdbe-aa8afc1717e3", "comment": "Malware payload (Mirai)", "value": "49f70b4085f18b0a20339e064c1c2b32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858673, "uuid": "51bd7cb6-e655-4782-802d-3b8092f11270", "comment": "Malware payload (Mirai)", "value": "6945e485e6daf669f631324e056c32d9f3f98f984708c3003a05c0cb75c5b3f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858673, "uuid": "92a3bcf0-42ab-4670-9e19-422293d564fe", "comment": "Malware payload (Mirai)", "value": "b8dc24ef76ecdeb23798cd0312f6a71e09f8cb13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858673, "uuid": "bc4a016b-a748-4627-a4f0-5254daecb9a4", "comment": "Malware payload (Mirai)", "value": "eb34324ac9d40b662043139107cb5b9b57faee891edc09ec74019be6d7c87bc09ade24992162cb280249c49a9bbaa13d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858673, "uuid": "923ae681-f3fe-43a9-83fe-f4fdc0e73eb8", "value": "T161730291130AE9A095905B70A7F8CF5A2B96B0FC97AF74531104FA92198B4C3FCD52AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858673, "uuid": "f2e0d587-65ee-4c22-99ec-b85808eef817", "value": "1536:eRrz92dj0GFKr1dC6vxrHwlXGnqh/fkdCDRUK/9ITUISLLv7lebyezT:4P9yj0SKrlwlX/cIV9XLzgeef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858673, "uuid": "893be67a-badb-409b-a1b4-4d564cd15c06", "value": 80644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858673, "uuid": "a0fb9925-64ce-4e08-a6ff-114106ebd0cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858673, "uuid": "8fb4d26f-f575-43de-835d-0d11ab73f38b", "value": "49f70b4085f18b0a20339e064c1c2b32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe1e3d3-4556-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636899909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636899909, "uuid": "25b2924c-3a06-4bd9-93a4-3cd0591caded", "comment": "Malware payload", "value": "38df87ccac12d33a0fa25687b1341d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636899909, "uuid": "293a1fde-2b1f-4b6e-be4a-5959f5b35a6c", "comment": "Malware payload", "value": "69e66efe150fc4cc9685bb0c57fd164edb85979281643ec63b6b54490aae9374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636899909, "uuid": "e2070f62-65ec-4a21-b5ff-753ccad1b037", "comment": "Malware payload", "value": "df9ccd1b867dbcb33df28ef9c48ae81ad678fd72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636899909, "uuid": "17e859f5-d9e3-4570-bb8b-34ba01fcacf9", "comment": "Malware payload", "value": "261fedba394308f0975020a05ebbae9b3b548c153d12ccc9c4504405a5c2d54ef8008202edc164a736f2a699d2b8cf1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636899909, "uuid": "4df4d277-d443-4573-a381-48c8a590c773", "value": "T1CD455A573FA10086C896CD33DAB757B12BBAFD4469450B2F088577A8DCFA3C14E256CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636899909, "uuid": "aa9c29ca-9952-4b75-9331-77e5b24fdfec", "value": "197f07b08e08be453ab745c2056b9eea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636899909, "uuid": "9f32cf21-9831-4f7a-bfcc-03b857936259", "value": "6144:u5XYXEeWwC42fWao+tPY7fnEOv31ewJWTTXhLDE2Wlut65ahYgsnfva6Oz8dePT2:uZanCHONvyDTW3jfo8drTKziy+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636899909, "uuid": "3f5ef328-a8ad-466d-a8b3-f8d0c8c0f5ca", "value": 1230096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636899909, "uuid": "3ddb067e-a810-4250-93b6-31c0f89ef7b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636899909, "uuid": "c3822c1b-fd26-417e-9082-d4c3934361cc", "value": "38df87ccac12d33a0fa25687b1341d0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc6a505-4518-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636873015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873015, "uuid": "bded6da0-9cc2-424b-9adf-8309e4f1138b", "comment": "Malware payload (RedLineStealer)", "value": "d6d49eb5449c62169927f9beefc811df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873015, "uuid": "b931f404-ae87-44bf-9866-3edf6a838ebd", "comment": "Malware payload (RedLineStealer)", "value": "6d0dbf72baedea5ae324a958896838964375ceafea3339f8d8004f787a5cc43c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873015, "uuid": "515550ac-12a5-42fb-be66-1dfc96bf7b7d", "comment": "Malware payload (RedLineStealer)", "value": "692ef0449cc9a29e31313eb86c1fbed5277c4f1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873015, "uuid": "76773a88-7bcd-4e89-a83e-1856dbbc1c90", "comment": "Malware payload (RedLineStealer)", "value": "0d20156e26274712227e281561faf10954f670bc21ac3b5930a8df4092b07a3e2d3e37d6bfcb796891abb4af147fb204", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873015, "uuid": "a1027e63-0f7c-446d-b112-e9cf3815cfd1", "value": "T1269367D4606121FDD409CB78575B2F34AF1779E783679E03A82B18874A9C7DA8F1A0F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873015, "uuid": "90eedb9d-1cbd-4776-b4f6-606fd6309b69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873015, "uuid": "7242b1a8-d8de-41dd-af7d-84617aecb760", "value": "1536:9stH6AhWe+RYMGTdXEok2y8PDBqaTDOKOVS4A52g5LuUvoGaN0/APAIwtC409wnM:9s3kCqok38PDBqaTDOKOVS4A52g5LuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873015, "uuid": "ec81a9ff-cf41-45b2-8173-a55586b0bd3a", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873015, "uuid": "2e44cbcd-72c0-44c0-95e8-fa8274325744", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873015, "uuid": "1e150e19-0a74-411b-9256-6ae647290798", "value": "Lulu_Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dc8550-4518-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636873208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873208, "uuid": "38dd8647-b17a-4baa-a906-8b3b114711c0", "comment": "Malware payload (RedLineStealer)", "value": "3f64f70a44930e8585348ed5e267388a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873208, "uuid": "fae20aa9-9951-4ad9-a3b2-6ec8e4614757", "comment": "Malware payload (RedLineStealer)", "value": "6daa6ed435ad595ab16d5bcf17ae926bf3913e93bf2cb1bdce1160c8feb3414a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873208, "uuid": "9510dd52-a1d2-4782-bbf0-4ddae7dd7065", "comment": "Malware payload (RedLineStealer)", "value": "589bbd5b0d23c2340151cc2b27ccd05d6bf88740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873208, "uuid": "bb2768ac-8348-45d7-8261-a0e648e0cd45", "comment": "Malware payload (RedLineStealer)", "value": "8ac17b9d9a6af1f75426f0b74d3cd95c90eb7d372b805c2387b729ebb926845968976bb4bb7afaa7709cab16fca25ccf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873208, "uuid": "53430d73-272a-465e-94fd-59e06a1c58be", "value": "T16B74CF023DB5FB58D0F6BF3342DF69964FBB6ED56F3259891A08A9001115A42AD3333B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873208, "uuid": "16caab9e-eab5-4cda-b139-99545c76183f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873208, "uuid": "132bb3db-54f8-43b2-a764-53982937bb3d", "value": "3072:vEsbc4j/uQVwHfCgP3JUJ2VXZUZ4hoUG+0f6gkWSLsrnRYCTtfhIft6AsfubmCdU:yK/uQVwagP5UIXZJhZaSLFYIfAmz8+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873208, "uuid": "a234bbe5-abc9-4377-a6ce-c415c5c81a2f", "value": 347544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873208, "uuid": "d7c42fd4-650b-4ea1-970a-95bf97158dd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873208, "uuid": "be703c49-c301-4faa-ae0e-a4b518036aa2", "value": "Genshin Hack V2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e218546-452e-11ec-843c-42010a9c0014", "comment": "Malware payload (OrcusRAT)", "timestamp": 1636882572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636882572, "uuid": "5eebab9b-cc57-4310-af65-36c91607712a", "comment": "Malware payload (OrcusRAT)", "value": "c74a943d5f3c9a059bde9ec1db2e82d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636882572, "uuid": "027fc957-5c60-4407-838f-9801336dbab3", "comment": "Malware payload (OrcusRAT)", "value": "6f2d51ee6984c00ceb30ca2b08f8599c2272a40b699b69adfb8faf1939ced7df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636882572, "uuid": "25d766bf-0c4e-4eda-9fd2-aa6a3c33fcc5", "comment": "Malware payload (OrcusRAT)", "value": "29b2061e940e4a66841b668cf533b4d8630f08b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636882572, "uuid": "bd1e6d91-be1f-4685-b961-d621aafea16a", "comment": "Malware payload (OrcusRAT)", "value": "eaf1f4e57f40484fec8a0db224bda53454b60896f4f8fad9bf91458180645300e5cd2d8d9a0e2cc48ddc252c2e30f25d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636882572, "uuid": "c6346508-d6a9-47b5-aeb1-77c5e73b0996", "value": "T11815BF013FACBD0BC1BE3679B3B71AC907B8E90A6452FB4E085851AD1D9B701BD153A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636882572, "uuid": "9eb89672-8e92-492c-aa0d-ce35f2a1c942", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636882572, "uuid": "677cd551-6469-4cc0-84fc-2493bb52e9c5", "value": "24576:2G+4MROxnFe3yRM47rrcI0AilFEvxHPjoop:2WMiYyl7rrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636882572, "uuid": "23ba218a-3cd7-4530-97f7-ef7f28343ccf", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636882572, "uuid": "811d3cc5-4577-4daa-a8d2-7a57d16b3111", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636882572, "uuid": "c925c979-12c0-49d1-9f03-1ab5a449daaf", "value": "6F2D51EE6984C00CEB30CA2B08F8599C2272A40B699B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba74acb-4545-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636892473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892473, "uuid": "189a72e9-7a83-4f2a-95b6-ecd54b8bc317", "comment": "Malware payload (Mirai)", "value": "ece27d5747396fcab4ed7d1bbf38059e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892473, "uuid": "77a706ed-6d75-40f8-954e-cffb7fb9d395", "comment": "Malware payload (Mirai)", "value": "70352db0891b0a04c36eda1a6c4f93120d689a89be8cb89d73b40bc76ee0d88f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892473, "uuid": "a6880d0d-dc16-4739-95be-7d479675929c", "comment": "Malware payload (Mirai)", "value": "a302d19858323194c305db2d0daf1ead9f86b1f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892473, "uuid": "e394ef5d-c2bc-4e9d-82a3-4cfa1e98304c", "comment": "Malware payload (Mirai)", "value": "f81e469b0a5801fbd4cb9e418a2ed1a52b46ddcf0df4a5b2fd268b65c6ddeec74c45b78a4d838f68abf8fbc3fd231657", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892473, "uuid": "b0e50399-9ee9-4218-aead-ffcc0efc133d", "value": "T1774308867D91AA26C7C4177BFE6F018E3714A7D8E0DA33438D191FA076CE90F0D5668A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892473, "uuid": "f75f4b33-59c9-4936-a69a-3a58604312d0", "value": "768:+ZJIMBP9XeGw1A0d23oQfXrHw5XTqF1GXKpP+an3mkHuLwCVy/Jx+5H8hG1rmCd9:wJIK9X2Bs3HrH0OF1VpGanWBeZWX505", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636892473, "uuid": "987f3572-7c24-489f-b904-577613f72fd6", "value": 59724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636892473, "uuid": "f6ad5b50-1752-4d8d-83e6-ee777dea9ad1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892473, "uuid": "b3edc903-d66e-47b3-9e1b-6088acdaad4b", "value": "ece27d5747396fcab4ed7d1bbf38059e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd3bb5b-4501-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636863375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636863375, "uuid": "e8cb52f2-035d-49ba-9959-28b1d766b1ae", "comment": "Malware payload (RaccoonStealer)", "value": "aa8761bdf429fded008176a6c6f778fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636863375, "uuid": "0733a8e3-6299-4825-a6b0-8fbf80e74b15", "comment": "Malware payload (RaccoonStealer)", "value": "709dbb88f530e7dd7eff23fefe75b8c42042bf78d373145473c89bf9afcf4423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636863375, "uuid": "acd87090-4ac3-4a85-92eb-d2b5df0af9f2", "comment": "Malware payload (RaccoonStealer)", "value": "cc525e788989d5295cdb3049409c5e3bc9d185b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636863375, "uuid": "184d01e0-a36c-4b47-85c3-ff74895fbd5c", "comment": "Malware payload (RaccoonStealer)", "value": "26347401f809d7276e96b12ba794a9acc8e754eed465b34da67730c3f257d80e40021ce7990c4971ef0143100e88ea75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636863375, "uuid": "9afe0afd-c8af-4116-92bd-a5d98a547d9f", "value": "T185F38C1077E39836F5A6E6306474CAB05F2AF8722570494B3B2417AE1FB32D38A75763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636863375, "uuid": "8b4710a3-3e3a-4006-a535-abc715041848", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636863375, "uuid": "fe6432f6-4faf-4dd1-ba4e-5521f4a76c1e", "value": "3072:N72BgPRRoVUdmcGENlPxq7F96vnpZa9uD6Vdyhk9:ZPRRoVUIcZwWnwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636863375, "uuid": "702bf829-0895-4fe3-bd60-3cc026a82462", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636863375, "uuid": "7bd4b299-e7dc-45ce-916f-db18a6164dc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636863375, "uuid": "0c7ffd20-aaea-404e-80b9-aefc8ddd876a", "value": "aa8761bdf429fded008176a6c6f778fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820f88eb-451a-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636874069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874069, "uuid": "8100f9e6-461f-4274-b6c2-329e352bedf7", "comment": "Malware payload (Smoke Loader)", "value": "50cc10636021bb61620255812fb777b5", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874069, "uuid": "67474708-fc60-4fe6-a06e-43fc3553d58e", "comment": "Malware payload (Smoke Loader)", "value": "71eddcf286dd89c3ea96394d34661ade1f167164dcc4453c31a68cb583069bf3", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874069, "uuid": "b52b50f8-0eea-432d-8caa-62e6032f8808", "comment": "Malware payload (Smoke Loader)", "value": "1cc59c1a1fdec383ee78838d0534d9469a8d73f5", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874069, "uuid": "9d65238a-c606-456e-80a8-fe01c7ba40b0", "comment": "Malware payload (Smoke Loader)", "value": "6efb76a0ef71f3a4c37e88b5047072bd339217eae0b9b283cc410d8455936b6fbc77f0416874d265aa6b92713fd8c128", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874069, "uuid": "7523d73c-eb7c-4f5f-a75b-baf9dad782b5", "value": "T197648E00B7A0C435F5B716F849B69369B92E7DA1EB3490CF12D526EE9A34AD0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874069, "uuid": "5155b9d3-35aa-49e7-bfa3-bed9aa0ee639", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874069, "uuid": "8ee84ef4-6b3c-488a-aab0-e46eb69a70d2", "value": "6144:0iGrjyQZPLseN67N/GH2CwuSoriZ0jGbFD6mFDM7fUG:iyQN36B+H2CwuSoriZ0jGbFvDMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874069, "uuid": "25e619ec-2655-4dfe-b77c-aa6d4a35b595", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874069, "uuid": "129c47ec-4e15-44a9-aecc-ce8ec4df0e9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874069, "uuid": "c737f2d1-26cf-40ef-b3b9-b1982bb147c3", "value": "50cc10636021bb61620255812fb777b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b672e6e5-451c-11ec-843c-42010a9c0014", "comment": "Malware payload (SystemBC)", "timestamp": 1636875016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875016, "uuid": "e40a0e9b-eeb5-42a6-96d3-233d6de89213", "comment": "Malware payload (SystemBC)", "value": "1d2d5950861d191f0cf126bf80e1857e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875016, "uuid": "eedfcbe6-cba0-448b-8033-589ea4b7bccf", "comment": "Malware payload (SystemBC)", "value": "74bc8cc794e98d78ac8e4d6eac70cec70e4c8b1359e53e48f653cac84bafdae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875016, "uuid": "b11736ff-518a-43fe-869c-0b44461f84b1", "comment": "Malware payload (SystemBC)", "value": "d7161ac371c18a87023ce37036bcd25d09d7baa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875016, "uuid": "a6da5445-4e6f-4cad-a519-b460dcfdb2b3", "comment": "Malware payload (SystemBC)", "value": "aa3d3093808c32d939517ec1788ddd929e7d3991995c0383ce1f12258c07108ee00c59f34a9934363afd84126f9da00d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875016, "uuid": "9b106575-c72f-4763-8061-eb12680bf7b3", "value": "T157F39E107BE19876E3A2263154B587B11B2AFC726C73454B3B5C122E0EB33D39AB5753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875016, "uuid": "edda3e74-5b7f-4c78-8b1c-ebd1a4b4e7a0", "value": "620327c357b4e134c44aeeb41890b58a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875016, "uuid": "d63365a4-1c88-4e15-abc9-f2a7a211e9fa", "value": "3072:37NJQEErGWmjpkCQzfeidiXcajPpZa9uD6Vdyhkd:8EErGRjplaroXcaDwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875016, "uuid": "868f673c-5481-4206-87af-4b37dc3742c4", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875016, "uuid": "a34b3377-8be4-471f-8094-c85837719001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875016, "uuid": "13d95cf9-037b-4551-bf12-4ed92c39c1ed", "value": "1d2d5950861d191f0cf126bf80e1857e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ca9cde-4550-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1636897045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897045, "uuid": "2b86204e-0f35-4dba-9460-2355b30c9a56", "comment": "Malware payload (DanaBot)", "value": "a86949c7e1b496f78ea9b2139470fb68", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897045, "uuid": "5e11b831-2727-4459-b405-2cb3f1a60e61", "comment": "Malware payload (DanaBot)", "value": "77ff83cc49d6c1b71c474a17eeaefad0f0a71df0a938190bf9a9a7e22531c292", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897045, "uuid": "4f7f2b67-5a77-4bf1-a8a3-f4007e3ce78a", "comment": "Malware payload (DanaBot)", "value": "6bf666690a7f906fbcd5dfca1bd449b85deda11a", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897045, "uuid": "666a2a04-30ed-4169-8dd9-4f2829ba00ee", "comment": "Malware payload (DanaBot)", "value": "9840862aff5a3585db71afb828de2229d64d173f0c181d0f10d8ffffb72057a3358bbe7707489ec5be17c7ca17e5e8a6", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897045, "uuid": "747ce8e0-b62d-4eff-89f2-f358c0470c5f", "value": "T174F6F122F240C13FE0B71A36557697F45A3FBB201A19C89B67E4494CCF75A807A2739B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897045, "uuid": "d270671c-c288-4778-bdca-9c04326e9a36", "value": "908afa7baa08116e817d0ade28b27ef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897045, "uuid": "cb9bf5e8-67cf-4851-aa4f-765c42fc46aa", "value": "393216:lWMvNVQYSSCD4aduUgwJVE8Pzt3H48uuzH2jlTi/XPTmd:pvNehKaduZwJVvzdH48VH10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897045, "uuid": "569e530f-653d-488a-9f48-9e833b6b387e", "value": 15492608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897045, "uuid": "7b21b576-7db3-4037-b365-f5028ad752d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897045, "uuid": "c051bfd1-7b2e-40e2-aa70-7277323e935a", "value": "77ff83cc49d6c1b71c474a17eeaefad0f0a71df0a938190bf9a9a7e22531c292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5223103-44f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636858236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858236, "uuid": "114382e0-1f18-4121-85f1-68e605a1475e", "comment": "Malware payload (Mirai)", "value": "b99d5fa03b5c8b8efc81d45d1c5a1f1f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858236, "uuid": "e82114f6-023f-49c6-b721-975641751447", "comment": "Malware payload (Mirai)", "value": "7830fd9f1ea71aeeae6f6497666ca76aa690eb83c0f541b9f5265e71a0b68dee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858236, "uuid": "509619da-dba1-49b0-97b7-413032dcd1f7", "comment": "Malware payload (Mirai)", "value": "2f9a8de4c7dc354e94c63d5f37d8eb4ef1cb875a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858236, "uuid": "c89bb152-f828-47d1-8076-31a676d5ca0f", "comment": "Malware payload (Mirai)", "value": "837af00aea485fafb09d1a725ccdf0fadf9fb29cca156d176d7c3b161ad115d401cda566de21783f1da0f610ad059fa0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858236, "uuid": "1e259c44-9a89-43f4-8ca9-e85e10b1fa60", "value": "T1B43302320DC53B9DE5D0187DC7BA49926392DFB4607A303A11A407A974CB90E35F6E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858236, "uuid": "fd7deeb2-c8a7-4212-950c-17d86b717cfa", "value": "1536:yDTVdI2metc+xdIvKBItU2eVptEzKerew8FJz1j:4Tj3artPROfBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858236, "uuid": "136270df-c151-403a-aa29-2248f9a9d56c", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858236, "uuid": "b9ba185f-a125-4bbc-a553-37affe41d9a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858236, "uuid": "2aac8e4e-8c67-4db7-a6da-a26e8b9d0915", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a431cdb3-4551-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897749, "uuid": "952c18c5-7dfd-4f36-ba7c-48021cb007fe", "comment": "Malware payload (Mirai)", "value": "61a2b3fb4938c0e0564f2e79264e871b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897749, "uuid": "7d9460e6-80f1-4234-8521-20b1c336b255", "comment": "Malware payload (Mirai)", "value": "785a909082009ba7c35955f52b6ff33e37b7c03056ec423d873673860646c46e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897749, "uuid": "e8054230-b0ba-425b-9756-b1c72e214742", "comment": "Malware payload (Mirai)", "value": "078a0d6637d4d6e36ce4091d64ea6296dd1534fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897749, "uuid": "5836eb2b-47c4-45ce-b737-052fccc5a939", "comment": "Malware payload (Mirai)", "value": "b99bde18426f65d432285a0e115e5b71bb4d115bbc8b2e1c065d95975c0f0a71e6d2a30d3cff1a855ebb0f93d8e22820", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897749, "uuid": "d890db59-e499-4d75-ade2-1aec5c941299", "value": "T1D8E32A34D4504B17C2C213FAA69E825E3F321F9793DB33115738BAB41FE279A1E69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897749, "uuid": "d3b9fcd1-f82e-4a2e-960e-e22f4ae39e3e", "value": "3072:Cv/WwsLgaq353qHiCOvhOpEqbDQHbe1UkmhxQwoVZUNu:KPLaq351hOpEqbL1UkmhxQwoVZUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897749, "uuid": "1a654390-8fb9-4753-8516-7eacdf39b0a4", "value": 143020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897749, "uuid": "52067a5e-35fc-46cd-90bf-15b80dd7f6e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897749, "uuid": "5f55b214-8ab1-431e-a739-6249cb409f7f", "value": "61a2b3fb4938c0e0564f2e79264e871b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ede5e9c-459e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930784, "uuid": "03c1fcf5-6d6e-42c4-8421-1ab79ae30cc3", "comment": "Malware payload", "value": "24aabf8f3eed06e61a8ab493cbe5bdac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930784, "uuid": "ea5f3f69-1c6b-4f76-aafc-d1ec65867ef1", "comment": "Malware payload", "value": "7860a0e17bc4340ed351438d16b05aa633fbbfc02b6ecb3961668351443ac594", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930784, "uuid": "487d0915-b3db-440e-a737-3ef48c1f1676", "comment": "Malware payload", "value": "cb813a2b5b73d7c41753f1baafb5af59d01ccde0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930784, "uuid": "e1f5eb78-f524-4aee-99d0-9ba4999e270e", "comment": "Malware payload", "value": "0620c68feb1fbf974e4c8c18106ac05a5b770725697175831fe1adfff4c9ae123cf62d0212d978b5e19c5e302b7b275e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930784, "uuid": "b6f0ab04-b42b-4822-a34a-2d6042e30646", "value": "T1C6F39476BBA19EB7D81FCE73059A4505188CD98B42D82FABB3B4C518E74BD0E04E3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930784, "uuid": "cd1bccea-fbd2-4019-a591-a2211fb78e6a", "value": "3072:EHqZU45k7VhT/lmrIpb4nUmOTcyalVwXYVNO:EHqZU425hT/laIpbNmOTcyalVwXYVNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930784, "uuid": "10b8e154-525b-4a2b-b5bf-dc2495399f8d", "value": 172922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930784, "uuid": "0978c7bb-341b-435d-a38d-9b74ab49b1df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930784, "uuid": "8227d805-0c15-4d4e-a0a0-1d5197735210", "value": "24aabf8f3eed06e61a8ab493cbe5bdac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b344eb-451f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636876280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876280, "uuid": "879cb91b-d41a-4f91-ab2f-246f32c6c208", "comment": "Malware payload (RaccoonStealer)", "value": "0a52a6c6f04350ec811665f96d3935f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876280, "uuid": "dc28b937-08eb-4722-9fed-3cc0fb27950a", "comment": "Malware payload (RaccoonStealer)", "value": "78eb62fcd7085f6e34ca30b112672ab1ddca5d98f81d85b6021621b98c43ee0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876280, "uuid": "5daef8de-786a-4690-a6e5-91438857fb29", "comment": "Malware payload (RaccoonStealer)", "value": "10a62112af2ba30630debf91c777af60624e545b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876280, "uuid": "cd07bbab-02b4-4be5-add9-1fb21a9c44cd", "comment": "Malware payload (RaccoonStealer)", "value": "b38698620be1efc2c8b804f0f770a6c3bd9641bdea2780c6def1707e98ffcaf9a87d26ede01813f87e4acd0a745c052d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876280, "uuid": "9f630f06-a3a9-4f5c-a470-3b5133ecc345", "value": "T1EA249DC177D18875E1523E3064658BA15B2BBC32EA705A4AF734B72F1EB33D09A66703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876280, "uuid": "28e824a2-c9d8-4197-87c4-3c9760e38ebf", "value": "cba5ab921edb2daa29ddf7f914128d13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876280, "uuid": "f3562221-6dc8-4cd6-bf23-dbc891549098", "value": "6144:kiZgIouqD8P7VBHEEWWR7ITsq7igavwVf:katouqD8PXHEIR79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636876280, "uuid": "f621d9d3-3ddf-46f1-8271-36cbe0558d81", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636876280, "uuid": "93adbf87-7bc4-485b-b62b-8a5833945d22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876280, "uuid": "e5f41236-6c81-4c6a-8ed7-6879cc2383f5", "value": "0a52a6c6f04350ec811665f96d3935f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab93104-459e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930804, "uuid": "aa484920-2aaa-4a72-b088-fc5bd9aa52a3", "comment": "Malware payload", "value": "07bfc667aa69a8c877073769e7dfa35e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930804, "uuid": "e50d1201-2131-4ba3-8c48-4f1c6dc5213e", "comment": "Malware payload", "value": "797c6eb75c13be5d25ece1efc4456af4202e7027eeebb0b06271335343e45bf7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930804, "uuid": "7d76783f-44d1-4c8e-9294-02906c13850c", "comment": "Malware payload", "value": "7b181d368f173907e6c84690ea8a471ee0b70d89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930804, "uuid": "a4aa176a-013b-45cf-bf9d-ae5817b98337", "comment": "Malware payload", "value": "6f456be1853a927ca12fe1eb7a08622bc07e1df60d9d92a7a92b48262faaf0ab007ff27bb426ddc44834ceef97f44d43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930804, "uuid": "6098f748-3c69-4a36-9cae-4f37073a6f57", "value": "T172A35C3A6740E673D14305B2159B9B210E32FA7B1A1EDA17E75E3CB49B254C4B123FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930804, "uuid": "b5b5c458-3013-4fa2-8729-ba83caec5bfc", "value": "3072:HPHhtbfrUDUPUycOf1PgByHV7TF4WmWvJmmq8cYEJBc+hG:HPXfrSqZ3Ns8FT7Rmmq8cYEJBc+hG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930804, "uuid": "3029a1f7-6aa5-40e2-b3a8-6ec7a15f6138", "value": 104758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930804, "uuid": "06409c60-3efd-49ce-a0ed-d77c48450589", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930804, "uuid": "9d322db2-8f5c-4dda-a461-47f5f7687664", "value": "07bfc667aa69a8c877073769e7dfa35e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c00e23-44e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636849674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849674, "uuid": "69e32093-7cb3-4430-84f0-94ea1e963e17", "comment": "Malware payload (Mirai)", "value": "5f51c42cd55d65a9881c1cae97e72b1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849674, "uuid": "f6456224-74e4-43b5-8f94-8a6680e84361", "comment": "Malware payload (Mirai)", "value": "79b92bd754a28d2e1bfbb082faea1fbac4e0229732fe84cf5fbbfb54d5cdb062", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849674, "uuid": "31a92efe-ccf2-4e41-af50-6a39cd81dadb", "comment": "Malware payload (Mirai)", "value": "2814a6cde3ed5a6fe05db84d196369ae955d1a85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849674, "uuid": "0d92b8d0-0e8b-4f84-b8ef-b622ad51d3ee", "comment": "Malware payload (Mirai)", "value": "40e80b3bc66e41c220a849f28943180a670815dad2b2c7c31ca968bf19beb43ea47c8cf7432198e59b26cf2872fbd0ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849674, "uuid": "459b4301-800a-4fda-a6ea-d34958fdb384", "value": "T128A3E752EC42960AEBE01774BD5F786D231137CDDAD93542ED1A4F243ADAF8B0C5BA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849674, "uuid": "e241ea58-e67d-4783-a0e5-2cc2a2d511e7", "value": "1536:P0mrPPmjEmf9cYGQGUJBT8PmkhcWAzbpb6MQE4iR5yNZXb4IX9mJzS2n:P0mrPr3yd6M/jDq56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636849674, "uuid": "5e1e7c2f-4e0f-4efe-b85e-0ced1973e705", "value": 99564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636849674, "uuid": "c9d85086-a3f4-4044-9126-551a0a37da54", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849674, "uuid": "579bba80-8b62-43cb-be7d-c0be2713ada3", "value": "5f51c42cd55d65a9881c1cae97e72b1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb1078b-457f-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1636917362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636917362, "uuid": "5482a6a4-5ece-46e0-84ec-ce6fb5189f02", "comment": "Malware payload (AZORult)", "value": "27a27493f1adef2577b9fbbf23b7439c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636917362, "uuid": "06e6a132-e7a6-4f88-ac92-896bf20eecb9", "comment": "Malware payload (AZORult)", "value": "7a7be7f6e662a8f7c2039de122ca08da4193d681b8a8a4ac5a25de6223ebcdf4", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636917362, "uuid": "9afb7fea-fa51-40ab-ab47-742d243c7a00", "comment": "Malware payload (AZORult)", "value": "8aa274ffc3bec53a789d84f70b82e3bf7e14d692", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636917362, "uuid": "d6d67515-be16-46c0-b060-bc278abacf48", "comment": "Malware payload (AZORult)", "value": "171da9746e3886078eb1080faaaa9e42cccc81bdd77eb9d11da86cc1e9303ba3b707ca6681c09f0f02ce3af6af14fc5e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636917362, "uuid": "1b0d331c-3238-4b8b-b9ae-37cedd39aa18", "value": "T18B24CF85B3F0867DE5620C3EA5E0B5E16969FE300935D92F2B04977F1B684C1CB25CAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636917362, "uuid": "fc31bd3c-fcd5-458c-90fe-93c21ea09597", "value": "94588880e79b2cd70a96e981b56cc67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636917362, "uuid": "5de791f8-91b4-4129-945e-cda71b50fbb6", "value": "6144:NkbFy7dpTPW4gl7iAukgIVA2Eahra2WuUJ3hSJPu:HzTP3gtinkgGA2XrYuU5hSJPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636917362, "uuid": "4ba0a467-5b26-45a4-852f-348684f38810", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636917362, "uuid": "ed08d583-0794-4211-9523-2f87e0cf644c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636917362, "uuid": "27aa94ca-6f25-4048-bf96-c4cfda155bb4", "value": "7A7BE7F6E662A8F7C2039DE122CA08DA4193D681B8A8A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625ac52d-4545-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636892484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892484, "uuid": "ced812a5-400f-410d-ad25-d2a04be9c16a", "comment": "Malware payload (Mirai)", "value": "e31e539c49bc935206f24b242af662f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892484, "uuid": "17e54576-c52e-44f4-acc5-f5e961eda2da", "comment": "Malware payload (Mirai)", "value": "7aeb98a9171f7ff8a09ce6e8badefc587d85e53bb2563078864cf7b72ae979d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892484, "uuid": "7299d25d-1b98-43f0-a8da-259f1c43887b", "comment": "Malware payload (Mirai)", "value": "654f3e7507cf9d7c8f46614decb554c56e04f75a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892484, "uuid": "a1b0e076-1c55-42ce-81c3-b87861b75fdc", "comment": "Malware payload (Mirai)", "value": "e90cb084e3cb89ec41d567be3daa50bcc0de7b2c49654a905251eb181944b672a6e1342a8461f0a47b1294ebf3421097", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892484, "uuid": "23833421-ad4f-4b76-9d09-2dbbc199f871", "value": "T119834B0272180E07E1920BB4253F17E583BEE9D126F4F689560FDB264A76E77148AFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892484, "uuid": "e6d4492e-9428-40fe-8345-b8ee9de313db", "value": "1536:xOOVb/LYkuH0gMLlh0x0WucANUzn92RBNCYgx4BVDffuEHg:xVx/LYkuIL/xOIBNrvDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636892484, "uuid": "be17e9f7-07e4-4910-9f2b-2e32e2db40ec", "value": 87752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636892484, "uuid": "26226d14-ec2f-486c-9fc2-2ca69169f93f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892484, "uuid": "90634b67-507e-4709-8fa9-afb5a74054de", "value": "e31e539c49bc935206f24b242af662f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8854bebc-4557-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636900279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636900279, "uuid": "438ce9a9-1ecb-47c9-9cc1-397c5f9137f1", "comment": "Malware payload (RaccoonStealer)", "value": "e318134b30e630a1cce477a13d6377e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636900279, "uuid": "c5954225-c827-4c7b-a1b6-5893626d6e8b", "comment": "Malware payload (RaccoonStealer)", "value": "7bd96869acc1bbf4b3fb3f08b853fd22e259d780f0b469e149f94ea0386743e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636900279, "uuid": "02d6084a-defa-4ca2-bdb1-068a90d0eb31", "comment": "Malware payload (RaccoonStealer)", "value": "6e15801413ca24ed23c54716be97bdbba5bf1ac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636900279, "uuid": "3914d46b-07d1-4fe0-8281-7a0d43eb7e0f", "comment": "Malware payload (RaccoonStealer)", "value": "db64146726ede00bea182a906a17a410d37af280410ab25af296bc29385080fe5884d396f03b412a5e99e4725240d32b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636900279, "uuid": "1aae5222-28dd-43c0-b3dd-24113e502618", "value": "T197B401C1ABE18431E2957E309961DBB0073BBD72D670990ABB70A71E2E733D0E562717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636900279, "uuid": "c6e8bfbe-e2ad-4ab4-882a-0d2229270bed", "value": "e26afc83cc50f029d0d1352e4ada9f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636900279, "uuid": "d82fcc28-af22-43a0-a24c-2f650e48e371", "value": "12288:yYO4WZW0fRuWLOKdO2iTTbboqZ5KdEo4Y95k79:ycwZuWyKd3wv8qZ5hmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636900279, "uuid": "5efe4c0e-791f-4173-8f9d-19d78315ab27", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636900279, "uuid": "60525777-48df-43f2-9d34-f7302fd65ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636900279, "uuid": "7afd4a8e-35ee-416c-b3a8-1b136cee4d83", "value": "e318134b30e630a1cce477a13d6377e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58508cc3-451b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636874428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874428, "uuid": "6ff4960d-3d27-4cfb-ad2a-8f7091b76930", "comment": "Malware payload", "value": "5bd2e1ebc32d2c40857b25132ed0a9a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874428, "uuid": "ef023eba-9590-4365-afdb-a25d56c7b57e", "comment": "Malware payload", "value": "7c5575b4f025728ebdb7dc470c52ba95cde7ac6b9ac9fd6d8bf9db48548846ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874428, "uuid": "a6bda795-c816-45fc-9185-a900091d347d", "comment": "Malware payload", "value": "f5a2596d7e9c1447474996ec4f66d80e5b58f679", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874428, "uuid": "b7b3922d-6dd3-4c23-85b2-00d993a16314", "comment": "Malware payload", "value": "ef429d0e36f6b868125dd50664ce900594a0608b4047159e342e401e8383de6680044fa4f27c5c7938c8d59ab8bc911e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874428, "uuid": "719a0013-d039-4d7e-82da-f25a9e2b2599", "value": "T1B8447C427798CB20E6A459F6D1EF592807E2E9D33632E7863F0962891D82377DD80FC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874428, "uuid": "d04bbf02-4138-4e1b-a2b0-76dcc93a8605", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874428, "uuid": "7803e83a-0b4d-4878-aa2f-3ee4452aab4e", "value": "3072:NTY6gfq7iaxqKkWKkmsanWVKur15uw1Cv8BCknSuCM2kpATJkSI7SR3dIXCWNnQk:9Y6gOzxTUXsi6JKQvCTtv+dN18bGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874428, "uuid": "0d479ea5-c31a-418b-a04b-efbe0727509c", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874428, "uuid": "21448c37-6ef2-4db6-a0b8-24f0acd396ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874428, "uuid": "9ec990a6-18c1-46a8-aad4-7ee8aff16b27", "value": "5bd2e1ebc32d2c40857b25132ed0a9a0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ec90fc-4565-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636906289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906289, "uuid": "2dacf508-6f34-45cf-bed0-f2b9c70513dc", "comment": "Malware payload (Mirai)", "value": "d568b2074e0051fe5f1eaa2c6a9406e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906289, "uuid": "ba53fe16-9a1c-4bdf-b9b8-8f23f5b9bd57", "comment": "Malware payload (Mirai)", "value": "7f1cdc02cbf9efec5d757a54bf32343d198e0e3c6e76e81e83b569dc50267a60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906289, "uuid": "39c480f7-bf18-4e0d-9ba3-ad7ccb34b57b", "comment": "Malware payload (Mirai)", "value": "a415553daeec5d888134dee2ceb6774d41953f1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906289, "uuid": "679cdf92-2ceb-402a-a039-acf836862752", "comment": "Malware payload (Mirai)", "value": "d74acb3caee6d7e17cceba34e8f05af62514911cbdb784f85cae7dd92f9da5b422f93c783dee8a7c990c5295f45477ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906289, "uuid": "66efbb90-93d1-4744-a4a8-0275128b34b4", "value": "T1E7230165148396709C910AF3ACBE4A1AA3ED14FAC076CB2BEF5A03439DC1745DEF4C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906289, "uuid": "8f55f905-2165-4b39-8280-1c5dcbbf861a", "value": "768:jK7y1XGOZf8OuMpTkb5b84SSqv1n8gnwaLB+4eq3UIjxqQFqJK7qY5Hbp:b12OaaTkb5Dd0egwa0+sjJuqY57p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906289, "uuid": "dce845c0-720c-4c00-b343-aac0882a8aa1", "value": 48556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906289, "uuid": "7929e0b0-b575-45e2-9515-ee73999011c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906289, "uuid": "ef20fb9d-2728-431c-808f-4d48f85f7e6e", "value": "d568b2074e0051fe5f1eaa2c6a9406e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffab8de2-451c-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1636875139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875139, "uuid": "687d9144-91ef-45dc-b7c2-a2808cb9ae17", "comment": "Malware payload (AsyncRAT)", "value": "6efe747e15ba88f921e8df033394b6ec", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875139, "uuid": "77978aad-fbe5-49c2-a6d6-62d5214fd9cb", "comment": "Malware payload (AsyncRAT)", "value": "7ff833b59d92a0425344bb852d09d7427b88860f824a38c89f89d16e8a9cec11", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875139, "uuid": "32e8b626-fb44-4d93-91de-6ed59af79ea9", "comment": "Malware payload (AsyncRAT)", "value": "48d48689c51095880aa7452508f1317a265cacd2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875139, "uuid": "77da651b-6e4b-48ba-9efe-2e6796e7da47", "comment": "Malware payload (AsyncRAT)", "value": "ee455902251f66b5210f76d315aa29bff3c51d903fa13a3ffff456fdd5b7b4011e37d020885b7174f678f8640aeb7512", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875139, "uuid": "9e23db1c-3f5b-4b33-a062-ada33934b82b", "value": "T103747B06230B4A0AF929B7749AB73B214310BF7655665707DDE5702FE03E3BA3AD8742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875139, "uuid": "4b99d18f-0977-4bd1-9069-6e0595685bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875139, "uuid": "a4a2510f-fcd4-47fc-a683-ef392022fe7a", "value": "6144:2AGXwWtjFZ1ewrmWrGWPRRiP0YkTlqUw9iOvwjUiTcy+kR:gXFx1ew6WygRuUw9iiwjLV+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875139, "uuid": "f5287078-b18c-4d2f-95ab-4998c00dc286", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875139, "uuid": "9326a292-7379-4f87-8e3b-ad5de893ee2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875139, "uuid": "4f3f6ceb-4481-4937-a84e-46785416a59f", "value": "6efe747e15ba88f921e8df033394b6ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9167219-4501-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636863424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636863424, "uuid": "3229e6e4-ebae-4e2f-92ca-e52694a5480a", "comment": "Malware payload (AgentTesla)", "value": "d96e793cbef74517d8262e8356198fd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636863424, "uuid": "e219ff6f-2ead-47e9-bc69-6330f6689c4e", "comment": "Malware payload (AgentTesla)", "value": "801ff75aa2fb884681cfd5263fdb088b2028d8c48e7638887b92572a2ae3472b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636863424, "uuid": "ed1c547a-6a66-48da-a509-8ddb1708ce3e", "comment": "Malware payload (AgentTesla)", "value": "04a2e171b2fb5a29ba80d3f8ed8721f0261f5030", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636863424, "uuid": "bf7bfd56-3876-4464-95d9-bf85533dd4d3", "comment": "Malware payload (AgentTesla)", "value": "1c0937f74ba3edd4a340316f4ff9dbecdb21ee88c3508bf864057ca2e014f045ca8e60e41ca81fb14d2909c7e181cd24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636863424, "uuid": "f9ce5659-d15a-43e2-81b5-207dc4b0c35f", "value": "T17F05AE4567905A3ED0AE537CE062051893B0D010A787FBEF6B91E1FC2CA7762CD692DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636863424, "uuid": "e20fa0ec-ab62-4417-bbb1-5da7ac404aa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636863424, "uuid": "fe7006dc-647b-4c44-89bb-10fb2364c0d5", "value": "12288:0xJ09BW+uTNNUqxYOZ4BFH3C6G6mvHoa0uUKMpgdVHtttgzW5f4xTBg:98+uJqOZiHS6G6+HoDumlzW5f4xTBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636863424, "uuid": "72cecd28-b378-493f-8575-af0c92b7ed00", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636863424, "uuid": "4d50807d-c979-4ab2-ab16-a8f690b6bc43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636863424, "uuid": "8954bee3-3a18-48f5-a228-3e9922a134af", "value": "SHIPMENT ARRIVAL NOTICE - ORIGINAL DOCUMENTS__pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b068c9-454b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636894961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894961, "uuid": "17b8763c-6940-40ef-86c4-4fcfdcdebe86", "comment": "Malware payload (Mirai)", "value": "24e8b2984540a1976a627577fad9e4d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894961, "uuid": "9ca569b3-448e-40e4-9bce-ff73284350b2", "comment": "Malware payload (Mirai)", "value": "826465acec7c235fc584a09d0806f4928a64432cf6cc5d24a1b9715b79f64af7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894961, "uuid": "535f1494-63f6-4978-9227-c9565a4eebe1", "comment": "Malware payload (Mirai)", "value": "df242a0672feea97af9ed5ebd2c28fed7fb67980", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894961, "uuid": "acac2aab-fc60-4371-885d-a7abf4bbc460", "comment": "Malware payload (Mirai)", "value": "63fa0cc1cafa5e39d0279e66b07e464c9b394bc4f7643e9cafb0e22ea69d8e6887fe2acf005b5410d74e579293e2891b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894961, "uuid": "5988435a-3844-4eb6-9665-c2dddfcf43a8", "value": "T16CC2C038534B51B9C8AEA6B602641FE12D710FB65443E88BB363CB93DE951713C07EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894961, "uuid": "6140dbe9-14a0-4df5-b282-4e914c36c10b", "value": "768:0fczX2Kwqr2mMYd8XZTbotn3BE+MnlAJgGlzDpUYs9:00nwX1YdC3oVBE+MnmVqYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636894961, "uuid": "24f1152c-5de8-4ca3-ab26-ea97b6db8244", "value": 26316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636894961, "uuid": "94dcfdce-2728-4e5f-9791-965cbc9e46c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894961, "uuid": "c00d33d1-f5b6-4a61-94fb-0c1e396df566", "value": "24e8b2984540a1976a627577fad9e4d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f248fdf2-44eb-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636854071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636854071, "uuid": "b61b5313-daad-458b-bbbd-852545400301", "comment": "Malware payload (RaccoonStealer)", "value": "2b7ff800bf041e3883123c72305676ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636854071, "uuid": "8b70be11-8973-4a35-89e4-6b61a65ec5e9", "comment": "Malware payload (RaccoonStealer)", "value": "840613e133118f0d8c21ff1b6df7b7cf1245664f88447fdd716a79305e9aeaaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636854071, "uuid": "6f4ae0d6-4b93-4ad0-980e-2cefc6ed3e02", "comment": "Malware payload (RaccoonStealer)", "value": "9d9e27383189ccfd1e0e6e9ffab14c9ca9dbaa4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636854071, "uuid": "ccb54710-69cf-4d55-b738-43444bae43d1", "comment": "Malware payload (RaccoonStealer)", "value": "952092c2bd60185bc32bd3293201fba2a702996a6d51e34bcc5e925a368c0d994c3c8a9264f868cc9233a63b201d1a09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636854071, "uuid": "57620e8e-d7c8-4636-9199-10d77c08c3fc", "value": "T1CAC4D000B7B0C035F5F766F8497592A8B92E7EA1AB3550CF11D52AEE9634AE0EC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636854071, "uuid": "6d5b9fa1-b5ee-4d2c-b7d6-639dbef393df", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636854071, "uuid": "21a64338-c710-4bef-b0cb-1053c7f066ca", "value": "12288:LjH89VzgzND/ZuZT6k28gR8M6coFw+IEQvo7uHNnS:LjH87zgZZ78oz+WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636854071, "uuid": "cca9fbdd-22dc-4a11-bbde-82d2870d68dc", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636854071, "uuid": "75582d35-f5c9-4ab8-a54e-2fc8a1bf50e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636854071, "uuid": "35678637-c70d-401e-89e1-f0096021c896", "value": "2b7ff800bf041e3883123c72305676ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b9e44a-459b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636929566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929566, "uuid": "2aad0ae7-df09-4f3c-b925-b33fc94b5616", "comment": "Malware payload", "value": "5caa8a0ab98ad1d6c978fd6d98aeb7b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929566, "uuid": "506d1878-c3e9-4442-ad27-914185672e81", "comment": "Malware payload", "value": "84277c89d508e1f0834805da1e989f3aaa35cb26a3e1ed4ff6d0346bd199d420", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929566, "uuid": "de89c9f7-4bd0-4b30-b1c0-69fede1ea442", "comment": "Malware payload", "value": "12c27183d8fefdf5950d65a57e995c3f98632752", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929566, "uuid": "4273ea5e-785e-49f9-8f06-d7b51897902e", "comment": "Malware payload", "value": "3cdccfe30e3494f7533761df393cc67b2714d7e046bacbe8c0b84a2f3be36b3111413db258525457279b00fa86dd1492", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929566, "uuid": "973f59d1-4355-4269-9ebc-6ecc8ea65be4", "value": "T16192D03064965C23CA32843BEF6A984765631FB8E9E8BD732C5212343E9550366F978B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929566, "uuid": "875a7f9d-47f8-4bea-9a81-e200532e6113", "value": "384:r3BiNc0KrPsyYrGcUp3EH1pX8v9Oa4eLu2yne7D+LXrhymdGUop5h1:1iNc0KrUmca3EH7X81O0b/errs3Uozb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636929566, "uuid": "a40c5402-e65a-4353-a001-e31c12fbecb5", "value": 20560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636929566, "uuid": "feb57022-6eec-4ad5-87cb-fe0ad68d9fef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929566, "uuid": "e10cdf6e-225d-454e-a4de-821f0060f4fb", "value": "5caa8a0ab98ad1d6c978fd6d98aeb7b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5e733b-4515-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636871808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871808, "uuid": "47b9e5a9-b24a-43a4-a7f5-a2119988dff5", "comment": "Malware payload (RedLineStealer)", "value": "b438e3866613ca1650e6c8c47c126120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871808, "uuid": "14cae044-b0da-4aa0-8680-4298fbb5b733", "comment": "Malware payload (RedLineStealer)", "value": "8466ebd35658644d4c289191e1341b8900bb021196fae0b82fbba7d8a74a3073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871808, "uuid": "ff2e6312-47c8-4340-88cf-a2c14293c561", "comment": "Malware payload (RedLineStealer)", "value": "9833335febcd01c44c567526055172a568e6e55a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871808, "uuid": "bffd3857-7d57-484d-b8f8-190f83161d92", "comment": "Malware payload (RedLineStealer)", "value": "757f99120b109acdf0fb83ddd0ab5cf4046570689a8803fb9e028f7f6cfaafed1ba0bc1c4e67d934dfe4ce58658bdfd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871808, "uuid": "dea524c6-0f14-4f20-8bfb-6d3a74755b17", "value": "T1F97533B642537F1DD1870F3D3E2B78C234AE616DD888E728A26D006DD691815DFDEAC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871808, "uuid": "1aa97875-b085-4f54-bd3a-3ab04c0f128e", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871808, "uuid": "175d4e1b-7193-40f5-af38-a05b071f2b4e", "value": "49152:+PDpUyEqfh+J+jxuUB7RiLjlW3gm58gNaD+M1L:+yyE4r5Rvg1Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636871808, "uuid": "2c3c02bc-6e3b-4d12-abf9-42d09a7e58e1", "value": 1587712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636871808, "uuid": "4453e910-6033-4ba4-a5e5-56d722bfaa33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871808, "uuid": "fae5bf39-7f14-4058-9916-1bf55c245dea", "value": "LeezeyCore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86998e5b-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636874506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874506, "uuid": "4a678bec-8e26-4952-83d4-275af1a2ad55", "comment": "Malware payload (RedLineStealer)", "value": "7819fce8aca798a7b78bd00d28399b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874506, "uuid": "61f68cad-21f2-4a67-811d-d99b49a1ddba", "comment": "Malware payload (RedLineStealer)", "value": "848d61a0f7291d5a0858d5f8d91b8548f5d457c15207cc4b293c17decea77eed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874506, "uuid": "d2478d7f-96ee-43b4-82cd-fda807ebda94", "comment": "Malware payload (RedLineStealer)", "value": "565976a0b2b3b3d8630438f4e096b54d5f868bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874506, "uuid": "85c92b59-9ddc-4714-819d-07b9b590450a", "comment": "Malware payload (RedLineStealer)", "value": "27f5201a870fe6464ff42a981554a339d8828c1368d315b8a841501c78d24a29e984fe869c8167be2ff7e3db575899f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874506, "uuid": "3beb17e9-3c41-4b15-a6e3-b8c543114a66", "value": "T12F65336883F1DD94C31C02B5CD9A71E27333C5B2ACF2E491A6E6B51ABE39D63C9141E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874506, "uuid": "8a735810-5789-4e77-93a4-97c18f7cd2e8", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874506, "uuid": "2546adb7-c7e3-4704-a7d2-ca5c5cd4d68e", "value": "24576:gqLp201av7jd8dEcMvLhLBqPIRWJvKdW9HJkEaHNYK3B601BkFw:gqLplavluEnvtFqPJvKdW9pNazBk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874506, "uuid": "9b02084f-f125-463a-b76a-a6a65a6bb92a", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874506, "uuid": "0b6f2840-9fd8-423b-bcd0-2cc7d711528f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874506, "uuid": "2a9c8454-8fa9-4988-8aa9-8f97935e6fcc", "value": "7819fce8aca798a7b78bd00d28399b64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e2fe2e-451d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636875314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875314, "uuid": "4ab740d1-84f3-46ca-a515-910bac84edc4", "comment": "Malware payload", "value": "9d554c837d237e9d2a9b4c051c75d99f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875314, "uuid": "1074e8ee-8d25-480c-81ab-18456fb88f23", "comment": "Malware payload", "value": "84c89b2859b386f60a109593eeb9068e52b10f435872d2e7abe76bffb4e9d564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875314, "uuid": "cf5cad2b-ff31-4089-989a-5a5e8dcb4ff3", "comment": "Malware payload", "value": "b26e53081d28c2957109ae3ee586b47eb3ed21bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875314, "uuid": "95cabbda-5354-473c-bc9b-0d8ea33ade18", "comment": "Malware payload", "value": "2d0b1626ed5970f2290f0fe60fbb47d7d1b30d4f4ad6a7798f433029b5d5ea32b32dc64d664be7195373e30bab0979ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875314, "uuid": "75b654e1-e67e-42e9-b9ae-149ff09c3a57", "value": "T1E9057D526AA96536D14F06395E83A3A44D267F063A50E9F6B2FE3D08CF357803D1D28F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875314, "uuid": "177ce5ea-cefb-4cf9-8627-ba731ebbb186", "value": "771d05838293a8356c469b98086d5fef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875314, "uuid": "3e556dda-9f41-4359-b180-75679abf1daa", "value": "12288:uBI5fjs/RGn87z7htHHqdmKRcdbmfdRa1P2AI5mlQ45DgyYLaSU3dyBL7Uo2jfnG:Bwq9NofGKsPArGuhFEvOcld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875314, "uuid": "3988e8af-3743-4953-ad5f-5f6b4e5fe25d", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875314, "uuid": "1996bd7d-b06f-45d7-8178-f6984daf6d73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875314, "uuid": "60569a98-63e8-4b34-a572-856b3cc276df", "value": "9d554c837d237e9d2a9b4c051c75d99f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb6b945-4519-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636873822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873822, "uuid": "a9d5da20-b88b-48ec-8488-4af96d1703fb", "comment": "Malware payload (RedLineStealer)", "value": "4d8f67b220f681050180f48ecc8ea9df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873822, "uuid": "375c54a0-c3e3-4e7b-a8e7-8c09eb220689", "comment": "Malware payload (RedLineStealer)", "value": "872c9ca954ed0738734e97cac2496e3961f19d5766a7fe23d93cd3ca8d6f8824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873822, "uuid": "d65dea05-dedb-4aaa-aa70-ad0d492d7a36", "comment": "Malware payload (RedLineStealer)", "value": "147f8ad8c789b42b39dff668ba5752606aceb4db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873822, "uuid": "f8489ece-cd26-4574-a162-6901885c0ab8", "comment": "Malware payload (RedLineStealer)", "value": "d3cacfee89aeb681f3b99054e3e1fd81f8c40a4cf69746323baeaa4cac0b2dd1c996366f8670b72d827ca1048c101960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873822, "uuid": "b2191acd-e058-498f-8b91-7f52d2d7344b", "value": "T18B5533CA7267F69AE20A4230B4231974F7CD34E69D34F160F9EF0E9059E59E1F2801B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873822, "uuid": "ad7bd51a-18a1-427a-aa21-65139fe1a23b", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873822, "uuid": "5039f9a3-d519-476c-8975-2e31a658360b", "value": "24576:bSqdwRIWs7sKxLCoNZTMZYeNKlsOxhIyNupvk832DTkEaHNYK3dGkP9Q2:XdwWxNNNZTyYeUhMyu5GHNaKcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873822, "uuid": "2bc29d45-a02f-489e-baa0-ff02167c3711", "value": 1370624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873822, "uuid": "69ecdaa9-6ac7-442d-9bd7-1bc58f310558", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873822, "uuid": "438f2394-29d8-4bd8-a93f-fd2d4f3bb3e4", "value": "GI_hackV2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a7ab98-45a0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636931492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931492, "uuid": "5f0c5494-0f52-4b3f-a45e-c4dbae4de3c6", "comment": "Malware payload", "value": "7885609d286d111b403db40d21839651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931492, "uuid": "574b5db8-5414-47d6-9d86-85fa72686fc2", "comment": "Malware payload", "value": "876eb969af6aa9510af53c8e75021c1bd625c2dec490fcaa7cf8a321144d34cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931492, "uuid": "80a644a8-4f6b-4122-86a7-77ee0e341ff6", "comment": "Malware payload", "value": "4dc66aefdf0bffc8174b55fd40300ff5522d2328", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931492, "uuid": "6f74c99d-cad3-4782-b6fe-303ab75d67b2", "comment": "Malware payload", "value": "54496f650377f666641ea4dca0bfcd3fb2f68594abe62ff9b47cb513095edeac137850676df50d62c552ac9d65adf888", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931492, "uuid": "ea82f73d-543f-4ce8-90cc-e9337fbddc5c", "value": "T1C2C3297785A55EBBC183B97929E619200F16A9970F3F0A8635399BF0038F4CDB40EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931492, "uuid": "b20569ed-5789-4479-b93e-3bbcb5ad35bd", "value": "3072:NbT8jJ8C/2pIlDJXDmPOkmq8jeCm+IckAJCcJgNS:NbTGJ8C/2IthU0q8jeCm+IckAJCcJgNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636931492, "uuid": "331dcf46-dac3-48d7-ac10-073c5101ff9b", "value": 122654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636931492, "uuid": "3f68b350-14a8-445c-bf2e-5f8b34c1fcee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931492, "uuid": "6a8c4152-358a-4520-882e-f977f24eea23", "value": "7885609d286d111b403db40d21839651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df285628-4523-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636878091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878091, "uuid": "3f292141-f01b-4ac6-bc01-ec5cfde10927", "comment": "Malware payload (RaccoonStealer)", "value": "100f06c3c5a50552ecfde1fbf3e9b4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878091, "uuid": "d4fbc5cd-aca8-464b-8d42-967053c16042", "comment": "Malware payload (RaccoonStealer)", "value": "879b3d8f4e4f90f19da28a6ff8b46fac43c972a2b4b268a708966650b9148b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878091, "uuid": "5bd63a92-8621-49c9-8b38-3e535ca27f06", "comment": "Malware payload (RaccoonStealer)", "value": "1749c9ac51e7d76c5138c7a8a4de13ce16e7423a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878091, "uuid": "69013a7a-5c57-4d59-a5aa-a5022ebdc53e", "comment": "Malware payload (RaccoonStealer)", "value": "a569d22eb16daa89f2f9ee26fc94876ad0cf4f036cc1c1f1a699eb3d22e77b0c07d0932feb62af3ff1ed90e81fd6cd30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878091, "uuid": "1f9964f0-b628-432a-ab81-0e9bfb278c7f", "value": "T1E0B4F1C067E297F5D1963D71B861D6A14A2BB839F470D906B774AB6E2FBB2C04261303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878091, "uuid": "ac3691d2-f2bc-4b3d-ae1d-10dde834b81c", "value": "cba5ab921edb2daa29ddf7f914128d13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878091, "uuid": "235c764e-a802-42df-ae8f-6a90f44e7569", "value": "6144:EAb6+No9Q6xqh3ZBNsqAI/7iyEAWdab0h22z3TIcn8hszfXVZgaG7F7ITsq7igag:EAOuo9QlNsmNEAMej4PzfXVzG7F79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636878091, "uuid": "331fb4c4-fba2-4bc2-8b6e-279850e3eea0", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636878091, "uuid": "19ed66f5-6359-4bc9-bbd8-7cc4df79e72e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878091, "uuid": "d9af3e48-abd5-48d6-a178-556b95bd3633", "value": "100f06c3c5a50552ecfde1fbf3e9b4bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256f1a21-458e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636923735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923735, "uuid": "b0f6352b-671b-417c-99ff-ec4219f74363", "comment": "Malware payload", "value": "7b1c3f5010c8703d58a2d0cfa15b3b12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923735, "uuid": "5182d915-4a21-481b-8eaa-6b27b55cf251", "comment": "Malware payload", "value": "879fccdf9b4b09063a6dbf1ac2cc381a1ebcacf6e38f5b8d4889785a4ccde22a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923735, "uuid": "87f22373-1ac6-403d-8476-01097389dd1b", "comment": "Malware payload", "value": "6e66cf1228c94d08df49fa2b7c3bfb29894cd596", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923735, "uuid": "eb999579-6b22-48a9-aecd-a6590ae716f1", "comment": "Malware payload", "value": "3385bc2cf7ba58fe48ee58069aadc2b39f598c28ee2f8aa0649ce05053abc49d624f7f1b1553b5286674fbdf1b76f159", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923735, "uuid": "2c85d5c4-183c-42c1-96ab-17a1dfbac4ae", "value": "T189E53379BD4E5925D3BA757356B2E37AD622FC415E30838A1E05DE8DBB64002C8213BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923735, "uuid": "d49c7060-572a-420b-8735-ced47d137973", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923735, "uuid": "8842bf10-a881-45ec-9e6e-79e9709b3016", "value": "49152:dD1Zo/BXVv2eK9cgiwMv2DKirx9N1eEuNgi4ANahMxByZuRDjdXggke0j4w+vdtV:HZCUegV1x9W7F45grfdXF7dtxIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636923735, "uuid": "aea37d25-eed7-4c48-ac9d-bb0ec2f7e866", "value": 3050854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636923735, "uuid": "93a105c1-e773-4d10-a204-a2d1f7f65d2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923735, "uuid": "3d26c5dc-71f0-46f0-9173-9b733e56d403", "value": "7b1c3f5010c8703d58a2d0cfa15b3b12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16c8d15-459b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636929580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929580, "uuid": "697f11a6-ea17-4e8a-b86e-f665e1a1b025", "comment": "Malware payload", "value": "0f14ca591699fd5920d4467a5932b63c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929580, "uuid": "03b414e3-5fe0-4f13-b940-ba0bfb5e4256", "comment": "Malware payload", "value": "881c6405182992e405314f36b49f845fa2002bd5ee0ff162cb46fef6785d9fa3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929580, "uuid": "29bd98da-85ea-45bf-9b70-9ed2934035e5", "comment": "Malware payload", "value": "8919ba473a47c63ea74f0326535c0af48b1f4229", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929580, "uuid": "29a5d98d-ef5f-4a76-86f1-2eb2a4a6a72d", "comment": "Malware payload", "value": "ed700b41d98d1a6ea9e711b2d05fc66fb9e066fcaeaeb65d28b106b74d2b22145fb2ce78b8ab32c00446e604b864fa12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929580, "uuid": "1b567ea3-ff0a-4e38-890a-e0458cf5cf26", "value": "T13DC2E165451FFC22DFF11539AE2C4145BF8B27F89099357B1AE186587DC28832BF844B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929580, "uuid": "39fb831a-40d6-4a80-ae17-1185f17a480c", "value": "768:yLa1bdZDfQOK7wWlcTpBOjlSrWL9q3UEL57:yLW7fQOawWlqpvLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636929580, "uuid": "ea344ce2-9a9d-4e71-8029-19c53c42ed3a", "value": 25852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636929580, "uuid": "aeafe1e2-9fef-4286-a722-d1bc7a027470", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929580, "uuid": "2126bef6-9cce-45df-a1ba-2d1079986338", "value": "0f14ca591699fd5920d4467a5932b63c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f29853-451d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636875520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875520, "uuid": "de1aa42c-4a85-4150-ae87-224c58c832f2", "comment": "Malware payload", "value": "b9f785ce342b6b268f5d6111e58efc03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875520, "uuid": "6ae2fa73-29fb-4696-ad5d-5c81b62ef5cc", "comment": "Malware payload", "value": "88554be898d01c32b08f330edfdd0c0c41e6caef8d8a6c6a78673c4639946e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875520, "uuid": "3d463779-5813-4ec4-9599-948de49e0893", "comment": "Malware payload", "value": "60eb0f3a46c8808dbe761e95a1acb65e607bd9e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875520, "uuid": "780a82a6-48b5-46c5-af5e-d86cd1061634", "comment": "Malware payload", "value": "8178902f9381298c9f77b593dabc069d4a36652416f74a3f684c80648ad38247a257d05c2358c4da60a9309aee2fb475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875520, "uuid": "064b1490-78b9-410b-97ed-58b9ade41442", "value": "T1C6658D4AA3A901ECD0ABD278CA529607E7B17C1103309BDF17D55B5A2F23BE15E7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875520, "uuid": "cb5220fd-2c12-4953-b17f-cb483200bf9e", "value": "0e0b1327b851d652046461e0a8be7593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875520, "uuid": "a17e2a9e-c992-4944-afd3-fbf0c2b5f5bd", "value": "24576:bCLwqP0WaBppewqDG9fot7ZQ7NcuVUlJL6RUJsS7dj:bxQNazpPqDG9YZQpcDJLWmDdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875520, "uuid": "f24cb6f5-231f-43b4-8e77-4755715305a5", "value": 1422336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875520, "uuid": "e90d716f-d688-41c6-b75f-069fb906505c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875520, "uuid": "189a4d68-ad79-4183-9800-58a8867b60e4", "value": "b9f785ce342b6b268f5d6111e58efc03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0de1fef-459e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930814, "uuid": "8c995535-2fe5-461a-a790-072e0c5112a4", "comment": "Malware payload", "value": "b908ff420cccb907508ea529dce66d1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930814, "uuid": "95149d0c-6131-40c9-a9ed-9e2bbd772611", "comment": "Malware payload", "value": "887b94442b76008c3c30f3b0cbb73568fa124d3d9b3287d3604a4b0bb2963339", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930814, "uuid": "b151f0fc-037e-47b7-8be1-314c6e5b0a1d", "comment": "Malware payload", "value": "0595f91d4a5c110d4a69afde62a690f6eaeb0d9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930814, "uuid": "d722d636-fe53-4e54-b185-917e0e19b6bf", "comment": "Malware payload", "value": "c7c4cbe6633ff182761a1e986c00932971f1ff1f40e68a70c8f4d6502fcc38ac46ef9d4bf0eda575a410ddeae70cdfaa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930814, "uuid": "c7bc94fe-24b5-4af4-8a2a-a967671a68be", "value": "T1C974F2023FEDF615F151AD3387DB1A320FA369D1463A69B91E08EA0167359526EB333C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930814, "uuid": "0b0eb330-2958-4c12-a65c-fc6b3e19efc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930814, "uuid": "3de7d915-65c4-4d4d-89b3-0e1eb56f3b2b", "value": "6144:Hz6VgwlTk7ZTrCPMWTqFYAocn+XJxPzoNQinM/WV3A369QUUEMXMgoVULkQLAFi8:oQ7ZaPpqFYASXfP4QinM/WV3jOEMXMgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930814, "uuid": "82c1bb34-ca1e-4925-b149-00a866605731", "value": 365976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930814, "uuid": "e56f4365-7a45-41f3-abe0-5fbf6ce2d12c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930814, "uuid": "ac6c5492-b491-4eb1-87e8-17d9a3885553", "value": "b908ff420cccb907508ea529dce66d1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba731844-44e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636850541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850541, "uuid": "98c63d9e-8318-43a4-b8b7-127bda436675", "comment": "Malware payload (Mirai)", "value": "a3fe6d5663a60b515559427d0f5b8e70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850541, "uuid": "0eb5b6fb-5f82-4665-badb-db6d6107e081", "comment": "Malware payload (Mirai)", "value": "88b8a6b1bfa2f983bcf59a05fb735e6cce206cfcabfce7a64974de5bae467123", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850541, "uuid": "6529a86c-1672-4aa5-9aae-ae26aeb1d9fc", "comment": "Malware payload (Mirai)", "value": "c41ae1af74c76abca4163fb8517f34f69f6a87d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850541, "uuid": "ff43a057-c8c4-43d4-9b33-b40d0ba0fc9c", "comment": "Malware payload (Mirai)", "value": "fa4ac0773e56eab0c5ec73cb99d701811110d0c766c0cca3a2c0c0285cb2585082b2d9953e9558470f1c5722feb8d011", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850541, "uuid": "7a8a3cba-fa9f-4c36-8846-8da3eb6bf48e", "value": "T1EAB34A29E1F66EE0C3054CB4B23CEA78434B4184B6C23DF48A878769211B6ED765E7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850541, "uuid": "edb6a1d0-7c2b-4752-95a0-e47e6a277d7c", "value": "1536:5aGG0p+vy2lbvAcEYqAKIwtR9JdWzohK4eS/O/OOueOpOdi+iC2YKvmyiGCkpxEC:5mbq4vAcEYqOwnwzo8kq8m/KSdYjqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636850541, "uuid": "5615ebfa-99cb-47b4-a4a8-39498b836e00", "value": 115704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636850541, "uuid": "d45c223f-d163-449b-9bd9-1b0947de640e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850541, "uuid": "afb1b7ef-578f-437e-afae-773ff68a798f", "value": "a3fe6d5663a60b515559427d0f5b8e70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88666c50-454a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636894695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894695, "uuid": "c9319b14-c811-4a3b-bbf6-2859d4007eae", "comment": "Malware payload (Mirai)", "value": "690e53cfe003f35e1d821738261a865a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894695, "uuid": "ddebe41d-7bb0-4796-a2e9-3f14183e1a8c", "comment": "Malware payload (Mirai)", "value": "88dba1a4a232ff69485ea4edeef47fcc10e03b504304469aa5102088349315d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894695, "uuid": "0c45635f-92cc-43f6-91ab-f55bda247cd9", "comment": "Malware payload (Mirai)", "value": "4afe77e56421688f691939488795dc76ad827e5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894695, "uuid": "24166276-c304-48c7-b13f-642a43e7a26e", "comment": "Malware payload (Mirai)", "value": "7abc6afa6f4a15b4696f5607b034407dc0faf436ac6786e2b6c1bb6157a41bb16b5ab4dec6ed5e19b325ed8f2278fb39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894695, "uuid": "ff961bf0-5f15-47ed-935c-3912940cdb05", "value": "T1B8337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894695, "uuid": "4155ddfd-df1d-47c6-9893-851e096ea3e9", "value": "768:jaixFwtLSYAagMo0ebfELcv0X3pyWfs3I9ICJUU/qMCqKomQRCvn:jaQFwtOGMv0XJfs3kICJt/qMF/RCvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636894695, "uuid": "ccc4c11c-24eb-4b9c-9e86-32dbd361b9c5", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636894695, "uuid": "8090f09e-df21-417c-888e-6388fc9393c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894695, "uuid": "979aeb75-5232-44f7-8e6e-2c69f17852c6", "value": "690e53cfe003f35e1d821738261a865a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f491fdef-454b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636895306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895306, "uuid": "e237aab4-0235-44f7-8def-8166599f4f0d", "comment": "Malware payload (Mirai)", "value": "1e61e22e596376228a7189b73fe6bdee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895306, "uuid": "cb3e1cf4-4744-4ad1-940f-c703abf49a4a", "comment": "Malware payload (Mirai)", "value": "89f110cb4139d759330e77fa27cd47fc2b99cc81e2ce6e3ae32c72f3d9a50814", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895306, "uuid": "ba51e50b-981c-4778-bc6f-6814c2728f54", "comment": "Malware payload (Mirai)", "value": "af65a8b0350dd06dd592f3247e492fbca63ecd2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895306, "uuid": "d1cbdc7f-df7a-4515-b902-eb05a57443c8", "comment": "Malware payload (Mirai)", "value": "756a92c9cf36fc632e87bc969e9b6fc20d0bfb34fa57b4867420ad8d8e804b2b5f938acc00f3055e8963bed02ff108bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636895306, "uuid": "f2ce261d-8daf-49fe-8d7f-62d2349f9e75", "value": "T1FFD2E1244C80F662D1F11D35D05D4357F2DA0BA585ECF2A932276196ACD7893AB78E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636895306, "uuid": "8bbe56e2-2a68-4e0d-91da-2314d46bc3da", "value": "384:NCMdpPW7ozDRkGgS1xw1JkYUrHPsIt3gW6PlVzH+sihF1q5iKkoxz3fqmdGU5Ee6:NJPBznj1marv1xgfusi9WqKq3UIkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636895306, "uuid": "573ef86f-72f1-46a4-81ba-d877ff3dd8c6", "value": 29480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636895306, "uuid": "798c94af-e18b-472e-a204-701fce49fb6b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636895306, "uuid": "114c449f-dcb1-42e6-bbb6-aeaf6a108fa3", "value": "1e61e22e596376228a7189b73fe6bdee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e60fe50-4576-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1636913469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636913469, "uuid": "af2c9049-9d5b-4cc7-9391-8e135c114cf8", "comment": "Malware payload (njrat)", "value": "db404d344d12678f7213b44048818c17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636913469, "uuid": "5c657edb-6e86-4e95-a115-5e2f7cf10433", "comment": "Malware payload (njrat)", "value": "8c4909cf7dc12e6724f7cbb4f095d366237a93ce25c6eedde1ff435aba588c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636913469, "uuid": "b713f3ff-5b15-4836-ac3f-b96055912723", "comment": "Malware payload (njrat)", "value": "7772297858581e8baa9b1546e8dd06fd255f0219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636913469, "uuid": "46943e86-3534-423e-a0b4-acdfeab991f6", "comment": "Malware payload (njrat)", "value": "33f8940592061046690fd19bd09c5611ee05ffb7fc15bfe3e6ea7839930cea7d4b8cd62b10a3fafbfdb53f417f1aa521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636913469, "uuid": "afdfeca3-752d-4258-a11d-797c3dc15fa4", "value": "T1F6032A4D7FE18568C5FE067B06B2D012077BE04B6D23D90E8EE664AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636913469, "uuid": "dd88c568-8d57-49e4-88e7-387ec5eb9761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636913469, "uuid": "71d18546-be4a-4180-a813-ea83401f6df3", "value": "768:k7rtsKADtOHiR4akrYBQWllykrM+rMRa8NuF/Ct:k7r8tVSkBQWlEH+gRJNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636913469, "uuid": "4e6e71d7-0405-44d4-88ac-51cefc3041c5", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636913469, "uuid": "cf7c8233-4009-4dee-92d9-7a1c82e2b94a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636913469, "uuid": "6dab48a2-6e0e-4b10-9e7e-06a13f44371e", "value": "db404d344d12678f7213b44048818c17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37824fbc-4592-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636925484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636925484, "uuid": "2d5486af-86f6-49dc-b148-ef0571d8b86a", "comment": "Malware payload", "value": "b4de54979a2aa69e0a20cbc533bce9c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636925484, "uuid": "73d4740a-4f28-4342-8eeb-fc1931f40026", "comment": "Malware payload", "value": "8cc8d4b8b2f4aacad20fb339f7f4c6e535812acee88e6357015ccbde4e5070cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636925484, "uuid": "369d58a4-e601-4cc9-9375-ece5321f5662", "comment": "Malware payload", "value": "33b424bbab9a7e7c8b0f09184639e124ebaee364", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636925484, "uuid": "58b4b9f9-00de-445d-a1c3-ab9c195db6e3", "comment": "Malware payload", "value": "a87cd61fef4bcdae4f71c49593b4c2d536d2b6ef96f9db2621d24664713bce904ff42a8b4c375534aecae36c6be7f425", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636925484, "uuid": "b017c117-88ba-4693-9382-3f34c46b3181", "value": "T167933676C783AD0589E525D7F521D48222747BC20CCDF41B81608D23E6C699EB7DFE2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636925484, "uuid": "ff3e9185-990a-4384-9850-238233d98f49", "value": "1536:Hz+U/NIqHxc1J6pDUA0OoLosAIZA3Otlz254rD3zlez8EEZpWNk:TX/NJ9kJZ9A3Ob2KP3zl48/ZgNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636925484, "uuid": "dc5faa65-574f-4c34-af9b-1817cb3517f9", "value": 96176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636925484, "uuid": "b31ab61f-6b98-4994-8bd6-9f82da7515d0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636925484, "uuid": "99368f44-52b9-4349-b573-ca87e57444ca", "value": "62514253c82a33766ec25448278bce96.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf2d15a-44ee-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636855295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855295, "uuid": "7d57f811-2345-4897-a839-abbfe6273fde", "comment": "Malware payload (RaccoonStealer)", "value": "d75912b8a971a5421afd2a0258f2b7f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855295, "uuid": "43a02016-5e6b-4f38-a970-c475cafc4988", "comment": "Malware payload (RaccoonStealer)", "value": "8dee7c9f5e45b520324d40a399ce69972385c7d2423068c4496ad7df03fdb977", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855295, "uuid": "444d008e-302b-45a7-823b-a1fe3aa114a5", "comment": "Malware payload (RaccoonStealer)", "value": "d99b84d9f8306a2ce9d758379bdf00b0e5129796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636855295, "uuid": "b7428656-7d86-46b8-88dd-8076b63ebd72", "comment": "Malware payload (RaccoonStealer)", "value": "e3acba0ff3961e7410eeea62035625ac4bf4088930fdb4bc9116797a47cad62d4ae1b9d9f430621b33864497f16f4d6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855295, "uuid": "77d4c628-093c-42cd-8943-e5db051348ea", "value": "T17AA40221ABE2D43AD0672A335864F3A4D73AFD72F875614A3B00161E2E73BC059B5793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855295, "uuid": "8cb72f76-5ed1-4e6f-b1d6-855592d9549c", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855295, "uuid": "7b617785-1d35-4b72-8c8f-a1b8334759c6", "value": "12288:9wmXoeSCd8/eDE79IwlSK8CIKOsiafiRQPSpRHQ:y4SaFDE7Bl1svoqRDRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636855295, "uuid": "c10e64dc-6ba3-400d-9c54-81e8e50a2bf2", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636855295, "uuid": "8a34a307-e5d9-4f46-b02f-d14badb5effd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636855295, "uuid": "aff0547f-d10c-4bf1-8089-229170d8bb54", "value": "d75912b8a971a5421afd2a0258f2b7f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93581def-4565-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636906310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906310, "uuid": "0a5712fa-dc69-4b11-9ac0-998a69f4edaa", "comment": "Malware payload (Mirai)", "value": "ccbb8085a8fd87905b2fb2424b2401f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906310, "uuid": "03407b12-1dc0-41bc-837e-4d366e83a078", "comment": "Malware payload (Mirai)", "value": "8e516e4936f8aeba1d32e1a83a858edeba3aea42d08af75432a7e503a244804b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906310, "uuid": "be091132-9a42-47f5-b53c-75778d543a92", "comment": "Malware payload (Mirai)", "value": "8b89e24c705a22649830059134b923326662827d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906310, "uuid": "097addf4-a0dc-4103-b4c8-58484c6a5ff0", "comment": "Malware payload (Mirai)", "value": "3807f19c1894896c461da524cdabadf917dde8de08a0b834b5865692fab053cc8e84edd7c2f854486d895f0a2abfbfbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906310, "uuid": "2d23eb46-c33f-4b27-b6a4-09f86d18fe67", "value": "T1F7B2C124D0F5ADA4FABF65F88C46EBD07FA0866F393B85C06B80AB10D051BB11E41DD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906310, "uuid": "edd3c8fc-f6e9-415b-8f4e-fdf6b7727a41", "value": "384:7SA0AeimAzNCdvw1PwIW2MnY+xdVHI38eiV6ZY4mrN08BwhxPh57M4uVcqgw0OaE:7UApCdvwJoXnoses6rmrNbCPs4uVcqgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906310, "uuid": "b1adf310-1c8e-4738-a30e-98652c35d368", "value": 24416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906310, "uuid": "8202df40-b02a-4bdb-8e8e-e1a362fd22d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906310, "uuid": "9e47114e-33de-4895-b8cd-e10714cc1c46", "value": "ccbb8085a8fd87905b2fb2424b2401f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ac3614-4564-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636906022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906022, "uuid": "8122f64c-d681-49e8-aca2-a6d68a54a99a", "comment": "Malware payload (RaccoonStealer)", "value": "41a38ac01d1ec59c3f3ccabca37c35ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906022, "uuid": "6e2cf671-740a-429e-8ff7-c28efbe0b968", "comment": "Malware payload (RaccoonStealer)", "value": "8e764ca97e49f2274523c3a21f091635c8dacadbdcb1ca64e248d656c36a7250", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906022, "uuid": "5bcee1d7-522e-488e-b1d3-a973c674ccf4", "comment": "Malware payload (RaccoonStealer)", "value": "55391e36fb245f08aab49c0d36015557126c4943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906022, "uuid": "aa3b27ef-2299-4a82-9275-7ade8de32b27", "comment": "Malware payload (RaccoonStealer)", "value": "96a5a4a6d13034ee62a918d899a35001a64555a9e152dd48143f1d6b3564c9f6c770cd0657adbad938dfdb2653aca829", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906022, "uuid": "d8ffd615-b006-46f1-a839-baf4902fe6ab", "value": "T1BA3633365B84F577FA4B2778440F857A1F7AA67629C666C032EB270FB52E6C009142CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906022, "uuid": "c5bf5e82-0abf-40dd-8048-1a6d3c5fef03", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906022, "uuid": "d7af34c1-f4f3-4603-b92b-ede2419de6e5", "value": "98304:UaI+VQVn3vF4D9FB1AsANSNhbtEOznSROAahV:UaI+VQpwFbAsb/uROAan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906022, "uuid": "8654632b-6b06-4b4d-b4b9-059049447aee", "value": 4871168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906022, "uuid": "9719beb4-c4e5-4ccc-82ff-79926268e5ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906022, "uuid": "f1b0a874-a60b-4816-9647-6a539b6ff3af", "value": "41a38ac01d1ec59c3f3ccabca37c35ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619f85bd-4542-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636891194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891194, "uuid": "5b08eb0a-04fc-42ff-9246-9e50cf548cd6", "comment": "Malware payload (Mirai)", "value": "a171fe478d3633fb11214a1c2a723530", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891194, "uuid": "ccd009d1-0661-46d9-ba6e-e35af95a74dd", "comment": "Malware payload (Mirai)", "value": "8f5c6220a91a0922da9caa5c11bbe286dda85d4df3be5453652484ea87a6cadb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891194, "uuid": "6f7f9ac4-3ff1-41e3-857d-9cb972be82a0", "comment": "Malware payload (Mirai)", "value": "9f4ba23fc4d676fe33764dfa3a7a159311fb2051", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891194, "uuid": "d516e948-222d-46c3-8ce5-7e7c05773556", "comment": "Malware payload (Mirai)", "value": "6efcfed2581830e0fe5770ba84a8952dceea52713d326ec09285a6c7b5057e89a0aa84658fcfbc91b7a372d93944f4ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891194, "uuid": "da121402-8d8a-4388-bd06-9db81cae3e81", "value": "T172936B21B43E2B13C4E1B07F21B7875AB6E067CD26A8C61E7D760E8EFF2254025539B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891194, "uuid": "89d85062-5529-4787-ba18-899bd7389611", "value": "1536:rOJ4SOlvhCqbCsSIVvkxg4WgiBnQ8wZCPmNTUHe:EmQIgP9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636891194, "uuid": "03e3fe11-aca1-4445-9586-a4203b5300c3", "value": 92816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636891194, "uuid": "83cd84de-46c4-4833-9ff2-fe43301408da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891194, "uuid": "efa0f26d-c9db-44df-98e7-017e4a7a83b2", "value": "a171fe478d3633fb11214a1c2a723530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4d3161-4547-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636893363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893363, "uuid": "67e9d4e7-275f-4a72-853c-dd21b272de4b", "comment": "Malware payload (RaccoonStealer)", "value": "6c39d733f22f29ef9e938907b7241416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893363, "uuid": "b9cfdcb4-ed57-4b62-b58f-963a33c1a153", "comment": "Malware payload (RaccoonStealer)", "value": "9024f6ef5d63c82506ef2a9c0dc109d6d65f1d76ea5f8e2f748e719ab5eb2fab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893363, "uuid": "821194b0-bc55-4679-b694-0f7e1cdf94a0", "comment": "Malware payload (RaccoonStealer)", "value": "82f199d81f7cbb059e5fbad7c2873e93d2b88945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893363, "uuid": "fa4ec731-726f-4f7f-b166-c7853f3d4d8f", "comment": "Malware payload (RaccoonStealer)", "value": "6fe6984c17f539008c83eee6027a3f87821c2b31764b6c38778ab7a90d250f8c955def3739364405b24b9a7e2a944c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893363, "uuid": "ec578f1d-41c1-496f-b982-71c3dd3fac07", "value": "T118B4F1C177B2A431D0913E71A8A5DAB122A7B831F834DD56B7B46B1E2EB33D08671317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893363, "uuid": "6cb35884-28ac-4141-8595-5391cb21b564", "value": "d6f1a2cb84dbc438e72cd46aa17d4119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893363, "uuid": "5f9b81b1-315c-4842-b5a2-cfccd3453eb8", "value": "12288:k/SBLpj2QPe7XW1Brm3bUroDeC4KaSnXLSOlftGxKJpbXh77TDq79:kqLpjwG1BrmLCoD1v7S61GsJRXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636893363, "uuid": "9d217647-5b07-4001-bd17-8f99fb81268b", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636893363, "uuid": "2d650b01-2855-44d3-bb29-8f08b3401226", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893363, "uuid": "ad398ece-9f05-4f96-84b1-95e66ee273e6", "value": "6c39d733f22f29ef9e938907b7241416.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9191e00-4558-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1636900871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636900871, "uuid": "4e497e1c-957e-459a-adab-6ab8a32343ec", "comment": "Malware payload (njrat)", "value": "d4140f5a775e00e0c378b273cafd99dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636900871, "uuid": "1dbfc72f-7aea-4eba-95d9-3321b7637512", "comment": "Malware payload (njrat)", "value": "90a325ecd04db2a368f38ffa53e4970f1df87674124b84a7d3bb82630483b499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636900871, "uuid": "df47b788-7ae9-44d7-858a-db77239b6ca4", "comment": "Malware payload (njrat)", "value": "d2d01b17152b0b67db3e85f373a8da1ad15ecf5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636900871, "uuid": "b6cc84ca-adc2-4b78-a9b8-dddc3f54a341", "comment": "Malware payload (njrat)", "value": "08d523e73b95405f9f0aa43959034255e9141cf231e39c939f0334da680066f053687cc3d290595d534249341dc0e7dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636900871, "uuid": "7c75c195-04be-4987-8544-5897b4c810c8", "value": "T1CF13E78CB694E174D5FF8BF1B4A1B2890B71A01BA806D30F99F154D94B73EC09A11EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636900871, "uuid": "8ce81b93-4fbd-4e81-9ed7-3be51857c998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636900871, "uuid": "b5e6cc6d-eb80-48b0-83d7-5e5b577f1ce3", "value": "384:mZypAdCxrmvYUy/fHiZn1cUEorgBHwLzoIij+ZsNO3PlpJKkkjh/TzF7pWnUggra:8yAEYgh3HcneIgNQuXQ/oR0+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636900871, "uuid": "668d2d54-11a3-4f07-9624-817cddadba96", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636900871, "uuid": "6a31810e-e970-4f76-bd5b-40e9fd6a9bce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636900871, "uuid": "8546d4b7-f8ee-4c52-8206-436c4416a9bf", "value": "d4140f5a775e00e0c378b273cafd99dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d5cc48-459b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636929291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929291, "uuid": "50caf9ca-56f6-4dea-afb3-022f029e4951", "comment": "Malware payload", "value": "83a8f9226ff48647d8605cc3e0ecc85a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929291, "uuid": "2441ff68-ceb6-4adb-9a44-14d309b6054d", "comment": "Malware payload", "value": "91a16c3faa57d4cf04e693e2e194277a061f799d6e7d3a226bd92c37b2184c6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929291, "uuid": "5882d0c4-9e20-45f9-94bd-77259206beff", "comment": "Malware payload", "value": "f1327a306efed26b21f7a73e607346b0465e2514", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929291, "uuid": "5d900293-b415-4f91-8288-7ba773fe56f9", "comment": "Malware payload", "value": "7a62e117febf369d048dcdf4e6ecc4189715aa5755c4879b5bcf4c6348b6d452b5534a4f8783dc9209f786a2406a84b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929291, "uuid": "857f5630-8d39-4edf-bc82-c8cf3a442669", "value": "T1B482E1A4C5FDD9E3CA486239037E3ECE5AA87ECA4B5F5C803761D1E648A7064F49D813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929291, "uuid": "c0f879be-a98f-47bf-86aa-90193346f868", "value": "384:MmAncJH3UcC9c4xRvdfuEr5XIcknQ1eatzlWX2JLv1R+:6c5Qc4xRvduGpfknEeayi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636929291, "uuid": "1b04b9e8-eed4-4fdf-8fa4-3fff66db658f", "value": 18216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636929291, "uuid": "86da3c53-f397-4ed7-8838-8bddaeea780a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929291, "uuid": "e099ff4c-403d-4c39-8523-61869a92673d", "value": "83a8f9226ff48647d8605cc3e0ecc85a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4528a93f-453f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636889858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889858, "uuid": "c1286a5e-651e-4222-85de-0dd08e5a909c", "comment": "Malware payload", "value": "3e6a751684c58f33c1a2edd3f0c0ea34", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889858, "uuid": "fb604b2e-bfef-4e07-93d8-3d394d41c344", "comment": "Malware payload", "value": "91edfdb1b5e4670227624c59ce877d3daed0507533419d5cecde1e692e91c2bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889858, "uuid": "ffcb3ea2-2b7c-4fb4-8da5-2b9e570358fe", "comment": "Malware payload", "value": "f0c0e0a0c4b5980777c8203a3081e20efcbdbc17", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636889858, "uuid": "5c7b7879-60bf-48b6-9fff-d50b683a737f", "comment": "Malware payload", "value": "10c902bbbbf0136213a054a5e4cb03ea3a3393656e728a77358f820bf78a604ec39385cd33d440bfe6598389b45d121e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636889858, "uuid": "c5cd96c1-628d-474f-842c-0efd398d397e", "value": "T18453293CE6B79C230673219515DE0BC3994D8397678A2E4E212C6FB952CF82F35CA634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636889858, "uuid": "ba4bc687-311f-4073-92c9-008fc7a6d299", "value": "1536:wDSBVEdJSODVQWrYtRr1fdvPUrBCFGHBmBWXp64qVs4:mSBCdUOQWrYtjoPqWXpuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636889858, "uuid": "7f45577a-0710-4549-8d51-9d2ffd9e3409", "value": 62356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636889858, "uuid": "862b3a4c-7477-481f-855a-c8f57c1f4d8d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636889858, "uuid": "b32625e2-f6aa-455d-9a3f-81f5e10487f5", "value": "20170202_fd62ce23cc6f4d5aa5f37369d7be95af.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1519f829-4540-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636890207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890207, "uuid": "233f2be9-98ca-42ed-b8a6-b11625181a1f", "comment": "Malware payload (Mirai)", "value": "30842a484b1fec86bdd2fe09e35aeccf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890207, "uuid": "d43a6f0b-255c-405f-bf82-8ac038102db9", "comment": "Malware payload (Mirai)", "value": "9209f3d89f8942e2cf1fe36207dd524ab307a97a53df3fff1aa6bd02b8475262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890207, "uuid": "bf7e0b4d-fdc5-4ca9-937a-50f7708dcd77", "comment": "Malware payload (Mirai)", "value": "e5392113df79a61995ca8705fc5786cf5c51ba81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890207, "uuid": "41cb0ffd-c25f-4b38-9043-4153e87d176e", "comment": "Malware payload (Mirai)", "value": "689c1688df6a9cb8b9159f883a23a3233c539b919cdd1d2bfffb1fa95f7ae3551b327c1cf7b0ec5352460ba746396fe3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890207, "uuid": "08f3e086-09c1-43e1-9bc2-b360d9d1a8e4", "value": "T13C3328C5A5D3FCF5DC21193C20AEAB62AEB3F53BA039DA9BC7D85963D901603D10265C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890207, "uuid": "8619ce74-4474-4ca3-a27e-22faffae124e", "value": "768:XKHm0d6lB5T2huNUM+BpHxB68ASIn/pONuQ3BW1rpLt/2Ie72d/DGS63y7UOiIyN:6G/T2huNYBpHxMQInSWJ/v96U7U+y63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636890207, "uuid": "a7455dd6-d8a8-4b00-a26b-b2d6f80e0efd", "value": 55056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636890207, "uuid": "d9aa248d-1ca8-4645-8ba0-9860824d5001", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890207, "uuid": "e5cf5325-69c8-47b0-b5a3-a8dfd34c6158", "value": "30842a484b1fec86bdd2fe09e35aeccf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4510cb04-4568-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636907467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636907467, "uuid": "250fe1a5-56c5-4058-80f7-c80d768dbb77", "comment": "Malware payload (RaccoonStealer)", "value": "32280767459abb8577201808afb19767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636907467, "uuid": "cb1d57f3-3018-4903-b091-8188360ad98c", "comment": "Malware payload (RaccoonStealer)", "value": "9229ec3799a341bd19431bdeff3486ca918529c155692fff783b22e4fb34a0a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636907467, "uuid": "8df1da5a-7ce1-4a59-b39e-2e63f3a9c348", "comment": "Malware payload (RaccoonStealer)", "value": "b11526f6668214d49fad101b32c766cf5434d9a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636907467, "uuid": "59f4383d-a939-4578-b562-1c6648c4de04", "comment": "Malware payload (RaccoonStealer)", "value": "f3b3d1e0efa795b442cc67e1851b063a20b77315408fc02c291337dcba961c0d6f49ef8e1ac0ad25b96b8c0be652a3bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636907467, "uuid": "f35cff7c-1682-4097-be13-a33e09a67569", "value": "T1F4B4F1D077E29075E4A63E30A975D7A14A3BB9B2D870944AF374DB1E2DB33D08866703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636907467, "uuid": "91d00a7c-a648-4af8-a4f0-dc57defb2b2b", "value": "e26afc83cc50f029d0d1352e4ada9f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636907467, "uuid": "2c4713a7-a10c-40a5-9233-9cb43c8d7950", "value": "12288:CYO42q0SlX4rVytUbb27+pOmXDQYn4cf7oHgduq79:Cc2XAtUbLOmXDQYn4cf7oSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636907467, "uuid": "ad02bdba-7483-4a7c-ab90-bb77bb879c95", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636907467, "uuid": "4a3b883e-05aa-4c8b-bb9a-a11559e07b5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636907467, "uuid": "867e2d9f-43ce-4bdb-93dc-b7e80de6189b", "value": "32280767459abb8577201808afb19767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4cefad-450c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636868103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636868103, "uuid": "c54b4024-fe1e-4741-ae58-acce836fb6e2", "comment": "Malware payload (Mirai)", "value": "fee5b36ca882621f71fd4f41bd16b93f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636868103, "uuid": "0f91d922-b023-469d-b3a8-5239aff7b02d", "comment": "Malware payload (Mirai)", "value": "9263ab0f4c0e36ecd0b3b67365cb91a8b8f735fe343521117da94002c6df237d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636868103, "uuid": "9cc22c27-50b7-4f4f-a3fa-a6ade753beb0", "comment": "Malware payload (Mirai)", "value": "2ce4f7b28c4d2999704412cc5993a3d27def586f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636868103, "uuid": "0b15ce88-2163-4874-86f9-b48c7166135b", "comment": "Malware payload (Mirai)", "value": "864ad477c5825488c887ac35169dbf811b7b8be68eb011ee16adc197dac4e12666826fd041e57776c3cc67865be9d39c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636868103, "uuid": "3c7f1e22-4fe1-4d98-89f9-daf6a59b27d7", "value": "T114735A24A9792F26C1D4B17FA2FBC321B2E5260E25B4961C7CB60F8FFF1425464162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636868103, "uuid": "117081b5-b92d-4e86-8732-96df86776c5d", "value": "1536:ZqAcqkBSkIBAIjS/0q+Dc03+R9QZEk6vNNicKzfDFx8:IArlg0q+Dcc+C+vN4Fzfz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636868103, "uuid": "ee3fe845-0bd1-4b2f-aa16-32db065faaba", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636868103, "uuid": "e51e2d28-7dc8-4a0f-8695-83a757a3b3d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636868103, "uuid": "0f54f92f-7180-48aa-923e-bfba8628ef7f", "value": "fee5b36ca882621f71fd4f41bd16b93f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c16fd06-455e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636903265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636903265, "uuid": "87248671-f0d2-4197-a82c-a4b1b73cd355", "comment": "Malware payload (RaccoonStealer)", "value": "692c89f8349b04cd170dc5c0055efb77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636903265, "uuid": "59d86701-6734-4f1b-9ed7-bcf7a7547f83", "comment": "Malware payload (RaccoonStealer)", "value": "92ceb8a100237ef5f832fa20c890adbb4795094dd0d04404643fc054d93ca75d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636903265, "uuid": "1a6d4afb-9d1a-4cb4-b1fe-92c78475f064", "comment": "Malware payload (RaccoonStealer)", "value": "f5ea7efd2424c9064cadabea625b452a7d8759e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636903265, "uuid": "c85ae27f-6005-4982-ad96-28c497cd475b", "comment": "Malware payload (RaccoonStealer)", "value": "0320011abb7cfada301bded06c4dabdea99466d757acf58854624e5ef23b59b3b9f92b302af3c1a94823a1fc653e9c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636903265, "uuid": "f6c75bdc-1042-40d2-b572-f591f95ed32a", "value": "T152B4F1C4B7E28432D1953E306865ABA4262BBD72D934590AF3746B1F2E733D18B76343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636903265, "uuid": "831bb030-8ace-4c81-9b13-b651b30adc24", "value": "e26afc83cc50f029d0d1352e4ada9f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636903265, "uuid": "c21a24ed-d416-4502-801f-dbb2197ec144", "value": "12288:EYO4jMv/EpmACjIrK3AKnGABMa10oGpvhU4VfY779:EcIHiCIroA+GABNSoGXHVwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636903265, "uuid": "77a98da5-e6ec-44a0-9ce8-330e7d51b86b", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636903265, "uuid": "707e4824-13e6-4d1b-8cbe-ea5d5368ed8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636903265, "uuid": "76cf87fa-229c-41a1-ba8b-b140778b7629", "value": "692c89f8349b04cd170dc5c0055efb77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b637204c-4518-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636873298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873298, "uuid": "4f459551-e28c-467c-985c-e4f1e97e6406", "comment": "Malware payload (RaccoonStealer)", "value": "8e4900be6c568c8833b9020c97d5c26d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873298, "uuid": "3bd25d9d-0e86-4985-946f-533299b9feb3", "comment": "Malware payload (RaccoonStealer)", "value": "9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873298, "uuid": "6e792576-b023-4594-b86b-7ce0583cec1f", "comment": "Malware payload (RaccoonStealer)", "value": "c012f4e440551ff055ba03e4261b8cbcac926bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873298, "uuid": "33c64731-60a9-4e95-a63e-d0352a5537d1", "comment": "Malware payload (RaccoonStealer)", "value": "c34e906a46285f0ef2977ec39cfe0807bf687da99818450a461bf11989acb04635683298b53d6cfea0bf93539873cb50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873298, "uuid": "354561b7-cfd4-472b-adcb-e45f4ad5f98c", "value": "T1F8B401D166E28839E1A13D329C61CEA0173BBD72E570522AF774D71E2E733D095B6322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873298, "uuid": "3ed25918-0436-4d37-806c-0344dd931bb3", "value": "cba5ab921edb2daa29ddf7f914128d13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873298, "uuid": "967392d6-fa04-49c8-9f4c-18ebd6d939b3", "value": "12288:eAOuo9QsuFHgXezXLDEcXJihfpfwpGYzor79:aVQVfMcXIfpfwpBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873298, "uuid": "72eda648-6422-4c4e-8377-2df0157738b9", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873298, "uuid": "4d095300-4811-40ba-ad58-407ecbdacec8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873298, "uuid": "38ce6279-09e9-4504-8c4a-ee062419c5b1", "value": "8e4900be6c568c8833b9020c97d5c26d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70be0e06-451d-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636875328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875328, "uuid": "5aafb13c-afdb-49e8-a521-0057cf61138a", "comment": "Malware payload (Smoke Loader)", "value": "936145edb0bd0d55f9aadd1fb0f21e78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875328, "uuid": "2d768e05-bc78-463c-aa5a-7bd214c27390", "comment": "Malware payload (Smoke Loader)", "value": "931cfc28aab40a0c8dc937b51a8ddbccb584cb6d43898cfeb16a5f34ac774e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875328, "uuid": "9b13b16e-4717-443f-a84d-b6128c3d9677", "comment": "Malware payload (Smoke Loader)", "value": "40a0098ff1c273b069e0c6ef62d42f04b19540df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875328, "uuid": "6040b6bd-50eb-43ca-9c9e-a2068424d369", "comment": "Malware payload (Smoke Loader)", "value": "5d003adb324a2a28275d1a636c5d5e1c5f1ed578a1ddde260493d58923a1ebae2c5ce6c6679a561f81c6ad8e6b827748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875328, "uuid": "11d27532-f947-4ca1-ae09-6a8d2abc38f5", "value": "T183748D00BAA0C435F5B216F94976936DB53F7DE1AB6494CF22D42AEE4A746E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875328, "uuid": "e757af80-77ab-496f-9fcf-3de882706501", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875328, "uuid": "eaf3f019-d3c9-4222-bb24-2a033959ef7c", "value": "6144:A6EBZC7lcG/CQU+rl5d6QUlaswci4/QPLyw:U4aGU+rl5d6QUAswBPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875328, "uuid": "53e578a0-6763-4f42-b2d9-ad2a5e5048c0", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875328, "uuid": "02fb08c1-ebaa-4da2-b783-088febda5075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875328, "uuid": "c33a9cb2-d041-4618-86e7-b59b39ca9afb", "value": "936145edb0bd0d55f9aadd1fb0f21e78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80bb372-44f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636858376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858376, "uuid": "d1352b60-59b9-4710-9f5a-45771676b17c", "comment": "Malware payload (Mirai)", "value": "de1994d01de65f6b1fd80b736e714f77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858376, "uuid": "2e98de13-c641-418b-8b15-a848511ebf10", "comment": "Malware payload (Mirai)", "value": "931d980d7b80a4e8401c53b42af27a877581e48a2e3ba7bc5d271ca77a264920", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858376, "uuid": "5cf6241f-8b78-495c-8f1b-6fa19d34a975", "comment": "Malware payload (Mirai)", "value": "2827d27b23e3f1b76dffa91921c6ccbaccdcdeda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858376, "uuid": "9d439653-a5cd-4fe0-b165-5807008cd69a", "comment": "Malware payload (Mirai)", "value": "73367c9da82d9a353431490d59cef9123d7f0a302489cbff5b4f027d58b12c583e9c229806fb549ddf589a2ec745b70c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858376, "uuid": "89217927-7e4c-47dc-ba92-d7705e0b0b1c", "value": "T1B04302702914395ADEE225F3EEF40ADFAAB35AF5D23F541D120A1C787A591C43B2D0E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858376, "uuid": "e39154fb-24b0-48dc-a7cb-a6a431751c33", "value": "1536:Ezl3KUJ5dVQ3cJ8k1yOcC0qRut+qx3lUULof:0rJtqJC2+ylUULof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858376, "uuid": "f63b0950-94ce-46c7-a6bc-3d14b854a109", "value": 57264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858376, "uuid": "6addc351-dccd-4150-ad1d-5ddd43f97d5b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858376, "uuid": "a20b8a0f-6c25-4e24-9ba2-eae41b4514b2", "value": "de1994d01de65f6b1fd80b736e714f77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52514a1-4549-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636894422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894422, "uuid": "9d5a0178-20ab-4825-a4c6-2375ba0b2b91", "comment": "Malware payload (Mirai)", "value": "11903469ab5ef238e4e33622292a8246", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894422, "uuid": "a3762359-3849-4fd3-b7e0-4a944606837b", "comment": "Malware payload (Mirai)", "value": "9454668175aa93d7852c8bbf2504164573f777d5a5be88a1571745fa23a53aff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894422, "uuid": "86a863fe-98d6-476a-b2e3-96ea445a97eb", "comment": "Malware payload (Mirai)", "value": "f82b807c4a0c6576795e1224e8462de5645f1581", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894422, "uuid": "300c670a-7954-4159-92f5-acd7b75c77ef", "comment": "Malware payload (Mirai)", "value": "f671ea793271ef60824bb39a9a772b872ea6430cb65b4a1df6e7dadee7e381400f3d13c28af98426e960935896be229c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894422, "uuid": "ae7ea83a-114e-4919-81b3-fe96e6eb6d43", "value": "T100A2E1384B8698E3D4D20433E5B8CE8373595A79EFDF3454521C23BE9A968425BF9C82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894422, "uuid": "aeb7d950-2195-4060-bd5a-00429a1a7bcf", "value": "384:Sh0RCpjHTk+TZosekexTtRgH8fc3DPyeseYawBbmdGU5ElU3:EX9lTNexfRfcwexwZ3UqU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636894422, "uuid": "92445c97-41b9-40d3-9434-1fc8b7253cd6", "value": 22120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636894422, "uuid": "746c2b05-c78e-4540-9522-0851f4ad1547", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894422, "uuid": "136dc3f2-e661-4f52-87b3-7bd3dc426bc3", "value": "11903469ab5ef238e4e33622292a8246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03ab2a6-44f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636858658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858658, "uuid": "db88d7c5-b26b-4de6-8f6c-349a27e697a9", "comment": "Malware payload (Mirai)", "value": "8001e6723e1e0b7250d599bd20540e11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858658, "uuid": "f2e0c3c5-0329-4ed2-9850-ecb29af9b9d7", "comment": "Malware payload (Mirai)", "value": "971e3ca42b3c775aa0a4661292475a7ef5ebaca926baf9ccf5f6ea5cf5b47d59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858658, "uuid": "9829cef5-0fbd-4d1d-99be-a462bad63e21", "comment": "Malware payload (Mirai)", "value": "90197b9507339926bcf2dfe1efa30cfe82796f35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858658, "uuid": "39ba2524-2400-4194-b104-ae9023e84d6e", "comment": "Malware payload (Mirai)", "value": "60b690924f104f09e8bef6e7423a5b33baf12cbffe92819f42fa38e489b3785776bc4ded846e885f455d4b40501d1e55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858658, "uuid": "d0f1bf91-06c7-4481-b565-db4a86873046", "value": "T16A33F2B3B8B1C3A1FE63823E9FECB58D4291C90A41349CE695DD60746047B621D0C7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858658, "uuid": "dac97e3b-15ad-438d-ad51-66192c7cea4b", "value": "1536:17J58v1SYtIBeHP2smgqBsH/Rb46ktnouy8tyJ:17oAt02sy0izout0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858658, "uuid": "c76fa14c-77f0-456e-a764-bca0afe34143", "value": 51940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858658, "uuid": "d88652cb-8ff0-46b2-9389-6db0541a1748", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858658, "uuid": "dc6e6565-95f2-46ed-91b9-2a1942c49556", "value": "8001e6723e1e0b7250d599bd20540e11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2a4fc4-451e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636875673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875673, "uuid": "acfe4865-d0e6-403a-8259-07e72eb015ea", "comment": "Malware payload", "value": "bc3cd381fbce5507b7cbcbd44175f0b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875673, "uuid": "67783396-f860-44d8-bb55-7a63f36b5869", "comment": "Malware payload", "value": "987daa0ee3cd7d6edbb2cfed9fe57cf22aa85fb4be14b99050206e1edc664659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875673, "uuid": "d2d579d4-b900-4a53-9a83-37b305b5a997", "comment": "Malware payload", "value": "26e257cfb39c571f93a18b2eb1353000af93778f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875673, "uuid": "ffb06318-da62-4ab9-bc3d-2ff690f389f6", "comment": "Malware payload", "value": "4cc335b2814ea0a6114ef238a7a82e5c24f873c39bd253b5749471ea3f1acb9863ce6c6ddb3b1ca73c99bf68bc5fc279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875673, "uuid": "06d4bef3-0ccb-41de-a0ab-416ba8e063dc", "value": "T1E134226C451FD932D63E59BCC2704AF237682D394D87132F889AFBB345BC1D898E8651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875673, "uuid": "d6adb108-3196-42b5-8f5c-11156b1411d3", "value": "6144:SbnyR/K2Kwx2GrEkMVw5XISnzdBKiyRiBQmYDI:eyR/8qPNj5rD/iiBQmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875673, "uuid": "0a7601a0-4d00-487f-921e-abc337fc273c", "value": 237230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875673, "uuid": "68bce38b-0588-4b62-8db5-55998bd0f50f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875673, "uuid": "248f99d2-6ed9-4205-b582-495b6feb98dd", "value": "bc3cd381fbce5507b7cbcbd44175f0b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8437e3b5-44e7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636852168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852168, "uuid": "f9c07622-b1f9-4ac5-b916-47489a5450a1", "comment": "Malware payload (RedLineStealer)", "value": "bf34d3d86cc2a132f7779051b3cdbb78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852168, "uuid": "5e3ca491-576a-4872-8b75-e87bbf453917", "comment": "Malware payload (RedLineStealer)", "value": "98c7fe4e4d23a7cbf822f6c0127b86d9b9f8a7b146e3a53df93eeab43269fe51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852168, "uuid": "3ed784cd-6dc9-447d-b297-5ec7e07f3ef0", "comment": "Malware payload (RedLineStealer)", "value": "bfe5d3acc044842f706efe20aa00f3400925de4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852168, "uuid": "de5b291e-d2c3-440c-b7f7-5b45a7969c2d", "comment": "Malware payload (RedLineStealer)", "value": "54eb7bfff97f096c496c08a27537cc6dab977bc892e35bb87e2efb1ecdafc9b1cbb842051f0b27198eb494fa3462b365", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852168, "uuid": "27aeb166-7c28-4175-8c15-0d2244246775", "value": "T161D5F181AD3C08ABC8DAC2309D2E4E79EA13AD07BA6505173559FE1DFAF3341495E90F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852168, "uuid": "41eae873-3715-4af6-827d-9bc0ab383b6b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852168, "uuid": "fd9ce8c9-f89a-416b-b4c0-0fc3fed136c1", "value": "49152:unQwRCvJo45pdDEDIPfN1WtSWGbWuBiiv6vJgYH+A67/EUWSmA+QDWYYOu4F:uLCRd5pdxfPWt3GblI3ecDK8UlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636852168, "uuid": "ba43a921-7dfd-4763-ac78-d7f5873df784", "value": 2935512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636852168, "uuid": "614011a1-0f38-45e0-ae6d-f0872c94a281", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852168, "uuid": "b120d657-4639-4dc3-b261-a5b954f5d822", "value": "bf34d3d86cc2a132f7779051b3cdbb78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b757681a-4551-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897781, "uuid": "ca627fca-62aa-40cf-9b22-cb59d6cf30f3", "comment": "Malware payload (Mirai)", "value": "795c7ce4666af87389d77acd3503642d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897781, "uuid": "74546273-0012-4209-ba2c-ad4b583ce08b", "comment": "Malware payload (Mirai)", "value": "9920c490221799ce095b525a50e473cb8b69494f5b82be20b1376361912553d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897781, "uuid": "bccc8351-9011-4d08-ada2-1ee60ad4427d", "comment": "Malware payload (Mirai)", "value": "80494b2a50b1ad3c31a2cb47038567f75ab3d5a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897781, "uuid": "1165a139-8a08-471f-917e-1fbd9fd7e24b", "comment": "Malware payload (Mirai)", "value": "b3384799be78b37532ecf790db4dcca69088ff01432e709e7ac7e4765045c1989e2d1bc67ac9536bd3aa0d3775b89f22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897781, "uuid": "bc1c0359-f1f7-4800-8af8-0b2b1bb9bf77", "value": "T1B6A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897781, "uuid": "8a02549f-568f-4bc4-9970-a8b3a20c8460", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fJFmmFVcqq0G27ZT:wJFv4Lm6AJ+4fJFmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897781, "uuid": "6ae29e77-bdc0-482b-b501-b820ae5bb127", "value": 104139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897781, "uuid": "e192b6f7-afa6-487f-ad05-7208f15ff6ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897781, "uuid": "d181107a-2123-4a1e-8bef-46d528bc9743", "value": "795c7ce4666af87389d77acd3503642d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939861c0-4543-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636891708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891708, "uuid": "55219a96-b033-4439-904d-f4b7e3a90635", "comment": "Malware payload (Mirai)", "value": "7fc25d526bc3e571b5221aa56637c71b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891708, "uuid": "cd2deef5-7a90-4dcb-bb3a-a1f97c7b0330", "comment": "Malware payload (Mirai)", "value": "99297a8c01310ac57f775371e9c6339a9692a46c4c3b061f626b9acda975326b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891708, "uuid": "34afaf98-ffee-40cd-8080-00dfd98c7487", "comment": "Malware payload (Mirai)", "value": "e231a5eb6d038485af37fb8339190d6267899b4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891708, "uuid": "2ebaf2b1-92e0-44d6-a76e-f2a968d87497", "comment": "Malware payload (Mirai)", "value": "5e7663da5a0403ff261cb70ddae03fe08aef5393a43bd8c234af15ccb90b1459f0c5586d6b7f7489fc56b94d9d2475ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891708, "uuid": "65ffffe5-ea57-4860-87ea-65c3d8a62ee5", "value": "T1BE73B70D3E319F7EFFAD82394BB38A15961423DA36F1D5C4D15CEA012EB024A741BBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891708, "uuid": "d05deeae-306e-439c-89bc-d7887f6d85ae", "value": "1536:VF42J6P/IdqvwmqYr0vguyl3DHOcNFTrnqqimf:8F/cqvlqYr0oZlCcNFTrnX3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636891708, "uuid": "463ce79a-98e1-40c4-b10d-16d9da0d22b0", "value": 75984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636891708, "uuid": "aadbdb92-09cf-457d-9309-b0e7559f4661", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891708, "uuid": "cbe33f3b-2649-4a5c-a5c9-507c8e023e3f", "value": "7fc25d526bc3e571b5221aa56637c71b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b72a20-4550-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897367, "uuid": "21808ba6-bf81-4f2b-8832-b7d223a94108", "comment": "Malware payload (Mirai)", "value": "af887efecb77e38f6793e48a197f92ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897367, "uuid": "6e07ffe6-5740-4446-9297-70033caaa6f4", "comment": "Malware payload (Mirai)", "value": "9bbc3ae1670fbd65efd83359b3b87637a532e0081f980ce331112fbdb8f23be5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897367, "uuid": "3df41839-cabd-459d-90a6-88002747ac57", "comment": "Malware payload (Mirai)", "value": "4abf7e31b3f21d9e830a82f73f408ae44605b068", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897367, "uuid": "c769632d-8449-49f2-8eff-de0ffbf06999", "comment": "Malware payload (Mirai)", "value": "0e54b1c0f47a715759727e3fbc44dad7f58bbbf34e7970fd777981e27effc3a82a12696d5126c5c4fc99abc989ddbe3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897367, "uuid": "dad51d5f-7b01-4177-9fe1-ed6f57b92922", "value": "T13AC3F730E8044B1BC2D223F6A75A469E3F351E9797E733115A387DB06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897367, "uuid": "57c84137-1ade-4ed0-ac98-a1b462e03bbb", "value": "3072:6jVlyaL5JCrIpv04s8bstiEiJmP46aQyfPluesNb:yoCJCN4s8b8YmP46aQyfPluesNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897367, "uuid": "cf10ee5c-aec3-4123-ae4e-b89272c05352", "value": 129899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897367, "uuid": "35c840cf-d883-479d-85e0-9d3b9d39dd28", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897367, "uuid": "68f9bff3-93b4-40b0-8cd8-cc4e5a81c71f", "value": "af887efecb77e38f6793e48a197f92ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bc0a6a-453f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636890042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890042, "uuid": "f07442a5-2892-46b0-aac6-33d8a23b1ad8", "comment": "Malware payload", "value": "fe6e1968426a3be3b9aaf70a46d2f7d4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890042, "uuid": "df5ba171-f39f-4093-bafe-5f844dfe675e", "comment": "Malware payload", "value": "9c4ccc867541ad9babae466c570b54de6abfd8c3cc8df5041ac685d9a2319391", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890042, "uuid": "286c7e4b-2b08-435e-9c43-54e0b6a7f39a", "comment": "Malware payload", "value": "4929fedea1243b52a582434b364b8bd172a0b76e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890042, "uuid": "d92995ce-7d92-4dcb-acc0-bb3f65cc656b", "comment": "Malware payload", "value": "ea9dfd55f41994f1322940c10d1726631c0c2db5ba1d2706891d597a1250ab896f2397ac808767cd870b022242065659", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890042, "uuid": "2c0bd0d6-4b18-48e6-9978-f6c770c6386d", "value": "T18CF0DC0ECF0540FD55AA708A3D0E81B0E9BBA174228CE0E68006E5C7012BCC812FC4EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890042, "uuid": "79fa3c06-0a8a-4605-8170-a97814d3bdf7", "value": "12:RdgDzEC26HWBuSMp8YRtmgHH0uMEk/QTaTjfYJS+:RCBWBu8YVUdEKsanGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636890042, "uuid": "5c5d5844-cc06-4ac3-97ee-1020b30d4db7", "value": 476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636890042, "uuid": "fa4493af-c534-4e52-aed6-6962f63615a4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890042, "uuid": "1335a6a4-8e95-47e2-a75b-e754d6bed54b", "value": "20170206_5601e3f1b386552d309c30661ae3ae30.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3204177e-45a0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636931487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931487, "uuid": "a920bfb2-f193-4c49-b4e1-bc8f4aaa3940", "comment": "Malware payload (Gafgyt)", "value": "4ea7992ef17bf3c3fe747fad24707f20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931487, "uuid": "d6259586-6c16-48cd-b0ab-481165db7914", "comment": "Malware payload (Gafgyt)", "value": "9c6f91142fc8c5371d74a67c9065e1f818df4c0bef0bf811d9b313c2c6322a79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931487, "uuid": "24449edd-662f-4d5e-8c4c-a676642264fe", "comment": "Malware payload (Gafgyt)", "value": "e47dd51f170ca427699b052354525885756aedd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931487, "uuid": "f07a268d-ee42-4905-8946-05397f00ee06", "comment": "Malware payload (Gafgyt)", "value": "d749e07e714aa87c1377ce85ab7f02a4ea2a9a96d544f2b19ade939a3972bcc077aa1be1fea5acefae800d928e6361ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931487, "uuid": "d020d3e5-ece5-497f-aaee-9f21b8a9f6d5", "value": "T197D31964F804475BC3C227BAE68E028D3F351BBB97DF33256A389D741BC57A81D29560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931487, "uuid": "3ca9f48a-6414-4b90-8374-8b20af309c07", "value": "3072:T9aenxJvZxHvW4FpM6G0SmHEVliYy1m72+7QaTztEJwNO:TbxJvvvWcM90Smqy1m72+7QaTztEJwNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636931487, "uuid": "488cce5c-4bda-40d7-9900-7bbe8410ff5c", "value": 134162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636931487, "uuid": "506b964c-d229-40e9-9413-b80ea115e943", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931487, "uuid": "ed15170d-8ecd-44f1-b691-38401562bbc6", "value": "4ea7992ef17bf3c3fe747fad24707f20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bf2059-44e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636850532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850532, "uuid": "ac198c06-56ca-47ac-8dac-d49f976bca38", "comment": "Malware payload (Mirai)", "value": "b6a4bbbdad5e4d1f69632c68a57d5f46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850532, "uuid": "57430b2c-d4c8-47c2-8336-efa06e00f3b1", "comment": "Malware payload (Mirai)", "value": "9cb1237ed5d2a6b4fe5ddcfb4daba8b95cc3eca10832a56a01a556685ec66347", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850532, "uuid": "dd738937-5723-4cea-a1c6-b4d3765e99c9", "comment": "Malware payload (Mirai)", "value": "38a5dfac215d3b0f6d43fd1b8b6882a3176f0d68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850532, "uuid": "b47e2d86-dc43-47c7-9ac5-0ebcabefa3cb", "comment": "Malware payload (Mirai)", "value": "d538a366a405da973b13d9aaaccfd0c2d92581a19ac50d4d9992ef6bb7da5dadba54c62e0834d6b6500909db67d020be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850532, "uuid": "66c5c96d-acfb-4aad-8f46-5f5790a8d7f3", "value": "T12304422AAFA06EB3E8AFDC7355861B5125CCA01731483BB4F930E925B61E15F64D7CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850532, "uuid": "5f5d38d0-4cb0-42e3-bd43-53c68430dacf", "value": "1536:JgaJyhT4SAhAN6oMwXzs4ZihYXhZ32TQYuWweXqoN5fKZ8Eewvyz2no:GaJyhTBN6oreYRZW9fK4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636850532, "uuid": "77c792e0-3ef7-416a-8710-2be7a7db0ff8", "value": 173268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636850532, "uuid": "a6a6cfde-6c0a-4fd0-a345-8f76c2edd50e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850532, "uuid": "1e3b5cd4-a098-4e19-8d2a-1871ffb8b5e3", "value": "b6a4bbbdad5e4d1f69632c68a57d5f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a833a384-44e3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636850511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850511, "uuid": "a15ebf52-b888-4628-9034-12233284f546", "comment": "Malware payload (RedLineStealer)", "value": "8ba1ad22db58fccdca33c2def32062b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850511, "uuid": "4092cba5-e6d7-4d07-b92d-6f43abedf1cf", "comment": "Malware payload (RedLineStealer)", "value": "9cd21169b96f9c616964fab0d9348c34956bdaa712ad3761408af2aea2ff3d1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850511, "uuid": "54495ad1-6106-430e-ab9d-66f82ce61fc0", "comment": "Malware payload (RedLineStealer)", "value": "de82774e0111706fef55f96e9d43ced9ca3f9ce9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850511, "uuid": "fbefe248-895c-44ad-9242-0d2dd9cfef83", "comment": "Malware payload (RedLineStealer)", "value": "a76c5282dcf55982de925cef2073a062feab17f822002ed871a340a7beeab0810a6d2bb3405795ef330547b72ccb912e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850511, "uuid": "79cc9df3-9c1a-46cd-b443-0b16a652f9d3", "value": "T15FA34794706021FDF809CA7D473A2FB4AF177DE783675A03A86B1487499C7DA8F1A0B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850511, "uuid": "c944fa18-bc36-4cef-b700-55493239ed5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850511, "uuid": "69f7293b-362d-4156-b754-10f4bf843220", "value": "1536:SqRe9xtAKPbQ+yoIg2EWSVm+Pe95sQqyA9AAAB0dSRWtoGaN0/APAIwtC409wDU:FMRtQ+y7NnShPesQq/AAAB0dSRWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636850511, "uuid": "cf44d54b-a318-46d7-9e93-88063fffaf0a", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636850511, "uuid": "3719db5b-19c7-4310-9c2d-5afbbe4fc323", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850511, "uuid": "0c459011-7039-48a4-8c50-23059cbde193", "value": "8ba1ad22db58fccdca33c2def32062b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340aca36-459d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636930202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "13b3bf7b-3edc-4414-83d8-2c8244cec626", "comment": "Malware payload (Mirai)", "value": "c14c943fdea80581b62b1ac5ee194be2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "56d95472-220c-42a1-b2dc-167a9a1bde4f", "comment": "Malware payload (Mirai)", "value": "9d032c015229de416a67adc7bfacd27294427ed16a0cd1ac51f3aa580135d9d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "2e790152-a1ae-481c-bb3a-b8861f0b879e", "comment": "Malware payload (Mirai)", "value": "50af2888a05db390dd870445d299a64ef7d727b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "866e57c3-1db5-4acf-af6a-fb7795a6e772", "comment": "Malware payload (Mirai)", "value": "ab9d2af5b44b9030ebbaf48761c3139b77832436ed77286e646d864477facbed034e4410990bea646e067f5cc4de9493", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930202, "uuid": "865189bd-cdaa-4bb7-97e1-9ca012329914", "value": "T11503F12492AE7108D92EF0FD04577C8BCE65C10E95C1E579AA20DC17AC83F6B271D7E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930202, "uuid": "711db666-9f28-4525-b9ae-bbb88206e281", "value": "768:gTrMevnN6tI6JmIB4FswZzlgHju7EwK5ztkE57anbcuyD7UHQRj3:+nvnNiZma4ZzlXTgztkE57anouy8Hyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930202, "uuid": "29471b3f-8cf0-4d8c-a7eb-6de770997d14", "value": 38404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930202, "uuid": "2a99bd0a-79ce-4f80-ab1f-b49f3d9dda0b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930202, "uuid": "3245bf4e-47c6-48a9-adc0-503cc769a2d7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bd777f-4551-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897756, "uuid": "2a4d6bb9-017a-4590-9725-66c4d1b6a71e", "comment": "Malware payload (Mirai)", "value": "59f1d0ef154dfa4a58cfdc443c222851", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897756, "uuid": "a8b4d1f7-84c2-45aa-85ad-5928f6711461", "comment": "Malware payload (Mirai)", "value": "9f658a6243bfc0149374682029b9ab269f4588dfd142716b26f3cc07824021b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897756, "uuid": "a1556ec2-59dc-45f2-a348-3d78de4d069f", "comment": "Malware payload (Mirai)", "value": "28fb0e195b0d241ef139d2252d64e4270f7e29ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897756, "uuid": "29900ceb-3aa5-4a4c-867d-00f86f8a2df5", "comment": "Malware payload (Mirai)", "value": "eec80315c86d84d4374b0b7d53aa0f70ec120564fe09a088048f89718b5d141f25be1e3255cb38a07110f9fb24c57c67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897756, "uuid": "cb50b97a-9061-4f36-9b50-10c68e6b3844", "value": "T119B31977A4654F73C04565F125BA9A310F12AD931B1F1A88763CBAB04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897756, "uuid": "b03a4847-b234-4475-a20d-0af08f17b8b7", "value": "3072:MDVLSItJP+Xsp4JlN3H52mH1cuEgv26uN/:MDV+ItJH2l3H52mH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897756, "uuid": "fb7a3aec-6909-4f35-b6e9-790ab1d6355e", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897756, "uuid": "e358dc5d-5b7b-4287-a3a9-89343cdfcc97", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897756, "uuid": "d931da2e-3880-4bbf-99d0-7fc3ae842e81", "value": "59f1d0ef154dfa4a58cfdc443c222851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ca436b-455b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636901885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636901885, "uuid": "7ae1e546-882b-449e-a221-e54401e6ec8c", "comment": "Malware payload (AgentTesla)", "value": "86d9fb8b0b052b90f0826295f8a63f0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636901885, "uuid": "802a6de5-4485-4e25-a60e-c66d38f8ec16", "comment": "Malware payload (AgentTesla)", "value": "9ffff542424c27e44cd1c0ae15166fbd66f2802dd41728b55ebbf0f812d10952", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636901885, "uuid": "9552c0d0-adc6-4ccb-b3a7-ea243ac67e37", "comment": "Malware payload (AgentTesla)", "value": "c955801e897cb35954e167fb056e0beb612844b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636901885, "uuid": "7919dcf6-f5f8-4e3d-86ca-55c8176f2e78", "comment": "Malware payload (AgentTesla)", "value": "e371b680c98a3651f58df09d2a0c9db028393fe6f9ec10cfb588cd6f1889558cb59b5b1c213a8877ac089509a65d547c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636901885, "uuid": "a0fec9ca-b6e0-4ac1-b34c-57250b778146", "value": "T18805AF5466E48A2BD0AE237CE071451893B0D011A747FB6F6BD4A0FD2CB3762CDA52DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636901885, "uuid": "3315fabb-be73-414d-8304-14e749d22183", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636901885, "uuid": "b1165913-e143-46c3-9bb2-5391b2e8a403", "value": "12288:DqJ0CBi0udPsjaVY1e/kR8WWtUQBaNyUXpas124xI5f4xTBg:aY0udEOVieqSYVws1PxI5f4xTBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636901885, "uuid": "ff72a7a9-c160-46e3-98fb-9ea074b8e5c5", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636901885, "uuid": "d2b2d0a3-2147-41bd-8dd5-4f71e16c11ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636901885, "uuid": "6248678b-f425-4241-af9c-88de4ce97be1", "value": "PO 14086 & 14117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058ed3d2-451f-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1636876008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876008, "uuid": "cfe1f216-063e-4615-b5bb-aabd1996ff7e", "comment": "Malware payload (Socelars)", "value": "f374e1fb218cb7b631353f153a27c166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876008, "uuid": "8a71ca50-bdfb-4c59-ad42-43c94687a0af", "comment": "Malware payload (Socelars)", "value": "a0b710e10c1c87ce87a81ae9d5bc9549f999c8817034877adbcabccdcc890c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876008, "uuid": "3151bb67-f35e-4a80-8cd1-c9f8f8df4ea0", "comment": "Malware payload (Socelars)", "value": "17d10d2aafcea8e76c17ae908645cefa35534e17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636876008, "uuid": "a4b1ab64-2f22-41fd-afc1-c7b03c74652b", "comment": "Malware payload (Socelars)", "value": "68e58740d984f6b4d4bceb2dffa1a157275a50a1ce16229eac19a06e7e545c783774aa733a52d9f6e8f6ea901f136c01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876008, "uuid": "b6dffb8f-c0c8-423b-893d-a7d2e35eb7f0", "value": "T168659E11E642A036ECE710B285FF4AFF8D286A21030454D7E3C45DAA5F619E37B3766B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876008, "uuid": "978eae4d-c62b-439d-b82b-b32d63624e99", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876008, "uuid": "91e2c75d-27e9-4fe2-9bf7-fd07647d3b7a", "value": "24576:clp91mSwIoFpKlzA17K3VW1857o0In2SCZQHxDwzrJBVQ8:wpyJIsEtp7KYQHxDcrJBS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636876008, "uuid": "2a0a9a40-131b-4b37-bb88-7d15adffb5d3", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636876008, "uuid": "d31b59ec-c0ec-4769-8afe-aed70767e88b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636876008, "uuid": "ccf0515b-6b42-456c-a959-881f1c4e4e5e", "value": "f374e1fb218cb7b631353f153a27c166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7bd05f-450a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636867159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867159, "uuid": "2554692c-fae6-44e5-836a-4bac85142176", "comment": "Malware payload (Mirai)", "value": "190ef516323451816e1386409f4ed9d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867159, "uuid": "dedaf01a-5275-4bcd-a409-05213a445aac", "comment": "Malware payload (Mirai)", "value": "a2b41254aa1d4ff972e2a00af6a201bfce345ccb22073894ee551c4f73155bd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867159, "uuid": "04976038-5072-4ea0-bb5d-5242b7780004", "comment": "Malware payload (Mirai)", "value": "dfccae4546e95f2b9edb4147ef2a0469ea8b16dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867159, "uuid": "d8b617a6-fac1-47aa-9f75-0292649d7ce2", "comment": "Malware payload (Mirai)", "value": "3472e17bf83fa682dbb1a919351062cf3e3d9bd4c80176bc81b1253d9731fffb4bea293d49458cd0e4f59d991d8a31d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867159, "uuid": "89627950-74e8-4abc-a2cc-aca69c05b1b1", "value": "T1F0F2D054B7E3E9E1D3B10831C97503C3EA4A8AFC859F306379150BA4ADD9E4336BD942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867159, "uuid": "fb96afc2-8eb6-4e19-b378-9162a4cafa49", "value": "768:h96r/HH0Ql+GqOe2Oha6yWD6OdpL2KbJeKnstEosl9q3UELCG:n4PH0Ql3qOe2WJySdoKbJHnN4Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636867159, "uuid": "f05a9fc3-78c7-4ce3-983b-fc516a67f551", "value": 34476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636867159, "uuid": "488d3df6-ddfd-4e4b-a046-54eeefef9d72", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867159, "uuid": "8666b8c9-2fb8-4454-9ec0-798e25c7a6f1", "value": "190ef516323451816e1386409f4ed9d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3413f912-459d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636930202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "273693f5-dbfc-4ec7-bccc-6b4e06d09ef6", "comment": "Malware payload (Mirai)", "value": "f437979c18900cabbef0490d28105856", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "3c877be4-552a-45a0-b8dc-0fcd16bb0676", "comment": "Malware payload (Mirai)", "value": "a3b9a130584bed8627be949aee00883d82633c59fa8f5169457fcec605959675", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "5e909303-9a68-46b5-8e35-a07fd874b61e", "comment": "Malware payload (Mirai)", "value": "c5fb83969a6bc6af8e64b5b8b1c12a304a089078", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930202, "uuid": "1586e23f-a67b-435b-ad83-d5d74a936b97", "comment": "Malware payload (Mirai)", "value": "7b19db6c2354f57ddfd77ddc9643eb29f10789b5965466822c3682b91621ea51f4806cb185355b887ec4a0cea8fc48cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930202, "uuid": "c3bf51ab-f847-40a0-af4d-004563af0873", "value": "T13F23F1DF2761F8D7CEAA6C3939859EA40C0094E4238B6FD80346542A784F58D2D8ECDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930202, "uuid": "be550590-bee7-4586-b34b-46d4a548c805", "value": "768:7Ifa05Y7w8Rc1ACPXY8PI18nR7dUJDjO1EUEp9iPBbpJYPSYnBWw:0Knu1At518nJdIbUi9U1J41n7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930202, "uuid": "4c894662-37dc-4e75-ace1-aac81c559d53", "value": 48528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930202, "uuid": "d2a35751-c021-4626-b67b-3e9159a2eeb4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930202, "uuid": "d8476933-6c00-4575-9970-0fa784ff9983", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12104bcd-456b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636908670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636908670, "uuid": "88e5bb06-b35e-412d-a270-572e75e5fb1a", "comment": "Malware payload (RaccoonStealer)", "value": "eb718c17034610c360ec1bf87afc56b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636908670, "uuid": "3d9b6bf4-26f1-4e52-8366-4128412a6963", "comment": "Malware payload (RaccoonStealer)", "value": "a3e076ed6cd74c2318673c4f62da5aa59d91dd115eb89882124f2476d1adb343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636908670, "uuid": "fd944178-c1e2-41ec-b507-79231a3b199b", "comment": "Malware payload (RaccoonStealer)", "value": "1b9e698385fe769ba09a233c1452348289911de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636908670, "uuid": "8d39d567-704c-4b41-bbee-7f71861995d4", "comment": "Malware payload (RaccoonStealer)", "value": "fdab4e2ce8d81ef0fce80fb278002be6b0a64dbdf357297c457fe7a36aadf596170b8e12b74b6cfc54e52fc2589f3df4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636908670, "uuid": "cd0345a9-e688-4400-9da0-460e2a040a79", "value": "T124248BD176E18876F0A63E30A865DBA0062BBC31D970950BB774E72E1E733D0DA65732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636908670, "uuid": "e292c343-f242-4092-a053-f44a2f71a9e9", "value": "dbcac2c45214b87a17ddc554ea3d071d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636908670, "uuid": "a48c9896-340d-40e2-945f-945ef859b1f9", "value": "6144:thKAflCNm1Rjehbyqjh9M7ITsq7igavwVf:tYAf4NaRwbh9M79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636908670, "uuid": "7230bb29-32ce-4b94-a0cb-03469763a3eb", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636908670, "uuid": "12f8d075-bf6a-43ee-903b-854291c64147", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636908670, "uuid": "663108ec-59bd-473d-8255-010de44fed12", "value": "eb718c17034610c360ec1bf87afc56b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10df5230-4552-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636897931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897931, "uuid": "bd315e61-ff86-4b00-b205-e45dbc7b4db7", "comment": "Malware payload", "value": "c2d44350d142220af259524920206e41", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897931, "uuid": "04082805-41fe-401a-85d3-137a2e09f2ba", "comment": "Malware payload", "value": "a51c40a18c1a7e476f06c899ee4df0c9896cae5e93510ed534bf185a1f7efb53", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897931, "uuid": "eec28013-34a7-4bbc-b171-939e1f77b865", "comment": "Malware payload", "value": "0e3557461e5509b509f743537aeed0be92ed94be", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897931, "uuid": "360ed8c8-bad1-4c09-a759-9d9533d675be", "comment": "Malware payload", "value": "3aeb1484711934b0fcef341c8060c89705d7cb9b3077ed9afe4839437dbc1c6f20ab7b703e5b5c750a22873061112d65", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897931, "uuid": "999618bf-baf0-4929-b984-e07ed7f8b5da", "value": "T173314C095BD51725D372CD3B54AEE2118475B815ED93DF5D02D050DC2469200F67AE6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897931, "uuid": "a68d4f74-1f3b-4071-94a4-aff424ffba9e", "value": "12:85nC3pQVe/4VfgFDWm8GW+feDCBHec3+UcIl1lDmIfcI6DmNf3YQVg1:85+pQQXFqP+feJc3+/E4I0CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897931, "uuid": "27ff23c0-07f3-4039-b518-a54850eb7ea7", "value": 1648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897931, "uuid": "7b342306-f2b1-48b2-8888-22e2f36d3c48", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897931, "uuid": "ef1fb9d4-66ce-4bf9-97e9-161397be08d5", "value": "INV-BB1090218 - BB1090203 - BB1090235.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58be37b-459b-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1636929668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929668, "uuid": "357bfc49-eaaa-4b4d-b464-fe98f5962b72", "comment": "Malware payload (AZORult)", "value": "7e25edba32eb10a4b28c0e0e07913f62", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929668, "uuid": "7ec94009-49d2-4ece-88a2-fb7ed74889b9", "comment": "Malware payload (AZORult)", "value": "a61be0c4cdd2c7e309cc75f19f38735d01b0e03bc1fd704d9bcf023237985947", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929668, "uuid": "79c503b6-5ec1-4370-a988-d8f7e0dc50c7", "comment": "Malware payload (AZORult)", "value": "21ab4c0b13bfd6633c840a9025d8751bdec28835", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929668, "uuid": "b67c39f1-c24d-4fe8-94c2-a0af469b81e6", "comment": "Malware payload (AZORult)", "value": "208568a055d33ca75badb58d20529786b25a14af26179177d1bff2fe23bf5bde2d94bc8d9ed10a412a33afd7444920a5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929668, "uuid": "a8bda941-fcac-427b-899a-75a7629f7612", "value": "T122D3186AF6C1D172E02908B9CD46D1F6902D3E306D3914B7B2DA7F8DA1F95C26A1C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929668, "uuid": "ee811c82-30f4-4e43-9a9e-a8651493de5e", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929668, "uuid": "7a21a5f8-6101-4cba-bc2f-05d64aa8dfe4", "value": "3072:4uOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEYnE/oHxg/:4zx7ZApszolIo7lf/ipT/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636929668, "uuid": "3fc809f9-c16a-4261-ae30-cabba94ae942", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636929668, "uuid": "d0b2c757-55a9-4e11-ba6a-e67f6476380c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929668, "uuid": "b5d08268-5420-4926-89ee-e80b8544065b", "value": "A61BE0C4CDD2C7E309CC75F19F38735D01B0E03BC1FD7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d3e644-4550-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897347, "uuid": "79c008b2-3e2a-4940-b7e2-1660ed22a02d", "comment": "Malware payload (Mirai)", "value": "8cf7ed3be0eed5f5fc78e52ead659a45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897347, "uuid": "95762853-43a9-4a3b-a152-fe13e746b30b", "comment": "Malware payload (Mirai)", "value": "aa9b3a086e0ceddc5078aceb760a63a0d90a8c4128b8a8b07e4256b46e81c3ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897347, "uuid": "b7bc5fa1-8e22-4a22-883b-aa4c272b45ce", "comment": "Malware payload (Mirai)", "value": "26b396733300ee6cf237d0df8f9a167b996d7883", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897347, "uuid": "352b0ccc-340e-4cd9-99e2-e7715f28a507", "comment": "Malware payload (Mirai)", "value": "1842b2637b669ca0abb31635f7dd6e86abd20cfb1e75bc790e6fc67c2871dcc96a79477d3b3ef8ddad6ee401fe421bf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897347, "uuid": "7f6abce0-eb20-4c53-80f2-24093e0d21a6", "value": "T1CAA3F831A641D973D04306F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B561E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897347, "uuid": "470b4c71-ec61-4ed9-b9f8-bbef44f7790e", "value": "3072:VK1z13U6HzHoXRtmTUhQogNqmmFVcqq0G27ZT:VK7DDeKlogNqmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897347, "uuid": "a6b0e844-9bf1-49ef-9fc0-6b64cabff29c", "value": 100043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897347, "uuid": "d230b954-aa77-4ce4-a9e7-0b0b3965b95d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897347, "uuid": "f0dce228-eaac-4f35-9eaf-954b47150d49", "value": "8cf7ed3be0eed5f5fc78e52ead659a45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcf31f1-4550-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1636897278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897278, "uuid": "3cbec63c-f756-41d6-a511-d13ef1ff921c", "comment": "Malware payload (DanaBot)", "value": "cc8fcc21e8dd039b45eaed8794282f7a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897278, "uuid": "c8bb26c9-ab67-49ea-8b0c-38abe8d676be", "comment": "Malware payload (DanaBot)", "value": "ad0ccba36cef1de383182f866478abcd8b91f8e060d03e170987431974dc861e", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897278, "uuid": "fba6e237-4843-4952-b559-d2e892d47b39", "comment": "Malware payload (DanaBot)", "value": "51ce0157b859c450418f0c62c73e559a7c399ea7", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897278, "uuid": "5ef42131-3c5e-446a-a3e6-04d26a3b10a7", "comment": "Malware payload (DanaBot)", "value": "add7b849f90b2f89713df66949eaba5d4cab829a9085b192fcdb3719be60494a14a2175e59223f0438163b2c6427bdde", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897278, "uuid": "8896c0fe-574b-4c80-9d12-4cb64346f8e3", "value": "T1A2F6F122F240C13FD0B71A36957297F45A3FBB201A19C89B67E44958CF75AC07A2739B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897278, "uuid": "42f1132a-883e-493e-bb14-c4d6675afbb5", "value": "908afa7baa08116e817d0ade28b27ef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897278, "uuid": "388886c5-124f-486a-ad86-fa913b659d1c", "value": "393216:w61w6fY5GZUaPmtNInF9Q//jx5EHjahPf5ycbzCQKt:hftlmtWF9Yx5EHIeQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897278, "uuid": "1e85fb3d-fa9e-4436-a7ad-b02831842903", "value": 15492608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897278, "uuid": "409652f6-0cfc-4fd4-aa47-919253583c5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897278, "uuid": "2b49bfb7-6fcc-4293-a710-dcd225d5ec4f", "value": "ad0ccba36cef1de383182f866478abcd8b91f8e060d03e170987431974dc861e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c9e607-451a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636874208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874208, "uuid": "51de2cc7-6afa-4717-b8b9-d1e99acd1496", "comment": "Malware payload (AgentTesla)", "value": "20e778df58ca438d71b8140cc517d2c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874208, "uuid": "279310fd-f384-4a4a-a035-3a3c6cbd1388", "comment": "Malware payload (AgentTesla)", "value": "ada45ff31e6b7ada1e8c2c3da7c418037404b538dafc5f7c94ae922e7dafacad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874208, "uuid": "02997bdf-61a1-4854-a06c-0bd171760a48", "comment": "Malware payload (AgentTesla)", "value": "4163c69a3e445845322afb4c1f22b613e4b7c62b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874208, "uuid": "2b169e1b-db27-40b1-ba69-b685d7c8dcd3", "comment": "Malware payload (AgentTesla)", "value": "4072d150040662ebad3db683c943fe8aeb41505b9c03acad4532456bf9e00211d47c1707a326add74d4ad4439850f05f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874208, "uuid": "b6c01b66-f2ea-4178-97f0-ec8ac6d81d05", "value": "T1B4A3CA3CBDD5423BD0B3DABA9AF525C3F968B2633506684D98CB13460E43F427E9152E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874208, "uuid": "368f26de-24bb-48c4-8a09-e467d628951d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874208, "uuid": "d21863cf-a48d-41be-9680-7f219597a409", "value": "1536:maRWeyqkViIbZ8GVC++KXMjjHuwwu1XHjEuNKKwHjpjN++NHCpBw+XjSFXdLLX+M:PRVt8iUJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874208, "uuid": "e199acb1-0962-4ff6-b084-898ac0d05088", "value": 99328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874208, "uuid": "3bcfa8b0-7026-442f-aa22-2fd83ae96bf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874208, "uuid": "650bad84-a345-4d18-bec5-05dcc016e6be", "value": "All Documents in one.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6c857e-458e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636923745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923745, "uuid": "c4daeac5-024f-4944-a74e-9d4ca10602bd", "comment": "Malware payload", "value": "ce5df5626f2facc562ea61aad3d5d312", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923745, "uuid": "e348f387-7df1-4eb0-a82a-cb6ab0b15c33", "comment": "Malware payload", "value": "adace11a1835d8b0b768bbb451dccf8507f5baf0c49925ff103ce1c88f0e1ba3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923745, "uuid": "bc26e9aa-a10d-4477-bdbf-263f327f00bc", "comment": "Malware payload", "value": "e476373920aba6e06ef71e4d5b77e5c7161b7398", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923745, "uuid": "4072680f-2036-4640-9602-5730d6e412b8", "comment": "Malware payload", "value": "41304f31dee98e3bc433d019ce1891bf3a6ce981b8eebd7054484102ffdd5bae49f4e55f762c7244e42951f054d4ce4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923745, "uuid": "ddb41e40-2b79-4f02-b8e3-b6d7949c045d", "value": "T117B533A567EA8CA3ECF2973989611501EF2CFC154F86D38D6BE571B9008E0D87CCA356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923745, "uuid": "9202fb26-0ccb-43b4-88a9-e2243699c5e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923745, "uuid": "77f64244-b9fd-4de8-91f7-91492e543e48", "value": "49152:96IxAXlCzf7JaTKTXFVf0qQDmtnWbiTtJ4ZV:Lq87JaTKDFVMqQK9WmJ4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636923745, "uuid": "5eebbc28-68d0-49bd-ae17-9ad566f450f7", "value": 2307704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636923745, "uuid": "709bf6dc-6cc7-4a58-87e6-c76a9159fbb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923745, "uuid": "0b43e9f0-c8fc-4970-8ad0-e1a57c9d56c8", "value": "ce5df5626f2facc562ea61aad3d5d312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6454d3a-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636874693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874693, "uuid": "fbb655ad-8bee-4831-9c5a-12cfc0d4307c", "comment": "Malware payload (RedLineStealer)", "value": "29071beab9a0f92e97a54c03a99561fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874693, "uuid": "acf6da3a-0e64-4865-8115-09f2aaa4051c", "comment": "Malware payload (RedLineStealer)", "value": "aed86e448e4aef859466ca59fabc468edbe9a2d1cdf7bb70c639b60f7a122c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874693, "uuid": "cc0c9948-4294-47f2-afe7-5cba3d675c70", "comment": "Malware payload (RedLineStealer)", "value": "0056e995c5e22364cd22df124416c16c724ac5ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874693, "uuid": "6cf6f401-93c9-4ac5-8327-6c5b5d42457e", "comment": "Malware payload (RedLineStealer)", "value": "7f7605d18e71779651ce33b7536a8031f9c64f9f16a480c244676bd89b81ea5d34672f704386eb612cf1ed0f19f2fbc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874693, "uuid": "1e2e543b-92fb-408d-b9fb-36ac843b1c23", "value": "T1410407433044E1DBD56A09B3B89FC9A152687DAF9690962F32C9B72E50F3311025EFBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874693, "uuid": "ff3837bf-1de4-486a-90fe-532eb7dfc4a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874693, "uuid": "47f1c7ca-6749-411b-aad5-5ea36175746c", "value": "1536:uvgPSL3CgHE+oh4bgOo1yG6TTOU9peL7qQgyGA5:uLjCgHE+mz7UG6TSU9gL7Gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874693, "uuid": "af857995-8ba6-45b0-aa74-6c46f76595b7", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874693, "uuid": "994cd77c-bf41-4edb-abe6-c409801eb4fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874693, "uuid": "aa4ffa05-d828-470e-b41c-0c03230dec3c", "value": "GalaxySwapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2d7382-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636874515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874515, "uuid": "f2e2c9c3-73ed-4a34-92d9-802ff5f132aa", "comment": "Malware payload (Smoke Loader)", "value": "fb316eec470415b45e3a2f5d2ee8963c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874515, "uuid": "3ab5ccc1-d7ec-4ade-b586-bd380840662f", "comment": "Malware payload (Smoke Loader)", "value": "afdcc9769cc71c469334312bec36a9f894b3e4775a1aee1f22f6502cbc13508a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874515, "uuid": "21230838-286d-41f7-86a4-76bd5af0893c", "comment": "Malware payload (Smoke Loader)", "value": "8aa3f5f18fce8683fa2e0b624af819ccd8a12f21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874515, "uuid": "13b6b0ae-24ea-4127-a973-37a355aab63b", "comment": "Malware payload (Smoke Loader)", "value": "3979d46c8f566fe949974780ee228613f1ef3c5595ad754e04b0aa96af5b678e764bf5f72e4f3e8c1fce127cd82fc2e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874515, "uuid": "b51b6387-4c2e-4469-b04c-2d7f55f9e274", "value": "T15D04BE10B7E1D875E1A7263064B18AB11F3AFE72697049CF3B64126E1FB32D08A76357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874515, "uuid": "79a7f0fd-56d9-42e3-976e-6a0e5dc811bf", "value": "90592966431675b281530e894e02396e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874515, "uuid": "2e278ff6-6931-4b7d-99a4-a9ba19033b9c", "value": "3072:C7GQCRVppFzpnKBkCbCatddrySRHVrqZmJ2Br9AHpZa9uD6Vdyhkf:7RVppzKBFlndWStVamJ2NmHwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874515, "uuid": "3b3684bc-581d-4c5a-9cf2-d77bd0357c6e", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874515, "uuid": "1a04b067-defc-46df-ba29-18c35d710424", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874515, "uuid": "206f7c81-685f-4e0a-8970-7df393b2f84c", "value": "fb316eec470415b45e3a2f5d2ee8963c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e50246-44e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Loda)", "timestamp": 1636851988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851988, "uuid": "de08b414-a940-4660-aba0-f504106e7a11", "comment": "Malware payload (Loda)", "value": "76dfeeb731295ac4ddedb8d828e9b4d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851988, "uuid": "575fda1d-4e12-4a02-859e-4ef656f965c9", "comment": "Malware payload (Loda)", "value": "b00e65f141bd037ee4e702f84f6079132a689f31970c29b4d1d67b6a1de4e0bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851988, "uuid": "e4200f97-61cd-49a4-9a0a-f091e8f197c0", "comment": "Malware payload (Loda)", "value": "2680e2011e29a3ff1f6bd70fc1e8c3a73b5564b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636851988, "uuid": "2f96d33f-c754-4113-8c62-260f368ab810", "comment": "Malware payload (Loda)", "value": "89c95ddaaa265db158382d6c44c20543ade94d6b15e4aca193e697094f49f025a0b20e5c8d2c51a8e377511090cece5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851988, "uuid": "33ad3f0a-fc50-4b2c-a14b-559ac3fd8259", "value": "T1DB45E122B5C69036C2B327B19E7EF76A963D79360336D29727C82D311EA05416B39733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851988, "uuid": "efcca82d-660f-41c7-8e6e-5c7d5edb291c", "value": "369fe35b86c83b3130c02698158a4d4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851988, "uuid": "cc12201c-c700-447c-b644-57316737ad91", "value": "24576:BRmJkcoQricOIQxiZY1WNfEiU4il6WwP1MvYR6eqbg79:uJZoQrbTFZY1WNfEboZR6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636851988, "uuid": "e8c5f2db-c6d5-4002-9550-9202fa917303", "value": 1187949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636851988, "uuid": "d0267d45-153d-46a4-a8fc-a7021e9d4eb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636851988, "uuid": "66c9e53f-83de-4f43-92ba-b1f774221a3a", "value": "76dfeeb731295ac4ddedb8d828e9b4d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d47f78-459e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930829, "uuid": "7795536c-d33d-46ed-9a21-cdb00f2c420a", "comment": "Malware payload", "value": "d83cad616e858959947a4d0efe5ee721", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930829, "uuid": "971dedc1-8114-4bfb-8bbf-5990f9ede65e", "comment": "Malware payload", "value": "b101ca5b6677700fcfb325b5b66dbb474ba7811ecb0f8ce41f624508b9e9d2b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930829, "uuid": "bcca9de5-19f7-4e8c-84d7-6cbf3838a373", "comment": "Malware payload", "value": "a58e27038e5033d33a0a297bfe8238c6e78839ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930829, "uuid": "1ca35c91-b89d-4c1e-b1b3-58af40436dfe", "comment": "Malware payload", "value": "3d59626911853429337a75db295d87215ba3e888e5d49dc98c03b2af30589f5f5af64b47e093568c7bb427787a93509a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930829, "uuid": "c48ad756-c655-4b36-95d5-29553732a104", "value": "T1247413022F8CF659F0773D3393FB55950FA678B16A36C88D1E0C9B19D6219826E33729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930829, "uuid": "f5075c7a-0f09-4a05-8fec-07e059bfa89d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930829, "uuid": "143ce70a-c473-4fbf-b617-e18fc452e2b3", "value": "3072:iwI3hmJ93bYhDDFSYoqgHmxpvBuQyZM+vjlrlEqoG3IqsGOAi3vGt2SYDoY92a+i:DI3hit8F0YZuQixrl2Gzt2fDosgc1wU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930829, "uuid": "3b2d5aab-e11d-49f2-9108-153969efa7b7", "value": 346520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930829, "uuid": "6d946215-9d19-4432-b82e-9ebd639f9675", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930829, "uuid": "63fd7f95-503a-485d-a933-352b0ac98c0e", "value": "d83cad616e858959947a4d0efe5ee721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e90c6b-4519-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636873705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873705, "uuid": "44ccecaf-8adc-49fa-9679-287f1c41edc3", "comment": "Malware payload (RedLineStealer)", "value": "f8aabf680229520e599d880dde50547d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873705, "uuid": "ed8b2f51-1251-49aa-99c1-7f33886db56e", "comment": "Malware payload (RedLineStealer)", "value": "b238cbf7a18f77f64476e5850ba07ce5810a4fb395b8db1527a57c3a836b330a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873705, "uuid": "f163ea2f-8738-4b4f-b0d4-4a91c779a1af", "comment": "Malware payload (RedLineStealer)", "value": "614f8818662a30a890e3dbc596a246c37da9a09b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873705, "uuid": "4decebca-35a7-4a34-ab30-f392056239c6", "comment": "Malware payload (RedLineStealer)", "value": "0d9a5ff1cb31b9b176c33b58a0baf3767e94019fdbb30fcb2793074f006a246e7e77b415c9a6d669a716744125a0d324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873705, "uuid": "60645daa-be60-4517-9a0f-623228ab1edd", "value": "T144842528687FC05940E3EEA52DDCA8FBD99A95E3640C743701B4A33B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873705, "uuid": "42c02b59-f329-4c4e-b0c1-13aef83f2a02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873705, "uuid": "74d974ba-eb43-4348-849b-24b697500934", "value": "12288:lEWirmQr1xv1I9JXJUIcKkZjdX4QF5sYL:Piz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873705, "uuid": "d05762c9-ed78-452c-9cbd-9414fee2226b", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873705, "uuid": "eed8755c-9fe3-4939-9e6a-251cce695811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873705, "uuid": "b7e0c0f1-de04-4890-aa37-6d6b2529fcd0", "value": "Genshin1234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb79a2a4-451c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1636875132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875132, "uuid": "0a3adad4-14d6-42f0-80e7-d4a365fe6aea", "comment": "Malware payload (Dridex)", "value": "b97f4a950d14bfbb1ac2cff7f9a78c3e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875132, "uuid": "a9801d18-144b-414f-a912-5558857ddbc8", "comment": "Malware payload (Dridex)", "value": "b261e9792e5c0bab70baf89b8d27b1d47cdddb79124525f185bbc477c23506df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875132, "uuid": "57da22d1-a4c6-49a9-86d0-421f83a602a1", "comment": "Malware payload (Dridex)", "value": "d8d7de147b3f93709cf500672c20463ad1baee37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875132, "uuid": "f67894c5-9c35-4fec-9763-b969bde1dcfd", "comment": "Malware payload (Dridex)", "value": "91c2d859daa6eae0e3eae5194846ff34ea4cd8faeadd537235fd4c000188118db95ce4a277ec76402d57db87e8ff67a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875132, "uuid": "75a94db0-8ccc-4fcb-bf63-31f6c4913bf2", "value": "T1E9949EECCE137CF6E6D5847056B7EA3B7F41B1AE9504E0BE0635A18568C9D3CF8A0684", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875132, "uuid": "8ca71f78-fffb-422c-b6c8-41e8198a0114", "value": "9e6571e4d470f356ffefd21b523a6ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875132, "uuid": "14d70f18-bf79-4ed7-b5d4-98a85e90d52d", "value": "6144:zcdpLh9zjFnh7FVFVmXEiLeizeiTDm+IXR/CAhw3iwT4:zc+UdjMHIXwAoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875132, "uuid": "92d5d5a5-8e5c-4ab0-b935-8dcb97cd21b6", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875132, "uuid": "5e4a3c74-4434-46e9-927c-74c279468b72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875132, "uuid": "7ade93ef-1dfd-4444-b333-3fc1e69350bf", "value": "b97f4a950d14bfbb1ac2cff7f9a78c3e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02515000-44f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636858393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858393, "uuid": "49aeb9e4-2825-4d1a-98fd-9e7bd4289dfe", "comment": "Malware payload (Mirai)", "value": "dc38f0d3037283d7a49cdf3178a5c338", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858393, "uuid": "bae895a1-a07f-43b7-a174-af94a2564c4a", "comment": "Malware payload (Mirai)", "value": "b284ad83558e18301645873db4969a930994d70b996f57e30a373c434649e9e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858393, "uuid": "aa6e8869-3ca1-43dc-93bd-494d54d03ad6", "comment": "Malware payload (Mirai)", "value": "71a706d877436be6bdcddae00ef16c0c9504d1f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858393, "uuid": "90dcac0f-01f7-4a32-9961-fb144ac78af7", "comment": "Malware payload (Mirai)", "value": "801c8a3179d4222ceb48a5b229d3f81326850d7ac8eae3bfbf659557c014afa417985ec6529209fb944282fe1403a21b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858393, "uuid": "8b56b17a-76d3-4aec-b927-20f03f70b9ab", "value": "T17FC3AE3399646D90C100487231F6DB3AA353D75261832EF7E1898A6C9893EEDB3397F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858393, "uuid": "6290db38-2e66-4fbb-9ee6-5fb5a4b5051f", "value": "3072:EKox2l1111/2yTd4JUQU1fAZzkSQ4cap7:EKogl1111/2S5aZASQk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858393, "uuid": "2e2f02fc-3a2a-49d4-a852-a8abdbe82fca", "value": 128740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858393, "uuid": "97526206-c4ac-4647-8b27-cf6606068ccd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858393, "uuid": "50b4bda8-27a0-453e-b335-db8ab072360c", "value": "dc38f0d3037283d7a49cdf3178a5c338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6584e7a3-4588-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1636921266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636921266, "uuid": "380bd2d5-706b-4276-9432-53a2d30e45b4", "comment": "Malware payload (njrat)", "value": "1424e47c68eff1985f6d5b28a2c5478d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636921266, "uuid": "7759a820-d141-467d-98dd-bc425a3d9bef", "comment": "Malware payload (njrat)", "value": "b2f0bc2708ed09126d4dcd9196b3c560622df056cd60475af82d8e998d5d45e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636921266, "uuid": "37b45efd-341e-43e9-8cfd-63c6daa211ec", "comment": "Malware payload (njrat)", "value": "d8cebfb69902702bf7d3a77acfe87e206abec044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636921266, "uuid": "481d963e-db4b-4d68-b13e-66a6126ce7fe", "comment": "Malware payload (njrat)", "value": "c16816f9f0dc4ae6818964212e5c68e025a558c8c37f8963adc8f22b8aac48f7b6fd13455948f97072aa5eaa4a5561af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636921266, "uuid": "01042d9d-9c46-4cdc-aa1c-948a6a8f126e", "value": "T100032A4D7FE18168D5FD057B06B2D41207BAE04B6E23D91E8EE564AA37636C0CF50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636921266, "uuid": "31340f5e-176d-4441-a1fc-a1b32e4a2ac4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636921266, "uuid": "fe8dc496-1fa5-4ad5-97db-2008391061a5", "value": "384:ei2KMizdVjnBhFbJ8ycPN/fnfwacRTrAF+rMRTyN/0L+EcoinblneHQM3epzXeEw:r2gVlLJfcPN/XlcVrM+rMRa8Nurot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636921266, "uuid": "1198ca93-af87-4766-80ed-25a28d9b0623", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636921266, "uuid": "8d53538a-f975-45da-b3cf-0a5633e2fa67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636921266, "uuid": "a3656823-206d-49f3-935b-2a2bb4dc75e6", "value": "B2F0BC2708ED09126D4DCD9196B3C560622DF056CD604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9e1719-4547-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636893359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893359, "uuid": "a0e63b7d-a32a-49d9-9e9c-d5e5bc87c529", "comment": "Malware payload (RaccoonStealer)", "value": "ee0350a7dba1fb04740017294f9a5d68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893359, "uuid": "3b35f160-cd5c-465f-852e-9d2697a9d59a", "comment": "Malware payload (RaccoonStealer)", "value": "b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893359, "uuid": "7e0b7b84-3aaa-42e0-8afa-031e77a77bcd", "comment": "Malware payload (RaccoonStealer)", "value": "e8f6cddfcec0e7685ffca138a26ce86b086757f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636893359, "uuid": "c5747ddf-3b50-4752-bd93-eaea4f918508", "comment": "Malware payload (RaccoonStealer)", "value": "94c2aabd7330aff6da74192c039bb272778e3ed04bcb903e9ca09821cfd90b798df854d61e26827e17face83874c405f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893359, "uuid": "23757271-57d6-4b56-b67c-bd24c666167f", "value": "T12C24ADC1F7F19875E1923D3998658BA056EBBC32E930951AF774AB2F1EB33D04961302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893359, "uuid": "53a13c81-21b2-4fb4-935c-0b5e291bbb0d", "value": "d6f1a2cb84dbc438e72cd46aa17d4119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893359, "uuid": "e1ffc856-dd6d-4640-afc0-c7a1f29442cd", "value": "3072:E7qzAhLVAGAFft4CBlYPZTLGyxqGiT5GVVQNVVggjcGkNIVqI7sxkgaBChMpZa96:X4VAGAFfZiZTIL7ITsq7igavwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636893359, "uuid": "6e5a1d95-c002-427a-8d20-094cdae23026", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636893359, "uuid": "a17f5bd1-e94e-44d2-9ed6-341e81be4793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636893359, "uuid": "add1c5b2-75e1-4e0c-af57-5f46f5ced9eb", "value": "ee0350a7dba1fb04740017294f9a5d68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8be87a-4524-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636878464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878464, "uuid": "2db21792-d16b-4e38-85b0-1fe52eb7689a", "comment": "Malware payload", "value": "dfa628a04a01ce356be1cda5a0df2c0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878464, "uuid": "c243098c-f506-4d81-9e40-8eceb8aa9d70", "comment": "Malware payload", "value": "b50d04aaa183a5dd2faa724c529d0493328ca2860d49cbdf152837311d9c1494", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878464, "uuid": "47fb6fc7-3ca0-4486-b23d-7e4cdcb65a25", "comment": "Malware payload", "value": "00f3126c5c4321cc65ef8140dae5c79a9e7ba952", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636878464, "uuid": "99359ce3-bca7-4500-9c30-b959dd2116d4", "comment": "Malware payload", "value": "961999db09ad1761d1996f732d70df55cc7cef7c4bb6d7bb8f5b6800bfea77ee05bb22439611fbefae1ffa39ce9b8f16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878464, "uuid": "55240231-91ec-492c-a2e4-6907ac8091fd", "value": "T13CE412E166E28474E4573D34A46BD7B82A3BBC21EB30550AFB305B1F2EB33D095A0756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878464, "uuid": "c3d0b73c-0029-4c58-86ab-7bb49419031e", "value": "cba5ab921edb2daa29ddf7f914128d13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878464, "uuid": "2d160bdb-cb98-4a7d-b215-3555d606fc7c", "value": "12288:MHYVIk/EJwDI8rssO48rZ90Y3ycL0gJ2EVyVc7vQ88tSV379:IdkcmfO4qZe2+EAVgPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636878464, "uuid": "473b483f-d99a-49f3-b0fb-62bdf4bffdb3", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636878464, "uuid": "13dcbd0e-ddd0-4aa9-9394-726a613a7c9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636878464, "uuid": "9e74ba5d-3b1c-4fc8-a965-2c5635f62c88", "value": "dfa628a04a01ce356be1cda5a0df2c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c75cb0-4540-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636890504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890504, "uuid": "43f39373-185a-4c25-a072-959ac1cfd8bf", "comment": "Malware payload (Mirai)", "value": "deb051bd3f3a6fa1022c7992a7cb07ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890504, "uuid": "813cad45-9609-413c-b1e5-694b33f74492", "comment": "Malware payload (Mirai)", "value": "b576765fe184be0b64a72ccfb21d843ebff029d83aad03115c7e14c7eef5fc55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890504, "uuid": "d0f1d24d-67a8-4fa5-b23d-747ead989a3b", "comment": "Malware payload (Mirai)", "value": "e5f398a6e15eda0b8405bbb3932ff79e08f14517", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890504, "uuid": "6e9b0147-3660-4649-9872-67f323669278", "comment": "Malware payload (Mirai)", "value": "878832fdc022860c5821bda23b928e778f2384a0758e0db7217939d7797e2b0d4549d32f7d4153e33b8987cf2029e5a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890504, "uuid": "f29c1d43-3f8a-4182-97e7-dd9b6987aae7", "value": "T1E243A64A2E658FEDF7ACC73587B34E21B29833D212E1C644D25CE9015E6034EA45FBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890504, "uuid": "d245c8cc-442d-452a-b9cc-314152b37d03", "value": "1536:oW2v8MoUnGtTAAuUN09LcJCsWIScq54wbZnD:oZv8NUvAl09LUCsWISl2wbZnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636890504, "uuid": "dac26f82-931d-4b18-a0cd-8a8cc32d6e97", "value": 59892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636890504, "uuid": "8ed5843a-87f5-4626-8d5e-0c38766cabe3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890504, "uuid": "2df890ff-e254-4607-89ec-bcfe8e77b3a2", "value": "deb051bd3f3a6fa1022c7992a7cb07ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bbc348-4514-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636871473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871473, "uuid": "cbd021d0-fe32-4dea-b61a-56c5bb879c13", "comment": "Malware payload (RedLineStealer)", "value": "85ac18793faef760b8f16b15e6b6ccd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871473, "uuid": "0d78e6b0-8f28-4532-9286-5baeac265adb", "comment": "Malware payload (RedLineStealer)", "value": "b964ae40cbc0dd892a8210187d7198c6a946e5dee5f2b54efc43dc6da7cab1f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871473, "uuid": "bb2a8697-ddbf-434b-8253-3656351626ac", "comment": "Malware payload (RedLineStealer)", "value": "45bde0c5d9666ef22a5fc1959025f494ffd3d028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871473, "uuid": "36c98daf-39af-485f-9f11-d5c9784d8745", "comment": "Malware payload (RedLineStealer)", "value": "9574e6c86742f3ffb73bb56fb8f5027d33b54a89b28fcd4983da3d62a5f60c51169a0ad26a336db2adbdc3da99c633b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871473, "uuid": "dfdecb5d-0f4a-443a-a55c-d88c01a67c86", "value": "T1067413032D46FA5CF1673F3382DB1EA10F9B9DD14A32C99A1E099B5963539022D37B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871473, "uuid": "e1db687b-8d6c-489b-843b-42b7bfa2e7de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871473, "uuid": "03a271d8-581c-4b71-b5b9-fab19ae2de34", "value": "6144:nWgaXtcpiI2895cJFDJPm1iLLlAs13WkyNXqgBEnO:nPUl095czDJu1i3VXgCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636871473, "uuid": "1e68c097-f692-49c5-accf-db5ad2182d23", "value": 349592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636871473, "uuid": "a17987ef-85ba-4275-b7d7-64b577c9ab7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871473, "uuid": "4d926e29-33fc-4148-b3ae-4b862ebe0df0", "value": "Genshin Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1122143-44e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636850526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850526, "uuid": "627efeb0-1045-44c4-ba62-4704422a1b15", "comment": "Malware payload (Mirai)", "value": "cf7d9400837dabfdc8d46118e5aee380", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850526, "uuid": "874ffd6e-c673-41f7-b8e1-4033e4302537", "comment": "Malware payload (Mirai)", "value": "b9c6d00c6a57072fddbf5161189fb6c143ea2fad4a90f81d3caaada0e2700334", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850526, "uuid": "279ef321-e30e-4e9d-b6f7-907a22b03f81", "comment": "Malware payload (Mirai)", "value": "639c3e9155889427d3c318f62e6bd48af41ab091", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850526, "uuid": "84025d0c-0c0c-42bd-8db0-c9b2a8412c80", "comment": "Malware payload (Mirai)", "value": "a0c1e95a31c73b0433150f8017296d9e9e43747fd3e111011afa0f12d63d269e777d73ee35093cd91bf0f3f5c450daa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850526, "uuid": "2e724208-9afc-4c27-9e69-26b4a46b19b4", "value": "T156D31C82E8419D26C9D307B6FA1F249E331127C9EBCDB2628D154FB476C9C4F0D6A729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850526, "uuid": "eb864a56-874a-4098-9b13-55f628e0b026", "value": "1536:xtnJxICkZXcm1ZuS8iwqQJq19VcWJ+JSBpKU2sKm7EdzLQpfCIOzAOjzRIzigMDq:UCkFcwh9+aeSBpLXE5Qp9OqaIEm6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636850526, "uuid": "144fe610-ba06-465f-83d9-450af74778a9", "value": 140592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636850526, "uuid": "f1f10295-5b5c-4026-b1b5-d9574e6a65d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850526, "uuid": "85e851ae-540e-4997-a1c1-a0d5f046e476", "value": "cf7d9400837dabfdc8d46118e5aee380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5366af4-459b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636929560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929560, "uuid": "9950714b-c11d-4044-bf4c-2709b1693281", "comment": "Malware payload", "value": "1134ec2a376c9e73c99bed47306784ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929560, "uuid": "e60a889a-b0ad-4318-9d31-cc1acd162ffa", "comment": "Malware payload", "value": "bbfc4167404445ae08a6503e1485303d2925491188d6998a501c325d63dee6bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929560, "uuid": "a9e07530-e070-4b7b-83ad-b2ad72057eec", "comment": "Malware payload", "value": "8cebb1a245d24dc3b96543640167ae43a8a12166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929560, "uuid": "a4015bc6-e9f5-4003-8858-c49bfe825f4f", "comment": "Malware payload", "value": "8575d248628ed11c7290c6d5b45661517006da5f57d88c6c5d2bf78b9b663c8d8191238dc903473e4bdfa03e28087114", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929560, "uuid": "8084e63a-6791-4b2b-8c01-a9f855bb57c1", "value": "T1C2D2E115D61EE837DBB0C8768F5CC941598263F980DE36F70B1D86B499C00836BF8A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929560, "uuid": "fa835ebe-7f44-4b30-ba1d-00dcbb3deed8", "value": "768:iruFxWmCaanqIn3VVKybFabKHysXc9FUppRhH55apsTr9q3UELkp:WaNIn3+GFtj7RhZ5apsuLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636929560, "uuid": "b92d9dde-e2e9-42da-94bf-5659afe1b826", "value": 30456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636929560, "uuid": "30cefcaf-59c6-4907-a217-3aabf3dba686", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929560, "uuid": "4b522b27-0caf-4a29-bd81-6af75c750324", "value": "1134ec2a376c9e73c99bed47306784ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2187534a-44f7-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636858875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858875, "uuid": "24c9fcca-cf33-4c9a-8e02-de01c79ce789", "comment": "Malware payload (RaccoonStealer)", "value": "04e12bdc1d965e789ab3a3d1c13768f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858875, "uuid": "2d06757f-7073-4069-ac85-58b656731f29", "comment": "Malware payload (RaccoonStealer)", "value": "bd6bb975db60f223e5169901b94cb4a087e76422f799890fba9049b3b9b80fc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858875, "uuid": "5f0fd260-0678-41ce-9c0a-d72bf1d9b164", "comment": "Malware payload (RaccoonStealer)", "value": "ddc514c475b21bf9660d30e9d99c3dad0dec66da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858875, "uuid": "a168cf21-7be3-45c1-8e2a-02f9087d4183", "comment": "Malware payload (RaccoonStealer)", "value": "f22c5863c7a635dab59f36d8bd826ac598df15ec192c44d6ba0b9dcc8aeec72864d475fba1179a1fc58671a7414f4c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858875, "uuid": "120e8110-0f1a-4b50-a2b5-a95d0d7a8188", "value": "T19EA4F1116BA3CC35E1E6E6305875D6700B36BAF2D53F54063B18AB193E73AD38A79342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858875, "uuid": "82be45e9-e548-4b5b-b4ae-7d58562619f7", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858875, "uuid": "ba503e46-e792-492c-aa48-e43be5aba775", "value": "12288:ewmXoeSlOGi5GknzChXwfyK0WsW0TWXp8k:Z4SlOGj85fVfsW0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858875, "uuid": "206b6a6c-6153-44ff-9c43-5527643e527b", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858875, "uuid": "6ea3c1e8-38b6-44b5-a009-51081000f185", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858875, "uuid": "c908ea89-93c4-40bd-8abb-f04ea5569567", "value": "04e12bdc1d965e789ab3a3d1c13768f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90526a58-44e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636852189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852189, "uuid": "65c5981f-898a-42c2-bc5a-136db7bc0f21", "comment": "Malware payload (Mirai)", "value": "ce6ae5eca510a3738e9ad6a3339e8937", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852189, "uuid": "acbbb94b-7f13-49c8-bfb8-c6882d308d91", "comment": "Malware payload (Mirai)", "value": "bdab3813802e3dfb5c559560a3067a567f519f64a270ca069c946303d1f85309", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852189, "uuid": "9b19b207-2ab3-4ea0-aa0b-f4ca3f2baf0e", "comment": "Malware payload (Mirai)", "value": "76f48268247ee6ed7a18ccc103ab98379f2559b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852189, "uuid": "5c00b42c-83bb-472e-b62e-70346e71cc77", "comment": "Malware payload (Mirai)", "value": "4727a5bdcba58c0a71965e6d4030c30c9e0d92a1d9e1492fde3bc35ad120454bbbdce9721e691107354c1dac558eed42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852189, "uuid": "93ba1a83-bf99-42e9-9068-d40d9bdba768", "value": "T15BA3084AFD82AF11D4C513BBFA0E028D335367A8E3EEB112DD216B2177CA95B0A77451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852189, "uuid": "f6e3d02d-6a63-45cd-a090-1fb447da971f", "value": "3072:p52Bh+9GkmXv2qS67bZX8tDaK9M7dJX6+FdvKnXwbZnE:T2Bh+9GkmXvfSDDaK9M7dJq+6XwRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636852189, "uuid": "050d7ac3-72c4-4ff6-a216-d4ed2ba7f1e4", "value": 105620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636852189, "uuid": "f101cee8-7639-492e-95c7-629147b77c13", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852189, "uuid": "8cd1f849-6b62-451d-85d7-3dfaf89cf93b", "value": "arm6-20211114-0109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466cb45f-45a0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636931522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931522, "uuid": "8e763951-60ed-4543-af9c-f5df639639dd", "comment": "Malware payload", "value": "cf08f629fa6d5cb081c8216205b3b49f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931522, "uuid": "9c956cc0-9cf2-4049-b79b-6a4cad23dad4", "comment": "Malware payload", "value": "c1918e6959d3264707928cf3155eb7d80be60c53997d9b7ae71fb6a41d6fa35a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931522, "uuid": "4dde3102-8c49-4616-9026-d11b3187b291", "comment": "Malware payload", "value": "391fb0272c252aa87abb7e66a3a911f36a233848", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931522, "uuid": "4e9ea0d5-c12b-4946-8d81-7b5678424e7c", "comment": "Malware payload", "value": "f1b18c2d810a4e23064ba401725c73f9aaa986e19c014f960982b2f91eba4143169669216a85a55f5be884d080490a17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931522, "uuid": "4a9740a4-601e-424a-9fb3-d0aca321535a", "value": "T1B9D3F93B27270E23C0C9947105E30332BDB9D78B34BA57D369D16D9C5F1AA843466BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931522, "uuid": "f409edd7-b954-497b-8953-67172811c570", "value": "3072:h+YD1LE+FUNP1u3hCgw59mm2fMkP2Qc/eNO:h+cQVl+O/mm2fMkP2Qc/eNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636931522, "uuid": "27c184bf-585f-4d56-b1c3-beefc35f4b5d", "value": 139308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636931522, "uuid": "3350d4c8-40fa-4341-899e-dc1d1dab16c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931522, "uuid": "cc0bb245-7cd0-41d6-957d-d8e04c5c4582", "value": "cf08f629fa6d5cb081c8216205b3b49f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d0f9c1-459d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636930262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930262, "uuid": "fed6d0b0-658c-450d-a6e0-7477e44bd9c3", "comment": "Malware payload (RedLineStealer)", "value": "827baa0eefb9f694e168d2464f7f3467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930262, "uuid": "f1cc821f-ac95-44f4-a5d2-9a00ef33c0c1", "comment": "Malware payload (RedLineStealer)", "value": "c19df5eafc1c7f1a80ef53182f729b98dd4856036dcc6e21aa3e8eae8005bc05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930262, "uuid": "906804a9-bf9e-4c5e-966a-639b605589be", "comment": "Malware payload (RedLineStealer)", "value": "24be0c31ac6bd052eb9ba69bcf8d51fa98a1ebd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930262, "uuid": "e7f9ce21-4a18-4a5b-ad5f-a5321f20bee1", "comment": "Malware payload (RedLineStealer)", "value": "eed37d3a6d54c9e17107d2aa13882911e11bbcb0ba92347917dd03519b9959c42b191ba84818873045cde3873460ea9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930262, "uuid": "41a1217b-9528-44fd-b7f7-169dfcc00404", "value": "T179246D1CA768E531DFBD5535C8E10040E3F5EE979107EB1AACC034EA2E82BD9F5266C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930262, "uuid": "5c6e622b-c9e8-4230-bd5c-cfc23c38b48b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930262, "uuid": "13a2a4b2-e11c-4810-a0da-c306b2161981", "value": "3072:XRSXpFbRotLPwdJTlyXaOu8sBgIwiWZJuWyj1I+fTzI3YZhUq+IH17bMCfLSb:v0AKOuBgIwiWZsx1vVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930262, "uuid": "87c72d5e-2fcf-44dd-aee3-10233c506f35", "value": 230248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930262, "uuid": "d3f8c916-c249-4747-b219-6c9f6d39dd58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930262, "uuid": "401419fc-451f-41ad-8ef4-f92bb0a99950", "value": "827baa0eefb9f694e168d2464f7f3467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3cec83-4579-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1636914917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636914917, "uuid": "f70ca649-dcb0-4c29-b4a4-0966ea0e5777", "comment": "Malware payload (TrickBot)", "value": "6b9cc0bb9853ea50b275759b023cb3a5", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636914917, "uuid": "7574120f-d316-4d8a-8a1a-6e0106197439", "comment": "Malware payload (TrickBot)", "value": "c1aab21879a22d14f253f9a097f32033e909d12a8646fc58e116f601e9aa308a", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636914917, "uuid": "6fdb6b2e-e4de-453d-bfa4-9a23e7f2f693", "comment": "Malware payload (TrickBot)", "value": "59c7e7e32f454c549577b647a821e5d9f24e44c8", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636914917, "uuid": "a35ef923-910e-4d6a-b81b-e443997b75f1", "comment": "Malware payload (TrickBot)", "value": "90e5760694de8251477e559179fa6eba0ab78d609f69e871f3b9d1f33afbc98ba74b5bb3b0a2987d70197de057b51d57", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636914917, "uuid": "c36b761d-f765-4aa4-bb80-1508e90a7a1d", "value": "T113D49E19FA698075D1BA82348D779447E6B33C511BA087EF23546A2E2F33F95493FB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636914917, "uuid": "4bfd940b-d55f-46a5-b27a-2bf2e21cc12e", "value": "a7abef23aa4abf8dc36e4de8b3a8ba8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636914917, "uuid": "5c3e4cb5-76de-4a45-a06a-f7bfc9ede9d8", "value": "12288:ReAwOWsNbmIKYnZKlzCoVJdVzNPVOAKgbTWM:RDnWzIKYnZKEc1z1fK0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636914917, "uuid": "109279d6-4b36-40f7-afbe-d6051e7963cd", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636914917, "uuid": "9dd9b09d-fd2e-4b4a-9c74-6399f1d6e808", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636914917, "uuid": "1de32e2e-e3ae-4154-9db9-640011f891fd", "value": "Szwfeqdees.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4fa30a-4565-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636906300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906300, "uuid": "8b5d36fc-910d-4064-b327-4625f790a77a", "comment": "Malware payload (Mirai)", "value": "a47cf0aeb4fdd5760209c9342c8be081", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906300, "uuid": "90c1d672-157a-4139-a4b1-1eb91bd6160e", "comment": "Malware payload (Mirai)", "value": "c3a10326a74c0a9a8001254e7c12499ac70f688ef1b2f077dcd6d859096293ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906300, "uuid": "95c65c17-8730-47b3-be5f-b5e66b0161dc", "comment": "Malware payload (Mirai)", "value": "7a2a8126a12b3d9ab97c5e14fb85800ee54c7183", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906300, "uuid": "2a1bcf55-c100-432d-9b3b-ed92762e9711", "comment": "Malware payload (Mirai)", "value": "50d69646614970e5e00f7ec433cd21cae2be431be10516094340874cb494028e5aa231e5ab64ac2804bf231017c3c54f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906300, "uuid": "e4df2cbf-7a48-4775-a00c-7ea3a5e2886e", "value": "T13FA2C130669E90F1C5F01532C3BF1F8C53A95B2DB88622B6523843B5DACB4527FB5647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906300, "uuid": "73438ca5-20d0-4e7d-a11d-1e2b94fd5ee0", "value": "384:qXlrmHNkS18wdx5LBwinBYdjhIpM+Lz+WpWImNEKcCS1lon5l1RmdGU5ElUp:qX6NkStVmiBYdj6u+P+eWIucZ1G5nR3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906300, "uuid": "38f81757-2915-45e1-8a37-4f49c4ca1940", "value": 22120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906300, "uuid": "25014528-c1f5-4834-9ceb-79eaba1669e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906300, "uuid": "866a82c4-6db7-43fd-8f9f-69a74334f922", "value": "a47cf0aeb4fdd5760209c9342c8be081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de57ad1a-451c-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1636875083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875083, "uuid": "17db8ce9-af3b-4a5d-872a-cb9ed1ab1cc8", "comment": "Malware payload (njrat)", "value": "1668d3331e6626d5324d8cddeb70cfd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875083, "uuid": "ee793995-9772-4710-b7ae-c3330270642a", "comment": "Malware payload (njrat)", "value": "c413639e6761e3d2e2baa10f37e545c7781e974f5eb4e64e6d7600532d282ec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875083, "uuid": "663201bf-4ef7-4c95-8bb2-d160086925e7", "comment": "Malware payload (njrat)", "value": "c9fca04a62ad4f8e932f340a995a7b23134fe3c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875083, "uuid": "aaeda2fc-6155-4e76-b6f5-fc87a854b65a", "comment": "Malware payload (njrat)", "value": "76bf08093c8308441cf4ec1c41cef44446f7b4e0f5af646ad4dc51ed83deec00bb5deba928887ff017af526b35a5d974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875083, "uuid": "67331f1e-2273-4476-9a02-11855cd18846", "value": "T16CD37BCB2E148AB3CB5DF53404A3733C072B993EABD38E0EE99B3D0A673625C5544569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875083, "uuid": "f32327c2-e195-4edd-ae5a-330f5accfe39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875083, "uuid": "a79af735-076e-4f20-a94b-59422c73f5d3", "value": "768:FGcQHo9fHWgwpuX1HMN7ec2bNAUtVW9Xu7W/Zq7YzUM3+XC1GdehtCRGYw3YgoE4:YcKo9epgONycoACNTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875083, "uuid": "01aac933-a1e2-46a8-a4c6-cab785ad2dc2", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875083, "uuid": "5cd392cd-7034-4ebe-9930-5d605ca569b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875083, "uuid": "4a42feed-fc47-4c35-9cd9-2eae3568c837", "value": "1668d3331e6626d5324d8cddeb70cfd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a9b915-451d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636875340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875340, "uuid": "f1222e7b-3881-4bea-aa05-0efbd9f08d0c", "comment": "Malware payload (RedLineStealer)", "value": "14d50f26c52f27f1b3d5665895a34106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875340, "uuid": "5f7e9879-04ed-44e6-aa46-d63127655821", "comment": "Malware payload (RedLineStealer)", "value": "c43f3217c1cb4f9b4c30ab1d7e5c58994a7f7ad3c639c6641f3e1602295313a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875340, "uuid": "2801bdb1-96b9-4d47-825b-3debed870e04", "comment": "Malware payload (RedLineStealer)", "value": "55b69c331bc83accc597fe08f58f073914244580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875340, "uuid": "a99d3298-e8c6-43c2-9b56-3fe2d682ca39", "comment": "Malware payload (RedLineStealer)", "value": "8f4e5bdefaf89af4f10fb3e667adfc8d131ba56d4e5b94b83aebdb6e1e4aeb9e8c71c69c570ae77a43477fac8c3fbbea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875340, "uuid": "adea247a-2004-44e4-a4c0-ee2b2b7e8b03", "value": "T1DA1633B4A5E0A34CC6270E74E9EDC93CD51156FC38E5EC4E6859ACE1F2B1DA3CB19428", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875340, "uuid": "c35779cb-229e-4cc1-9052-b1684ffc066d", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875340, "uuid": "aecf1c28-92a6-4a16-9f5a-b692089d5869", "value": "98304:Fxx/Y0pTmLBqQfulu7MJ94OFg+UOkcu5xyXmB4Wfy:1g0p+757BMFNu5x1X6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875340, "uuid": "b1dfce3b-5fbb-4ea1-94f6-3ed783377f15", "value": 4373504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875340, "uuid": "bde4148c-cbea-4a24-be61-5bdaf785879f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875340, "uuid": "fdaeb813-3512-4643-bdd6-5dbd0013fda6", "value": "25a02262-50ff-4bb4-8a56-d36f2fe0b0c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81413d44-4551-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636897690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897690, "uuid": "8eacee70-07cc-4f8e-9509-6538dc0ec38d", "comment": "Malware payload", "value": "bc932eae2d06c0fd6a1c80cee43641e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897690, "uuid": "2c629ac8-fd9c-4625-a2bb-da5fe824a84e", "comment": "Malware payload", "value": "c49ef950b047cb566383c4f3cfc639cd1288ad06b8bf387145654113cbe70820", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897690, "uuid": "6e777c46-6467-4f1d-9001-ae4f34aa8298", "comment": "Malware payload", "value": "c1414b4320e6a8a5dbe3292be7205977239d4472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897690, "uuid": "d0a8eda1-d85d-489b-a36c-e9de3be0d4d8", "comment": "Malware payload", "value": "c23fafcb3e18ad623fef41bdac7ce007a16dc04600b23b6399751d915d34b8a9bf3fd57d00a762e1b0c7ed5e58164fe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897690, "uuid": "fac4161c-67fa-45c5-af98-0d029c53a42a", "value": "T150F22A2D6B9D8A21D92C4B790CB14200C3F39133E536EF4B5ACE64591B6F3916E80FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897690, "uuid": "a1beeb5b-769b-41c8-a82b-db15376310be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897690, "uuid": "d9407186-6d3c-414d-8f4b-cda7ea3bcfe1", "value": "768:NPGtkVkyD5rkiMfWBuZ+e5DRQNvYIsnJj5VfeHo:1Gtmdi04+eZRQNvYIMP2Ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897690, "uuid": "7ef3e42e-92c6-43e1-9fb3-ba333219d459", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897690, "uuid": "cb1907cd-5c26-424d-bb1e-a0416a58f4de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897690, "uuid": "50318b1c-174a-46da-9919-df06ed7b0e66", "value": "bc932eae2d06c0fd6a1c80cee43641e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67c1fce-44e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636849649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849649, "uuid": "ee8fd6aa-24ff-436e-bc8b-2293a9ceecb6", "comment": "Malware payload (Mirai)", "value": "94b930c66e730722fd06e90cd7d26c54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849649, "uuid": "239f1667-742c-40e3-9c91-2d2f06541350", "comment": "Malware payload (Mirai)", "value": "c5d7e291dbb411493e1037831641325cc6b5117052212a33a2c59e0da390ff64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849649, "uuid": "68fe1159-d83f-43d1-8a8e-f9322d968138", "comment": "Malware payload (Mirai)", "value": "18cc60a4a10c060f03deb27418eaa37fe7ca44e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849649, "uuid": "bc15e54c-7b9e-43aa-a1ee-2935dcc1ccf9", "comment": "Malware payload (Mirai)", "value": "3597e8c7c37e76035099d6e7b18266f3ab99f7d11a7a91d504d816432db9039759d3d09060ce65594f733b3d7aee6377", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849649, "uuid": "90a8d71e-8b4a-4731-8bd1-e143daa3be71", "value": "T17814E793978B9D7FFAEA53FC15C7A924A2A2058964738087E0BC3E1D1E705E0DD09BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849649, "uuid": "a8ff7842-921a-4faa-bd9f-8dcc77994836", "value": "1536:afe4Pl/+P+5tStPPFKqJJhPZaIUpCldUTjJblGlRy9Wr3occhvXssadzwMSaxafn:vNJJhBabpUOhv/6iaxFeAe4AU0D5NZ8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636849649, "uuid": "7c65bfb7-7de4-42e7-9e22-b1891f1a6a07", "value": 202495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636849649, "uuid": "5328e9c6-1a1f-4807-ae66-3bd83b00cd45", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849649, "uuid": "76148c48-1730-4e75-ba20-517311f859a6", "value": "94b930c66e730722fd06e90cd7d26c54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3405ef-44e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636852187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852187, "uuid": "1fa3e941-2fe8-4f5d-b5bd-2ae522609862", "comment": "Malware payload (Mirai)", "value": "2c3b2f98f64bfc11dd745430417fb497", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852187, "uuid": "d102cb2f-a864-433a-956f-7b8a7c2a4f82", "comment": "Malware payload (Mirai)", "value": "c7ec33c5301b9b2508cb336dac86657ee418af67ebf3614e458974f3590fac4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852187, "uuid": "f3361a41-e49d-4c45-a3f0-cc48229daad8", "comment": "Malware payload (Mirai)", "value": "121a29a566668ff7f8c61384636a568d4888d105", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852187, "uuid": "5124a8d1-8a46-4d09-8441-e4fa8c8cd660", "comment": "Malware payload (Mirai)", "value": "c279f88c002df4054860e15b67adeedf21b05deec3c9ceaff067c04e0232e311f6c8ea321a6b2e88aa18044afb47b034", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852187, "uuid": "f4a000e9-86c3-4ec2-bda9-22d69cf3c068", "value": "T130734A13248088FCC485D270AFBF962BF662F07E4234E59D2BD4BE13BD1AE211E5E595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852187, "uuid": "772ea2fc-ea7a-4a53-99b4-cf3930b9afdc", "value": "1536:ODeK8QYcfpg67uW7jgwGbeXwsphnb4hIM4SJrRVeTBnc2:ODaQYSpgoH/gwPwShchIMBrRVeTBnc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636852187, "uuid": "bb12c223-b099-4e62-b7db-23fbd657f55e", "value": 73888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636852187, "uuid": "1daa9a7f-b7cd-4337-bf58-6812556fbb00", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852187, "uuid": "2bb86a3a-cd75-47cd-b2df-d3a83d8c2bb5", "value": "x86_64-20211114-0109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29309192-450b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636867477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867477, "uuid": "9b460385-641a-43f8-936f-ec3ebd80f451", "comment": "Malware payload (Mirai)", "value": "889d53e692451450ddefb98e4a2adef7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867477, "uuid": "aedccc48-35b6-4bf6-acbc-69df9eb0f8c3", "comment": "Malware payload (Mirai)", "value": "c8d0b3c3be5452d06b022712de9bcb7cb5670073d5548d2dc1a532dcf70d2171", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867477, "uuid": "364801a4-0dae-44f0-bc65-5b96079c5f64", "comment": "Malware payload (Mirai)", "value": "32e8eabeaf58d24e3fd1d2fbd137f0b7f89add2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636867477, "uuid": "61aa2b53-8cca-4209-8ffb-2a3b0c2936d1", "comment": "Malware payload (Mirai)", "value": "cc1fe339f33e721c11c3975d51a106974d6c957032a99616b35d9a5a69a167b8df0999547532874af29abd6694f2ec2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867477, "uuid": "64483f22-c415-4788-981c-dff8f28ce2e1", "value": "T16FD2E1CE09264CA0D36AB47C0AD00FE93D974693F411D92D5FA4F5518EDB7F82A8AAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867477, "uuid": "ef7e5d21-7cb8-473c-ad70-34ebfc8f4e6c", "value": "768:hPMFPu1mI0GwEurl57TCfvvl2B5yt+jmJgGlzDpbuR1JP:dII0ourl574V2Ty9VJux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636867477, "uuid": "df7235f2-d05d-4177-9f6a-95f6544af5de", "value": 30832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636867477, "uuid": "5b5e4fcc-d778-468f-b575-aec1b8b594c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636867477, "uuid": "fb51910f-69ed-4b1d-811c-73ec6104cbb6", "value": "889d53e692451450ddefb98e4a2adef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c5d1de-4551-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636897770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897770, "uuid": "a6dad9ac-230f-41bd-846c-1ab26d85aa52", "comment": "Malware payload (Mirai)", "value": "4b7ddc38251943a564c0e913ce509622", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897770, "uuid": "dd9d59c8-fc6b-424f-91c8-7d4757b3f5cb", "comment": "Malware payload (Mirai)", "value": "c91efa365197e3c3f0c5c4dcc517c6795875c47cabba26e91d24a1d1584c7447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897770, "uuid": "5de56d79-a6d1-4b55-98d5-5def858b7461", "comment": "Malware payload (Mirai)", "value": "205f7825de9c6bc97779460aa00d3fe07dfc3327", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897770, "uuid": "01a96200-fdf7-4fe7-b0fb-f27d5c1adefc", "comment": "Malware payload (Mirai)", "value": "6724c873418d8acd90197bbf26cf52405d249eb476d4f2129d6118387cde195a4228828e8ed0b5a1abef6038c2ea0179", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897770, "uuid": "bae14701-1b96-4de7-8858-8869fa9d04a8", "value": "T18AE3A63E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897770, "uuid": "23abb192-476a-432a-a0b7-f8eeaff4bac3", "value": "3072:JW6BK9tS1aRG4dKP6h//CTH+mrThPaLEne7rNb:c64i6XCCmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897770, "uuid": "f43bd64a-c093-4c18-9528-e1b5cb1432dd", "value": 155429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897770, "uuid": "eb41687d-69b8-43e6-93b2-b2c2dfdaedeb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897770, "uuid": "39395fea-7c36-4526-9868-339d2cade721", "value": "4b7ddc38251943a564c0e913ce509622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecb9555-4518-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636873231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873231, "uuid": "fa5949c5-7bd5-4395-9f36-7066851b83d0", "comment": "Malware payload", "value": "0ac34cf9b5240f5891b1858be02adc14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873231, "uuid": "a2a5a15b-888b-40d4-9b89-e8dc7f4f5ffc", "comment": "Malware payload", "value": "c96669b662ee39a964547bd29dc74ab5a8f19d41f4e19ee2b2f53d05afd4cca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873231, "uuid": "3b5b0cdf-067a-4b9f-8678-92de979c24f5", "comment": "Malware payload", "value": "f1e2afb1703439bad1450d550177810fcc1aaeb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873231, "uuid": "e86a7624-a6d0-44a1-9fd5-d439fa3ea538", "comment": "Malware payload", "value": "9b9b4b62bc34660e6c38fe70a167e3f09bd8b542219f8c191d043de3de95ade481e14889d39e70e522bab8d19939b3bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873231, "uuid": "338902ae-1254-4824-9fac-1b9357e42108", "value": "T19346335572AA18F9E47E8273D581952BC6B2F0122358828F1B7CDB26CF177802E7E771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873231, "uuid": "63ad9f41-0548-44fb-98ab-802a11cbab11", "value": "1861bc6d7cdbc03b4f60bf54c0a672fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873231, "uuid": "a4a51143-815e-4f4a-b672-a916ee1d02b8", "value": "98304:s+0xoEgGh5vBHAq+xapjlZVDYucrK7W/Qeqn3nvkOPWCqGOBx+aGiF5D29:s+AJlh5vBH+apjlIBd/Hq3MOuCqNBxXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873231, "uuid": "6b337fcc-cc65-4e2f-a31b-797a75264e6a", "value": 5560440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873231, "uuid": "0e5270ab-24b0-4edb-87b7-27c0e4621b76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873231, "uuid": "2198d98f-c59e-4688-8722-86e52507c592", "value": "0ac34cf9b5240f5891b1858be02adc14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba2649e-4542-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636891453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891453, "uuid": "70e868ac-eeeb-4d4a-8ebb-d3da944ae0d1", "comment": "Malware payload", "value": "d1602c13d13b21573c20b77fdb18bf26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891453, "uuid": "dbaca1ea-443e-460b-b137-7ab372dafcf1", "comment": "Malware payload", "value": "ca0c717cf96d8ed8d929b292fb7f4b7aaaab51c46ead19dc400c9c14c122eadb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891453, "uuid": "d730976b-4add-4adb-abd9-1b2b15cbd172", "comment": "Malware payload", "value": "87101c026d76e98c6804cb52a04394c0a128bdbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891453, "uuid": "ab46cdb5-e052-40e8-9bee-84dec51f507c", "comment": "Malware payload", "value": "98ba804d5502027f603e29db709facd77e33bd07cd466d98704297092aa056e1dabbbde3a150b873c453d84ba67de27f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891453, "uuid": "09248705-ad6f-435b-9708-86f166f2de86", "value": "T1EDC305576BC13802F52A8DB6BB219130DF1CEECE2C52C78616ECBDD77E619095B6D220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891453, "uuid": "ef8c6b01-eaf3-4b0a-8ad6-76c90c104e7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891453, "uuid": "3b176683-bfd3-4bc8-b67f-171ad1639ed2", "value": "384:q7BdxRGCtT+b4XeytQd08gO362h7zhtEtUQEgND0WcbkdqSxT0rswcCm:23GCtT+d08gKhnhelC7SxT0rsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636891453, "uuid": "918ff387-e559-450a-bded-4633632bf723", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636891453, "uuid": "9f154640-eb47-431a-abba-9fb6da21943f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891453, "uuid": "a76550e4-883a-49c5-8ca4-be38d2c122d5", "value": "d1602c13d13b21573c20b77fdb18bf26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78f654f-451d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636875501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875501, "uuid": "070cd63d-b166-4e85-a989-497398a9a508", "comment": "Malware payload", "value": "ec593c5788357ec2cbaf733ef22ab062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875501, "uuid": "4f4b5c54-5365-41ab-8aa0-adbef088dff4", "comment": "Malware payload", "value": "cbe0f2bfb4ec372228cff745606e92d9e6b8481a0fb5113f09e7e518ed0c215c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875501, "uuid": "7a53709c-0726-4e49-9dcb-df127ac43336", "comment": "Malware payload", "value": "3aa360751312094812d7beffcdab2e9a122e9c4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875501, "uuid": "2d836d56-4763-415a-827f-67211e63e331", "comment": "Malware payload", "value": "2b7e04d8fb44e3fe8b7867783ed96a863e4f797300452f456a63219f03b07b4388a989f02282b411c1a045ae87ba1fa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875501, "uuid": "c76d1141-e03c-43cf-8a4a-48a70c74f0d2", "value": "T127D31370F930B236D3866933F6255C786A01A9BA5513DCA6F11F3B0903B64BB0EDA195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875501, "uuid": "4bc339c6-d580-4d4a-b19a-4944bf248c4a", "value": "3072:ok2znB0/R8PxYzznCWOTXBlmduumkRFZ2MnTc:oxznBuR8P+fCWGmdHH2M4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875501, "uuid": "4849c4b6-8fbd-4437-b917-e9b033a24334", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875501, "uuid": "cc07e573-35d6-4e56-92d4-e89dee2d7123", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875501, "uuid": "fa45b53f-bd8e-4706-9617-50b35b044ab5", "value": "ec593c5788357ec2cbaf733ef22ab062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ef4968-4543-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636891730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891730, "uuid": "21cfdd35-dd9a-4d36-8d28-6937da7242d4", "comment": "Malware payload (Mirai)", "value": "dc741472a23b0dba8fef9dfe70c6bc5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891730, "uuid": "4b1f614d-24b3-446a-8991-bd6c1d54cc0f", "comment": "Malware payload (Mirai)", "value": "cbf9bbce822ef183ac1f055f3b61b3bbe9cf782300d0a8971c262972907efc93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891730, "uuid": "7a06b0b7-1784-4dab-b58e-e23379e85c61", "comment": "Malware payload (Mirai)", "value": "fa8a0010ab2fe4a2ccb94e04adf6f33cbc078b55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891730, "uuid": "3483194f-3783-44df-a7f7-c4226d67f130", "comment": "Malware payload (Mirai)", "value": "5b8d31162b30d9348e297580b06d7c5a53a9453f99be7a2f4638dc2dbf9fb0190b71388df8642ec6d68725f80831dc53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891730, "uuid": "f78b2adc-7411-42c7-89e8-95c696f8a45c", "value": "T1EC431986BC91AA26C7C4177BFE6F018E371467D8E0DA33478D191FA076CE90F0D5668A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891730, "uuid": "c000ee9f-025b-487f-a7f7-5c7f999914dc", "value": "768:sEI95OFbhb+IPFqc8o3VrQgYi0XwYaFoIL4fborR2g3a7wCVy/Jx+5H8hG1rmCd9:C9MF9b1Tl3ii0xeoI8ErggweZWJjiWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636891730, "uuid": "7282cf4b-2b88-4d02-a359-a44d26dc9a71", "value": 59724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636891730, "uuid": "799b4441-300f-4dbe-811c-4f719b5bc75c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891730, "uuid": "4f57c9fe-3d83-4c02-9e7f-bbf0a5f22bcd", "value": "dc741472a23b0dba8fef9dfe70c6bc5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50303141-4517-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636872697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872697, "uuid": "a56b2873-689e-47a3-8968-36c4e12aff60", "comment": "Malware payload (RedLineStealer)", "value": "c19cb6fb47b51fd5d47548dfbe60568f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872697, "uuid": "cad08a03-3c11-40a8-bfe7-62e7c511bfe7", "comment": "Malware payload (RedLineStealer)", "value": "cd613a472ee444ebdabe6219452c6a31eff020d162eb079eb52141b018add9df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872697, "uuid": "ff76b306-185c-4006-8f53-1ba0f1d0a697", "comment": "Malware payload (RedLineStealer)", "value": "fbc52093c33b489ae43333f1fefdbd79cc643587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872697, "uuid": "114ba031-9319-40ce-a728-6a490ad57dcd", "comment": "Malware payload (RedLineStealer)", "value": "608ada520b5507164b3d6c4425ca7c6607f0dd80bfcc03f63b9795c2234ae37e6d6d7350b79ac7d261f2012a1bf86c98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872697, "uuid": "89b9aca5-27c4-436e-a554-bad19e6af498", "value": "T1D094B000B7E0D035F2F756F44AB592A9B92E7EA19B34A1CF22C526EA47346D1ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872697, "uuid": "c6dd0a6f-bf6a-4ae6-a2ed-f4d6346c403c", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872697, "uuid": "806b996f-c28f-45f1-a2ef-31a9bf659fa6", "value": "6144:q8JWreV2Pc9bUql+fJN0kJ4iZe6hJyG+S0kpznHWv9ezTbW6YJ9y:JWrSlBUZfJpXe6OG+S0qznHWvcbWhJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636872697, "uuid": "32723704-a381-4994-969f-9703a08c3c02", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636872697, "uuid": "efc66964-e816-4ca0-84c2-de82a4aaf2d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872697, "uuid": "1fd5c6ce-9d66-408c-9bf7-2fde2772ddd5", "value": "c19cb6fb47b51fd5d47548dfbe60568f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bfe529-4543-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636891716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891716, "uuid": "a2dc0497-e115-477f-a37f-7c4326e20ed1", "comment": "Malware payload (Mirai)", "value": "598ed5ed37201c46b0669ffea9540327", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891716, "uuid": "f83a3f64-e8dd-4be9-8713-23b9c2a9bebb", "comment": "Malware payload (Mirai)", "value": "cf0752788b0edda6f5813ce2ae900422310b9549aa85ec500ab5ee929b899a41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891716, "uuid": "7f784333-e573-4392-8d0d-7568635eee60", "comment": "Malware payload (Mirai)", "value": "8b2b542f4717541b7360a25c1d8155cabeff5632", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636891716, "uuid": "f6ba97e1-97f2-4d72-85f1-a3c7bddcd336", "comment": "Malware payload (Mirai)", "value": "d3835825d45615e37b629b8be6c8cb0207439ad84b8144d21dcbe1d4099f78028294f794a98a930794aebb4adfd7aed2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891716, "uuid": "aff79146-b51c-4352-8243-457cde660daf", "value": "T177C36F19BF611FF7F89BDC378AE91B05288C641921A87B71BD30D418F64B25B25E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891716, "uuid": "689f3807-9e54-463c-a24a-3ef4db556550", "value": "1536:Vjdzgn3y1NKsxOnn84bLG2Pa8SFd7jYgp/i9Bu7ZcU3Xq0EH:3zyy1NKsxcn84bvPaXFdSu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636891716, "uuid": "853c29da-6b55-438b-b62f-a47bf313c3c5", "value": 125116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636891716, "uuid": "3010d962-1924-4b6f-9b31-b45ce48bd897", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636891716, "uuid": "9ec34593-a594-497b-8ca4-3e6b173dbd64", "value": "598ed5ed37201c46b0669ffea9540327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b967b4-44f7-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636859169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636859169, "uuid": "faadb272-950a-40a5-802c-dcfacf024401", "comment": "Malware payload (RaccoonStealer)", "value": "f7ace51c49bc40593b1c8e2fda11e2c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636859169, "uuid": "cbf77c09-1418-4378-8121-90b246ef153c", "comment": "Malware payload (RaccoonStealer)", "value": "cfe0285c92fd3ba73b574809c128333d493a354b509aafbf9d05402f8f82fc93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636859169, "uuid": "8988812f-7928-4b83-b7d0-3fe050d8ab25", "comment": "Malware payload (RaccoonStealer)", "value": "f0d39289981d00d64ddb76fa1bc273eca28b468c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636859169, "uuid": "adee2035-70d6-4b48-b855-19afa5833c12", "comment": "Malware payload (RaccoonStealer)", "value": "130271098ee5c0577cac1b25f389037bc9505ee47961c951c56a4f4af1ea772f236083f1a5d38492ac9dd16355c08f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636859169, "uuid": "7a58e03e-d586-4f08-a284-bc52b211b2fc", "value": "T168A402016BA4D4B6E59736312A30C7BD1B2BFC325835514A3BA52A3F2E737D04AB9317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636859169, "uuid": "625e8f40-f46b-4149-a19d-9864f94ee0af", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636859169, "uuid": "eb494be9-6634-449e-be2b-f85868780811", "value": "12288:LwmXoeS7XFMisiJ/sLaVyrjqh0J7j1UECaYULOw:k4S7Fmuia+jqGN1hYSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636859169, "uuid": "8ce0f25b-94e2-4ae8-85a8-75e8e08c5b41", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636859169, "uuid": "451d963a-4d4f-473c-b4b9-f79c4170531c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636859169, "uuid": "0b741f3f-3f4b-4af1-a66c-086327bb51d8", "value": "f7ace51c49bc40593b1c8e2fda11e2c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af94a5e3-44e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636849664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849664, "uuid": "75f5be5a-09cb-4300-b319-98e0794f56a7", "comment": "Malware payload (Mirai)", "value": "5219a202bfd0a942e1eac45676ada1f9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849664, "uuid": "c851f474-2210-4997-9bf7-e11f9d904cdd", "comment": "Malware payload (Mirai)", "value": "d03a780253086eb9992658bdecd9aeddc3a150aeedbecbff4b5240c285aec987", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849664, "uuid": "c82b1894-d2a5-494e-8887-22bd3d6cc427", "comment": "Malware payload (Mirai)", "value": "9053a47e5190936d471f3f10543a8068b18039ee", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849664, "uuid": "f7c61eb5-84b9-41ff-a5fe-dbb86f4c888b", "comment": "Malware payload (Mirai)", "value": "8b8d774aaf2d43cd57895ef952ba4bc6eb40a7288b50083ececfc3c0af1028032c076168bf6e6cdec41af14af4e7474f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849664, "uuid": "df778144-766f-40c0-b654-b3a0fbee81df", "value": "T168C3175FBC9441FCD1B4E2380BBEA936C451B1EE11B8BADB27C4AF251C159A31A19D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849664, "uuid": "1e6819e7-2cf2-442c-8a6c-e0b876742c1b", "value": "3072:zstMmpz1Wpvh0THzf6rvLQ6sncjKQsdO0GnpCBmvdK5SyvkWiP:zstMmpz1WpvhmHzf6rvLv4FGcFSyZiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636849664, "uuid": "6e964100-4b6b-4e6b-949f-2aca28f7ecc3", "value": 124160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636849664, "uuid": "89db8408-b481-43ba-bd6b-c186755c8a85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849664, "uuid": "9154f2ec-93bc-407b-9e6d-e85a3f23db5d", "value": "5219a202bfd0a942e1eac45676ada1f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f79a64-459b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636929311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929311, "uuid": "85fff6f2-9d35-4d24-93f3-9a86c15fd24e", "comment": "Malware payload", "value": "e418c121b06c532cf0031a8bb1520ff1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929311, "uuid": "c7288cad-d087-4e03-8eb0-5cc0726c0745", "comment": "Malware payload", "value": "d281f1798378ec6233487beeee61c573d2db5be73dc86d21210e3cd565674947", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929311, "uuid": "96be444e-8bde-44e2-8c88-49b1a83b9dbd", "comment": "Malware payload", "value": "ac3253282df34ec68b355eb76aed4576b9d12318", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636929311, "uuid": "9ce4f928-3958-4a11-a432-dca7ac43bc6f", "comment": "Malware payload", "value": "9164381073d557751276d81cfea4be07a7de68617f37351e2610cef4d8fefbd3019118ccf673502c480141f4570bdaa3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929311, "uuid": "db316c95-3e9a-40d7-8fe7-2715dd40ad2e", "value": "T16482D160C3ECCE19C206433B055E18B11CF1BDA64227A6C64A2715C2BFFA5AD97BAD05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929311, "uuid": "f8bfc425-5bdf-47d8-b861-4099c621fd5a", "value": "384:MaeXIHx+eaFuraF9C/lCErgGRhN2MZSO2ZXaSKQBvMv1R8n:TDGOaCtCvGR2F9KSu8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636929311, "uuid": "355b4511-458b-44ac-9bb8-e40c384aec8c", "value": 18016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636929311, "uuid": "6e191f56-ebcd-4cd8-8074-83e5c47c793a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636929311, "uuid": "7ba63dff-073e-47e3-91d5-88e3a257a9cf", "value": "e418c121b06c532cf0031a8bb1520ff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6877d7-451a-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1636874036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874036, "uuid": "6fff5ab2-5eb1-473a-8dbd-0bf3459b92d7", "comment": "Malware payload (TrickBot)", "value": "ddf55126a11267b709c9a11e74362c0a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874036, "uuid": "34534dbb-cef4-443b-82da-3c30a310619f", "comment": "Malware payload (TrickBot)", "value": "d34e5b665cf93ee29410445c006bab618e3645aad6607d493b52cb96c23c2859", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874036, "uuid": "c4a85838-36dc-4ae3-8d00-2192a722c59e", "comment": "Malware payload (TrickBot)", "value": "339b136a52803cff382bae97c41b34a870f2940b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874036, "uuid": "18a434bd-697f-447d-83c3-3a3c834e87e7", "comment": "Malware payload (TrickBot)", "value": "73033a78be4687b4a917643376304c84b9f6067ee9f8da018571ae205db19eb2f75ea976aa8f22bb299097d167e350ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874036, "uuid": "c55c770b-7828-4023-8d67-fb193d52a87d", "value": "T1FDD4BF59F7744065E026D1798E339242E6B67C161F30DAEF2365626E2F33BE0853AB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874036, "uuid": "1c79fa67-8d9c-4f23-9430-eb13e406dc92", "value": "a7abef23aa4abf8dc36e4de8b3a8ba8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874036, "uuid": "4ee4b381-50bd-4981-949c-0ceb6d2ebc03", "value": "12288:C13uG42tfQbrORxZyDFdodY9vwyGDO6Zme:C1uP2tMOLZWFdASn6Zme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874036, "uuid": "d19e6a55-bcfe-41fe-b82a-81c8483d901f", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874036, "uuid": "16412ca7-829c-477a-a0be-b7e3fe81073b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874036, "uuid": "2d5b9871-c9e4-4abf-b92a-4a04344dabb4", "value": "ddf55126a11267b709c9a11e74362c0a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9816be9-459c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930104, "uuid": "5cc0c865-6858-44e8-bdd8-980f43b47e79", "comment": "Malware payload", "value": "87486342350d1df123eb4823aeebcac6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930104, "uuid": "434ca924-5c57-4d00-97fc-2c871627dd86", "comment": "Malware payload", "value": "d4ed3e769999dfb1e874ad58181c4e2408c7394060964192d46072e613f1c08e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930104, "uuid": "80631f2b-2c58-42b3-aba6-e218c67eebd5", "comment": "Malware payload", "value": "a633908b945bc8b470ee7b6baa82709b64f1ab97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930104, "uuid": "3453d7bb-6155-42f3-bcd1-396433561b99", "comment": "Malware payload", "value": "bd91618ac88499960852e55234627fa954ffa241e064ab795df57e059b6ed86de53fde255590f8deda5e8410805d01e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930104, "uuid": "70bd090c-7ce8-461a-9982-5b1468ce2462", "value": "T11F82D0312265BD71CB30443EEAA98342675A1FFDD1FBB2B3146005BD5A8680B95F8385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930104, "uuid": "7cb94602-7757-4b5f-96e6-9e68b7c346cb", "value": "384:3a0qBythg5QUx9OVf8fvS4M6KktcJZglqitnhymdGUop5h4W:K0qByLg5QUvOVf8fvCPNulqitns3Uoz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930104, "uuid": "4d49d1ac-d6c5-45eb-b2b6-6b254050d3fc", "value": 19040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930104, "uuid": "e355f990-6d09-45b2-8c65-2bbb45455d8e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930104, "uuid": "0c7de970-ceda-4837-aead-728dc1360e20", "value": "87486342350d1df123eb4823aeebcac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c92367c-4544-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636892072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892072, "uuid": "e4863a3f-6cc4-4324-b501-0fa595f61a10", "comment": "Malware payload (Mirai)", "value": "4b8786c2bd21684836784a11a08a4a00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892072, "uuid": "b3d0badb-3227-4f5d-b372-81807c453f7c", "comment": "Malware payload (Mirai)", "value": "d7ced17231efbf9c4d3c03519e9d7c20793996202b4b4aa3702bfb94ad522524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892072, "uuid": "666fab93-5148-425e-89b2-ed9412a429de", "comment": "Malware payload (Mirai)", "value": "2e1d253e78cfd13f9a5113305566b7c0279e9762", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892072, "uuid": "364d5bc0-58d5-4dca-af04-1383376fd5f0", "comment": "Malware payload (Mirai)", "value": "39fd1fb4b9ec718ab7fd7243c95c44cd44853bc31238cda9520a6fb81d86169d21603f4ceb39e7919131a9386244b425", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892072, "uuid": "bfcfd830-3fd9-497b-949e-b221e7bc858f", "value": "T18273814A6FA14FF7E8ABEC374AE91705288C551A25AC7F79B970C808F24B24F15D3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892072, "uuid": "a8ef8297-5fa8-499f-a0d8-10b4589870eb", "value": "1536:Z/9YWltD8CiwwxIhP10cCP7YgQDTZsuxqCn:1ltD8CVIGDTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636892072, "uuid": "57bdd0b8-bb86-4150-9c8f-7cd89b28a3e6", "value": 76640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636892072, "uuid": "6bd927e4-af75-41ee-b277-f9a2ccaf2955", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892072, "uuid": "273f262b-8367-4ef1-81cc-644b606316f8", "value": "4b8786c2bd21684836784a11a08a4a00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54aaa7b-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1636874584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874584, "uuid": "970d334f-c364-41fe-8655-77795c108f21", "comment": "Malware payload (TrickBot)", "value": "9abd93765b72a724c25d6c9a2b6c0d1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874584, "uuid": "e9ad69ff-a5a4-42b6-8688-f96b7bac9d4e", "comment": "Malware payload (TrickBot)", "value": "d8a022ddcef8459ab71cdc33f3474779df507a25ca4d179279be78424c69c813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874584, "uuid": "3357eace-6b3e-4a45-94ab-da6b09a53418", "comment": "Malware payload (TrickBot)", "value": "2993c6b4ed199302a7d98dba08a7c07e1506d159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874584, "uuid": "e794f0c1-9263-422d-969b-013daa40d802", "comment": "Malware payload (TrickBot)", "value": "b989436ceb832066d20931cfa895e5e8b2ba1c5ece9e336456f851470ffee9efe69ea6e3d90dfa381530d2a36b05fe0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874584, "uuid": "a7c37839-23d1-4a0e-ad5b-7175b530912e", "value": "T11BF4E0A236E48076E5B601320EB67B3A96FBEC644F79FBC31390974D5E310D1493936A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874584, "uuid": "16c98009-0152-4371-a8f7-8ab15f12b5e7", "value": "b1583b0de68b5707a7d41293f45591df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874584, "uuid": "0427fb32-f928-4e9f-8413-feaf3019156c", "value": "6144:9/Z8DzzV0Xl2D3cowVtWGC0m9LYLr5XY1HUoG/D4gHpb9K8LHnhEoXYzo:QzzV0Xl2TGCLOR2fFgJb9FhTXYzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874584, "uuid": "2e6e8513-d9b2-4c71-bf93-6c82df7f1d34", "value": 729151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874584, "uuid": "66240b69-eaa4-4e6b-8ff1-0b2b34381e1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874584, "uuid": "e4178a38-2c39-48dc-a76c-f65d0d4ef53f", "value": "9abd93765b72a724c25d6c9a2b6c0d1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ec3204-4541-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636890900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890900, "uuid": "c5587c2e-bc61-47da-9c31-4a87b0070ac7", "comment": "Malware payload (Mirai)", "value": "abeea91a40ca80d46d3d740ba9802059", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890900, "uuid": "8952cbbe-9066-439a-924c-f3ce5856b770", "comment": "Malware payload (Mirai)", "value": "d96c699b5ffeb72b0e539bfd2940e343617ca702bfb73f659b2cabafe8b3a84a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890900, "uuid": "bc05eed3-a904-4648-9654-54d4be87ba2b", "comment": "Malware payload (Mirai)", "value": "da78d07589b7f3d98126bbd25159a2d4c2451657", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890900, "uuid": "99dbff6d-e090-4829-8397-a77dbb16dd2d", "comment": "Malware payload (Mirai)", "value": "08f07ae974df40104617537639233ac584f0c109d0657d60d37765891101467e16793ffed5d5b8b56575bb71628e476e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890900, "uuid": "de853fd1-ce69-4177-880e-a5c7ff682203", "value": "T1D3B35B22BD660827C1D4617E22E74321F1F7534E60BC9B1A7EA30D4DAF24B50367B7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890900, "uuid": "c085505f-1d9c-445c-a542-16280ddbac5f", "value": "1536:RfzzU4LJ7k8kZafsvq6YOZwuDwNO2dLBB5JteN5xtGXphaErG:RrQ4oAsy6vwucN3J5JwfmphaeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636890900, "uuid": "6c815fda-ebc4-465e-9ca5-7ef02e5150f1", "value": 110872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636890900, "uuid": "821a1207-546f-44d5-9127-f11dc4a5265d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890900, "uuid": "5df03152-fa1c-4e4e-911e-368e149717a3", "value": "abeea91a40ca80d46d3d740ba9802059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64efe91b-453a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636887764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636887764, "uuid": "cc86f1cb-0e90-45b4-90fd-3041a030a94d", "comment": "Malware payload (RaccoonStealer)", "value": "0f9d1f2e3aaad601bb95a039b0aedcfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636887764, "uuid": "bca9e9b4-11fd-4cdf-a68a-e41456915df8", "comment": "Malware payload (RaccoonStealer)", "value": "db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636887764, "uuid": "14e24e3d-d535-431b-9ef0-72967a5d939b", "comment": "Malware payload (RaccoonStealer)", "value": "141e7b7b2a4a31b2a7e599b2d2064239fcc66707", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636887764, "uuid": "7918e83b-3bcf-4567-b58e-1592b59a6bac", "comment": "Malware payload (RaccoonStealer)", "value": "2f8480345872a2f6faba9df2e291b924e736e17fdc0b7c2eefae854f54685d8c9f9926af74892ad17b95ebeae1ffc831", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636887764, "uuid": "d972288e-7142-4db8-a453-3337c5f84101", "value": "T16CC4D000B6B0C035F5B266F94DB69268A43FBDA1AB3591CF61D536EE4634AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636887764, "uuid": "f2bd3be7-343a-43ff-9591-4459105b6188", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636887764, "uuid": "b57a7442-05e1-43df-9f95-749353710160", "value": "12288:yYwM38J59NGoCVB/UWhqNjuW0FwI02A9LFbo277FWcmJXkzsrmviikJW:yY138J5yNVB7LVwI0Hu2mm/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636887764, "uuid": "812d7427-12be-4d72-9f87-697ec21b1ade", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636887764, "uuid": "c3f87971-f831-4c19-8b24-a2eb587ef649", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636887764, "uuid": "d5a8b667-29fe-4fd8-b7f3-75dec86e1728", "value": "0f9d1f2e3aaad601bb95a039b0aedcfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55f7a8c-44e0-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636849271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849271, "uuid": "33c2f5a7-969a-496f-8a7b-9b3b87e01a33", "comment": "Malware payload (RaccoonStealer)", "value": "fc08c3720e1aed0da2bffa4e1015928b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849271, "uuid": "c0899525-7090-4f57-bfa6-78501a9d6ce7", "comment": "Malware payload (RaccoonStealer)", "value": "dd342468231a6e7e5cd08f7003da4185736c258be4cd0ecd61ff119d664c6b9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849271, "uuid": "101dc5d3-0f8b-43d2-a00c-98bf6d38e45b", "comment": "Malware payload (RaccoonStealer)", "value": "58d3d5e3de9be2525c937e4b4a9989bc08a6f2af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849271, "uuid": "ae7e6147-c622-4cd4-b510-4ed8d1ff0ba6", "comment": "Malware payload (RaccoonStealer)", "value": "685398790debb18ecc406aeec75972ae8f8ed124dcdc26e8370b7afcd51a7116abd63fc3b6198c0a344d6345af5a9763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849271, "uuid": "b16a5b15-0820-41b1-a171-277af7bbd9d5", "value": "T135C4D000AAA1C035F1B75AF84A759279F93E7E91AB3491CF22C52AE947347E1EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849271, "uuid": "0d5beb40-b7b8-4676-b54d-90695248853c", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849271, "uuid": "f476b123-f6e8-47aa-b747-82f7fedde07f", "value": "12288:/nw3mhrbkM39uxQBfHRR9arF5M+e++rm7RmiPOox:vhP39uxEHgrFy+silx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636849271, "uuid": "4dd49520-3fb9-4d91-a19c-a7a8cdb39a75", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636849271, "uuid": "7b0faea3-8676-4051-bc79-14c5acdff8bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849271, "uuid": "61d39452-0fe6-4b22-bafd-535ca21edf0c", "value": "fc08c3720e1aed0da2bffa4e1015928b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6affe883-44e9-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1636852985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852985, "uuid": "6289a5e3-f517-4bce-bdc9-2a7e6a971240", "comment": "Malware payload (GCleaner)", "value": "95ddbe7ee7396998e2f85974c7c969cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852985, "uuid": "55603407-4472-468c-a40b-4db175833ffa", "comment": "Malware payload (GCleaner)", "value": "dd6869517005d2a602fa1e6f1eeb8c6a31958c3fd08c64cf316c570f4c5a187c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852985, "uuid": "28e93b4f-071a-46cf-b886-70cfd5fae4bf", "comment": "Malware payload (GCleaner)", "value": "ec9374775aa272e8acba567a093b5109953cf674", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852985, "uuid": "21d4a8a8-3da3-46a0-b672-0246170623a7", "comment": "Malware payload (GCleaner)", "value": "af712b4cd9d9a22b1ebb5d616d47dd404a8475bd757cb15859e55b7c6e25201f4831f33ba6446b45f5478f7822afd799", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852985, "uuid": "b632e8ed-a5e1-4e91-a2cc-b7ee19c081f9", "value": "T1D99600ED09FB0528A2B9DE255BF59A37C2B7B813EE02D55D410472208EB33E0D5A1B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852985, "uuid": "c4e4f0d4-1ed0-408c-b705-dd323e109ea6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852985, "uuid": "7ba0d6d8-24a3-4cb9-a121-2eda234fc47e", "value": "196608:vokJx3W551gWxR3JD+K/qOtBZNOxV49/g/Ov1tViaIzuRNnC:Zvm551gWxjqKCO3rO4iOzysC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636852985, "uuid": "d34a0e3c-d1eb-40eb-8555-72c7d287eec3", "value": 9190400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636852985, "uuid": "c5c767c0-c79a-4aa8-b755-fbd5dd6d7324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852985, "uuid": "d758df49-44b6-4303-90b5-85810da5a30c", "value": "95ddbe7ee7396998e2f85974c7c969cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914d7c78-44e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636852190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852190, "uuid": "2f600941-d7c2-43fd-9676-fabb7a94f693", "comment": "Malware payload (Mirai)", "value": "d4726dcbd3c44b56be833ba112218a5d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852190, "uuid": "f9f14ab9-8880-40d1-a279-6e826f949153", "comment": "Malware payload (Mirai)", "value": "de94a2f04fb6c9f0e76ec8a6e7f56bc762818419476336df56670ef0d653f6b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852190, "uuid": "723427c4-785e-4555-b320-c11c110ee173", "comment": "Malware payload (Mirai)", "value": "d2c41bf4d839a50ef67d36baa9d271fba471f53f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852190, "uuid": "bb1ea38e-8bc0-474f-9b35-9a88186ab8d3", "comment": "Malware payload (Mirai)", "value": "a6d36969ba4e0c19d121cecd4cd86652a64a048473841f95765c6b689e320683ba54139d49512bdacdc8c9db88ddbd75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852190, "uuid": "a0c341ad-784e-47b2-982f-e7551e2ac744", "value": "T1A1730785BD82AE16C6C5437BFA0E038D3325A398E3ED7213DD156F11B7CA92B0E6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852190, "uuid": "6c90b28d-e433-4528-82f1-6a440acc5ae8", "value": "1536:4YT1nYLS2xgCwgjxmIDasSgxgz9veMe39zRkBVwvDApPOkqGBc8wbZns:4QnYLwgkI3Sfz9veTdYVwvI2vGXwbZns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636852190, "uuid": "edf1c5b0-d7e8-451a-929f-5ce2befb4ccd", "value": 79460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636852190, "uuid": "7234a141-ad29-43c4-8a64-ee47da908942", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852190, "uuid": "209c7e51-d171-4b86-96a0-aab3f670b8c5", "value": "arm5-20211114-0109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbb7406-451e-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636875642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875642, "uuid": "8d6091b2-c772-454b-a0b7-dcce6f3d7db5", "comment": "Malware payload (Smoke Loader)", "value": "cb16bdf4bcb9721a9acb97c4cd3e511d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875642, "uuid": "c6d04b6e-a735-44d8-9f0f-0a4d91cbabee", "comment": "Malware payload (Smoke Loader)", "value": "dee95532f15e2ec01276b45a5cec1eddc591ea64ce8104addaab693af4e0651e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875642, "uuid": "be333705-e5f6-42c6-bf88-23be3221a101", "comment": "Malware payload (Smoke Loader)", "value": "6e550e426d193f012c9ac7f6f2bbd0423e896025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875642, "uuid": "d566659a-af02-4b31-bb75-51b0ec65a5dc", "comment": "Malware payload (Smoke Loader)", "value": "a9874b4fd9a6611687b6cbd9b168f49bc0c5e55df079ec0abdbdbefeed8d2796bb67ecacff7c12b169a0b0f0d6925f2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875642, "uuid": "de122a9f-10d5-494b-9257-8629b203d5c3", "value": "T121F3AD00BFE9C835E1A62A3064748BAD1B3BBD723574450B3B55262E9E733D09A7534F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875642, "uuid": "7c4f2c44-1cfc-448f-8b29-c5990b875ebc", "value": "b2271179048a9a8fc6be7cfe8a9583d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875642, "uuid": "c53551d0-147f-45eb-be0e-5e0a53154604", "value": "3072:X72BgPRRoVUn+D1zeKJD8kbQnyCn4CngZQMKpZa9uD6Vdyhk9:7PRRoVU+DNJPbQfngZ2wVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875642, "uuid": "429f5f09-5c01-4751-9c47-282105921e53", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875642, "uuid": "5e1b9799-3e8f-46aa-8678-25dd87ef304f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875642, "uuid": "39790d5e-e5ad-4b9f-873e-94057d20c9f7", "value": "cb16bdf4bcb9721a9acb97c4cd3e511d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985feb3f-459e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636930800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930800, "uuid": "416bad53-834e-4716-8330-0dc8f0227053", "comment": "Malware payload", "value": "1beeac80d961747dc6c4666c11a4a606", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930800, "uuid": "043bb3eb-1e5f-453f-a8c9-b4db0a5c04fe", "comment": "Malware payload", "value": "e12272a5cf4107d5c73bfa6706e4835caa309761305b767ec5db964ecd80d6c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930800, "uuid": "51db4e50-90be-48a9-bf7f-7ce41537a67b", "comment": "Malware payload", "value": "213a81fc945633571688b217175722d70520cd85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930800, "uuid": "8254804f-9b97-4bab-81a7-9592bca40fca", "comment": "Malware payload", "value": "5506cc20e0a64865f2c811d9019a4ad4dd0596b11f7a5daf98738fdfc1fe28c7d10537e8880ac64ecbff5fb71f45b52c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930800, "uuid": "314dc29c-aacb-4b16-b931-95dbee6c7cbd", "value": "T1C4C31BB3B904EFE6F40AA67504D35B227E70BBA74F531622721739669D3B1E42827F04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930800, "uuid": "9b7c9b88-0ae6-4b2b-aadf-ee097965d28b", "value": "3072:sc3kZNjWGp8fOKfTK+feHyCtXm57VcVnJmm2fckv2QcJrNO:sfWrfOKfTyyCpK7OVnJmm2fckv2QcJrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930800, "uuid": "c719ccf5-33c4-4a10-b8ab-03cbfdeabae1", "value": 122493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930800, "uuid": "07d048c6-18a5-448b-a117-203174afdddc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930800, "uuid": "472f2613-6484-47c2-bacb-2496a9d5a40b", "value": "1beeac80d961747dc6c4666c11a4a606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca34fbb-4592-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636925519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636925519, "uuid": "73f99bb0-dc72-4a5b-8835-549e792c54a7", "comment": "Malware payload", "value": "1f11aa133eace62a55f650aa164c9c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636925519, "uuid": "aa5c4eb3-a6b0-4061-9f01-58dce1a02d44", "comment": "Malware payload", "value": "e1534afbd84b6c29ec61833d51ab9818fe187a9286cf86d5efaa93e76fb2c855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636925519, "uuid": "66501f7b-c8ca-49b7-a058-e06e34d5df4d", "comment": "Malware payload", "value": "659d296d547fd0b1c53020f098db43bddfd5bad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636925519, "uuid": "df05d170-d84d-4996-bdd2-fb1b864260a1", "comment": "Malware payload", "value": "4943d7a9c64fd9a1854927ebbca32f0dd3fc8828cbb62c84bce04ad6942f97b21cc1bb24ed6149ae842d14bcda40cea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636925519, "uuid": "352a68cb-98bf-4ee0-b040-6b373000aece", "value": "T1EFF38D2235E0C875E463493749B8CA314F39FD6617768AC737C81E4F7A603D0AA35BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636925519, "uuid": "8653f7f7-d909-45db-a4b8-446479073e22", "value": "56d90aae5b6fc24ad877f9c3b939f784", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636925519, "uuid": "8b40d851-3911-4b4d-a471-d0b129a7cae4", "value": "1536:nUdsobve5kgyozu1QuUR+Qs8jcdSc8mE5gciW4qZgpJCKlJJ/J6I5k72yq:U85MLUR+1MF5oWf0lJD6I5kayq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636925519, "uuid": "0f76a067-e09d-4cd7-a89f-422c4c87e0b4", "value": 158232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636925519, "uuid": "2a5ecb0c-2c62-404b-a51e-67cf264f7da4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636925519, "uuid": "c3eb97af-d08e-4fa7-b924-747ea72aeb0c", "value": "812E6A02214AC3CB60E429.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e213b6fe-4549-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636894416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894416, "uuid": "2dbbbb2e-53e8-4c33-b6c0-bf36edc97356", "comment": "Malware payload (Mirai)", "value": "de0626d4a9bba1d0842be1af208cffdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894416, "uuid": "98e423f9-5288-4f72-b579-646e6c79fad7", "comment": "Malware payload (Mirai)", "value": "e1e78c2e70a80c0b90c61d5098386803011ae3a324b4bc969c9beb8ce15c8be8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894416, "uuid": "d99356c6-f9c3-4724-8bd2-daf1e0caa3c1", "comment": "Malware payload (Mirai)", "value": "6405db7953bcdd9216c10755ff79b3d6836d8c5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894416, "uuid": "319c812c-9980-4314-9392-87b00dda647d", "comment": "Malware payload (Mirai)", "value": "2b515974113336af474d63bd62d0b6ecec53d2510f4e3d5744557475af0a4ad7ffead7bbf0ff64173f8ccf07ab6f5f2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894416, "uuid": "75202e01-9b74-4e3e-9c20-acd66f215bbb", "value": "T17CB2D12092CA6430D6E009FEFC8FD20CE3662EE8F8DE7174A6090624E5F50C626FD957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894416, "uuid": "c212911a-4c01-4ee7-bfb0-7d1e359052c5", "value": "384:X2NxFm7WXgw0juxBP8aWs6GKxJ4/vbs+/lUXWX1VBNK0YhvZZQZP+TIimdGU5Ei:qxkqcCvyyXbs+/OGX15KNxZMP+ci3U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636894416, "uuid": "56bbc64d-bce4-46a7-8e30-afffd5a9e4c8", "value": 25024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636894416, "uuid": "1e62d20f-adea-4868-b290-979b80f474c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894416, "uuid": "446716d2-affe-4dce-a1c0-22114c326048", "value": "de0626d4a9bba1d0842be1af208cffdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d005259-4552-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636898086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898086, "uuid": "96301f1e-32b9-4e15-bb2b-8a5bec47b120", "comment": "Malware payload", "value": "8a3683404c4adced356a67eb26728631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898086, "uuid": "6cb7e0c1-b54d-4e68-a1fe-1145da4b2a13", "comment": "Malware payload", "value": "e2f0cb187cef5f44bd1af3d2b5b6596765c581df2fab62478bf82410b339993e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898086, "uuid": "24127986-9496-41d5-9075-58ccee65b7e1", "comment": "Malware payload", "value": "6b6c2f7a2ac59875ac19d966516e486a9e15bcbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898086, "uuid": "1d0ebe9c-22ce-4c8e-ba3e-6798a9605559", "comment": "Malware payload", "value": "a5b38cf79c3b1fb8d76e3adff1f442170e2f134fe587272d1a965af9ec5b6e504837d87f54f26f7b215b50cea4437cfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898086, "uuid": "c71ca3dd-faf7-4d1f-b7d6-6edc72588b5f", "value": "T1CB24A4BD749ADC82C52E9F6F024170145222A4CB158BF36772F91AD64FAEBE019817CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898086, "uuid": "b68fa55a-b907-439e-8e20-d777e9ed919b", "value": "3072:VxFabnd0IiAg1JxxXK3WJZHls90Bd2uXuZJqopcDPi4d4a+EaiPKy2SfipCSV5YO:VxFKd0RZHGyBMuXzoof4PgKybfIpjYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636898086, "uuid": "fe859f6f-c04a-4e6a-861e-cced15ff8308", "value": 225547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636898086, "uuid": "2dacaecb-12ca-40b2-9ddc-9366cca1af8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898086, "uuid": "db1d0247-3950-492e-b411-7046f9b4142e", "value": "8a3683404c4adced356a67eb26728631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452f70e4-4566-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636906609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906609, "uuid": "20cfc7df-5ddd-41a4-a892-1efcaecf1725", "comment": "Malware payload (Mirai)", "value": "62290ddc2def0a2ec6dd9794dc63bf44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906609, "uuid": "b1eb614e-ecdc-4e62-a390-e453adc3ff9e", "comment": "Malware payload (Mirai)", "value": "e40040bbbcac09e280912a142e8da4fd66bab73b3241ad387686577c156886e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906609, "uuid": "3ca0919c-3815-4640-b557-77eb2a0d3ba5", "comment": "Malware payload (Mirai)", "value": "f3a506fdf058d7cc13978c41d0ff34fd9db3360b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636906609, "uuid": "dea1f12f-1770-4a6e-bdc3-35d48e1273b7", "comment": "Malware payload (Mirai)", "value": "5b7e7ead61835c0690ee4e663c788d4e2176df358789ff22919b50c017590873a779ab22d52c367dd86fb248a69ba4f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906609, "uuid": "db064515-1eb2-4b83-a2af-738047db73f4", "value": "T1C1D2E18191565AB2C4B61178F48B824F521F7C3890E134BE6A641DCDBF8AB5803F7C87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906609, "uuid": "e1f6c1a2-ba8c-4d3c-b7ad-3b022ddd0660", "value": "768:NCusHfRavj6BIrLkTeV90a9+zcv/kXSIOQtNuq3UIQX:CRwaOsc9EzcnODtNBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636906609, "uuid": "d6b062f0-ba02-45a8-b346-a66ae383fa27", "value": 29480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636906609, "uuid": "3172cb51-5ce5-47d4-b2ef-e3534b138120", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636906609, "uuid": "a42e5e66-78e4-4c63-b038-ddfce411388f", "value": "62290ddc2def0a2ec6dd9794dc63bf44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74711eb0-451b-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1636874476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874476, "uuid": "103f2fd4-7d45-4835-94b0-724d4c29b49a", "comment": "Malware payload (CoinMiner)", "value": "3762bab8e1146f8ae6abd90d97b30cb9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874476, "uuid": "e0b9be65-80f4-404a-80d9-18cdd224fc80", "comment": "Malware payload (CoinMiner)", "value": "e44155eacd7a58cad14121cc9a9ad2f4146cf05da8f71b0751d7ff25d3283c97", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874476, "uuid": "b7b096e1-7999-4c09-a8ed-b69ba6a885db", "comment": "Malware payload (CoinMiner)", "value": "ed05a5f661f56018cfd5820fda10400c5ed8ca21", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874476, "uuid": "0f6d7f7b-054c-4866-a740-28a8c14b239f", "comment": "Malware payload (CoinMiner)", "value": "2075a65b7ecb7868e8e505aa59cc31733d08a0f64695e51f788a5cc9bf115d7e821f006e7eec6ab7e763cfdbc1bbab42", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874476, "uuid": "6ef7ccac-9114-42e1-a9df-83a8fbc0d823", "value": "T18A95331F9DA6C295D39EEFF6D94F2033AF7603910376932232DC5E8C89429552F682E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874476, "uuid": "03851517-c892-43bf-8563-40f98beb6870", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874476, "uuid": "fb024c56-7c6a-4117-8739-a49a8a536420", "value": "49152:83HLCEs3CYNX0NXbx5YZFhttqg7aBu0heHex04Py:omEcMXtyFhtd7D0mR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874476, "uuid": "a15b1001-5fee-4fee-984e-bdd004216b36", "value": 2041344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874476, "uuid": "267ef043-8ca6-4d04-a4db-284baa1ed7ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874476, "uuid": "5f16090c-a006-4e7e-add5-fd4a8a7e56f0", "value": "3762bab8e1146f8ae6abd90d97b30cb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18da3f41-451e-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636875610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875610, "uuid": "af286d44-fbda-40e9-98c1-8db0d191db00", "comment": "Malware payload (Smoke Loader)", "value": "dab4bd6e7eb352208f12391b84e9bf6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875610, "uuid": "a280c4d2-a544-4601-96a1-3487b3111dd4", "comment": "Malware payload (Smoke Loader)", "value": "e4f04712d99435fd9e716a22af790ea6b58547beeb9089c71992e3f3f2ed0c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875610, "uuid": "005d41cf-cdac-4e51-8c6d-2c75b78de059", "comment": "Malware payload (Smoke Loader)", "value": "75da5ab102cbd28e212390d49891d2e853fc21f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875610, "uuid": "b704e4de-bb22-42cc-b0c9-41fc72842529", "comment": "Malware payload (Smoke Loader)", "value": "27cb862ace3a8d86dc06f810f6e7eaf66e8f9cbbdbad2715b21b4737679731c4d54608a9ea19cc0e7625209701d62309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875610, "uuid": "ecffbc0f-d5c1-4423-92c5-78229a11c579", "value": "T15F24AEC077E18875D1A23D3294618BA01627BE36E930950BF774A7AF1EB33D08676F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875610, "uuid": "1077cc5b-8673-41b4-8be5-471cfe0df1f7", "value": "cba5ab921edb2daa29ddf7f914128d13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875610, "uuid": "c7fc7cbb-8e66-4573-b648-458f0837481e", "value": "3072:S7/fRgZgIouqbiBGyd65TOIHPrZuDXlVggjcGkNIVqI7sxkgaBChMpZa9uD6VdyV:KiZgIouqwb0PHP4X7ITsq7igavwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875610, "uuid": "67c86270-c88a-454d-9459-c30396132707", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875610, "uuid": "92db6ccf-4b08-4285-99b7-25eca9b6918a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875610, "uuid": "e2470799-e172-4948-87fb-e65b5140e701", "value": "dab4bd6e7eb352208f12391b84e9bf6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cb3de9-4554-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636898775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898775, "uuid": "e043e782-ff6a-4aed-856d-1cf9e0479dce", "comment": "Malware payload (Mirai)", "value": "0b5c6cd019e57d1ba7890c8bc3d3075f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898775, "uuid": "b9e11a34-6c88-4cd9-9b79-30901fdaafe1", "comment": "Malware payload (Mirai)", "value": "e685c009e85994ce8544d7901d92565191ee3600ed7e49b86d4375185cd45ac4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898775, "uuid": "9dcbb5ae-3ff7-4e7d-a804-687090f102ab", "comment": "Malware payload (Mirai)", "value": "7e913745a0d7e77c7116df38599a951227a724e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898775, "uuid": "2bcac7b1-961e-4836-a29c-f905989d5585", "comment": "Malware payload (Mirai)", "value": "5a0f652568d71ea9bf30d6d57b18ad9e139bd2acf4e67160e41dce7d255f9dfdeffc4e3587acb8fa1ebf0ada303f7bdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898775, "uuid": "53631e6e-9eb3-45f0-b3a2-768ff8e817ad", "value": "T173C2E184FF6C8F6BD8CC4636434C9BD9963488D04F4E551AAC4ADE8A13E70582636ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898775, "uuid": "d144159e-48a6-42fb-a7fa-bd95322f61e1", "value": "768:aXgv6OnIPU7WXhmKzgZJAsVAeJX0YnO8Erq:awvhn7WRNaHVA41nOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636898775, "uuid": "dbaa0963-3b19-45d4-8b71-e22b7df52563", "value": 26464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636898775, "uuid": "3230a7f9-1de2-40ff-88ea-b70f3db794c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898775, "uuid": "c33279d8-eb37-4df0-b0f3-5b30fd211e87", "value": "SecuriteInfo.com.Linux.Mirai.793.18886.3430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd919a31-4550-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1636897362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897362, "uuid": "8deedde8-c416-4046-9c09-56a52020d8c9", "comment": "Malware payload (DanaBot)", "value": "531264ffbb9cddc429a1bd98853d1c7b", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897362, "uuid": "db9b2388-e8d7-400e-a5d7-55e8afa089ea", "comment": "Malware payload (DanaBot)", "value": "e7c9951f26973c3915ffadced059e629390c2bb55b247e2a1a95effbd7d29204", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897362, "uuid": "ce2542c0-8c44-4a9d-baad-ff153a43b92e", "comment": "Malware payload (DanaBot)", "value": "05a539bc52a103e4a11a402975ecb80c4c6a9972", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897362, "uuid": "5e6fe79f-dc35-4f77-be37-6d0588eb5db4", "comment": "Malware payload (DanaBot)", "value": "96721b3b2227a98ca42ac7447a3b85b0effe0674fe627d0c7e8daa5a26b22b6c323ce600a20e231d0d2df0400c1f2284", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "main", "colour": "#6EE951", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897362, "uuid": "0deb6415-862f-458c-8b6e-ac3555fd5289", "value": "T1A7F6F122F240803FD0B71A36557697F46A3FBB201B19C89B67E44948CF75AC07A6739B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897362, "uuid": "bf065325-1fce-408a-aa29-853d0310019b", "value": "908afa7baa08116e817d0ade28b27ef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897362, "uuid": "d18d6b20-7342-47cd-909a-dde152f3f28c", "value": "393216:4WsuCYU9hq6Hn6bxPhb4w1trlHGnDdxN5BN:4x3YU9hbwxZfIdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897362, "uuid": "44065f00-096c-4ac3-a4c1-cfba01a4d19f", "value": 15492608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897362, "uuid": "ed05fc5b-6627-45b1-89cc-ec60bd4ec3a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897362, "uuid": "9c84bf40-739a-4f5c-a1b1-ecef4380ca53", "value": "e7c9951f26973c3915ffadced059e629390c2bb55b247e2a1a95effbd7d29204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84616621-454a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636894689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894689, "uuid": "2b23ec31-6191-49b6-a589-f90642b732e3", "comment": "Malware payload (Mirai)", "value": "0805ea25855f1db7c164a1c81b77ec46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894689, "uuid": "435ac116-9586-400e-8ec0-7e72bbd686b4", "comment": "Malware payload (Mirai)", "value": "e80ece7d4fbe58c85f0975b4cb5be7db71dd39b8fc93d3493b29d98c24f07276", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894689, "uuid": "07f833d9-db4e-4161-85f0-3d3fc3202baa", "comment": "Malware payload (Mirai)", "value": "9d0d7f92196ea903a2c5bf2ff216ac87156ad026", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636894689, "uuid": "10d25b9c-25d1-4691-af23-e47b43c750ec", "comment": "Malware payload (Mirai)", "value": "235f611bcdb241915c3e3499c1ce651d6df15b8e94dff87f850773e21675528b6e17c468934008191871179491138f7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894689, "uuid": "fec46353-c4da-45b8-becf-b9c58a0a354e", "value": "T182B2D064D1DC7EA0F6F72AB1F949B5D53BF0DB9939A6CAC02B846E1150122B1231B4E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894689, "uuid": "3731544f-6127-48ba-a0e9-91acaa282488", "value": "384:7/A0AeimAzNCdvw1PwIW2MnYgbT+X8uh56TMUv8hZJHeQWyQ9aDkjgM4uVcqgw0z:7LApCdvwJo3qtsEXJ+F9aI74uVcqgw0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636894689, "uuid": "9bb548ca-7c7c-40c0-b6db-a6ccd447a468", "value": 24416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636894689, "uuid": "a3b27e98-6e91-43d2-b787-5072e879ae1d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636894689, "uuid": "7ec02fc6-475b-42ec-a943-416dce9d49c1", "value": "0805ea25855f1db7c164a1c81b77ec46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd922a8-454e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636896500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896500, "uuid": "0015df3e-3578-4054-ac89-e43530c1290a", "comment": "Malware payload", "value": "0eed73c62d0e4786e27e66a1cbedc15a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896500, "uuid": "eb96388a-e21c-4b83-a419-25cbb292dd1a", "comment": "Malware payload", "value": "e883e691eddd4d6c04e9a79998179cc27f99146e30f648f6ab71e2bd84426366", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896500, "uuid": "e2c153d6-7d23-4427-baa3-ea65e29d0217", "comment": "Malware payload", "value": "8a46573fa399d1218dea5cc3e7f0864a82a0fbb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896500, "uuid": "92c1f9e4-87fc-4add-a649-df38fa156d12", "comment": "Malware payload", "value": "096431c48b2c05c54a0af72c9b707d5b8898b115f3a8afeb21be38fdbf3b644cab2c24ce7a2c59aa17232f07689b8137", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896500, "uuid": "261b5d4a-f8cc-4e47-b2c3-ec6dc00f4682", "value": "T192A522E6F6252CB3EB662473C0DF1F6EED5A049156A2693EE4104B4821732D2EF05F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896500, "uuid": "65744ed5-6564-4499-add2-799ec2014694", "value": "950750ffdb371ba57143c05704022343", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896500, "uuid": "2f2a454b-95a1-4c3f-8ee7-39590cbd62f5", "value": "49152:Bgjs5iGf9aAgLSCbJG4ubg+rwsUtVzDru5nVN2tXmA+jwSTWE:roxHW8UnVctXmAROf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636896500, "uuid": "3c82a8c5-cf89-4e73-861f-2aadb7771aa8", "value": 2212864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636896500, "uuid": "6af58712-8956-440d-b6cc-3669dda01a13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896500, "uuid": "a1ea8fef-6691-4eb3-877d-f56617d9dd57", "value": "0eed73c62d0e4786e27e66a1cbedc15a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c8d85a-44f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636858934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858934, "uuid": "ebf68d13-cf22-49bb-b292-2e8752c03c22", "comment": "Malware payload (Mirai)", "value": "e31c14f230db19633f7b2c848caef65b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858934, "uuid": "3c21c766-f393-4e67-a77c-115beb55562c", "comment": "Malware payload (Mirai)", "value": "e8cbf8f8bd646a6648d95a0dbd798982b6f43a1d3131a3029bdab7750cbf2444", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858934, "uuid": "c648e617-6b58-4690-afcc-c3b3162ef9c0", "comment": "Malware payload (Mirai)", "value": "dba436942ecf877695baebc7611c9cb5dabab875", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858934, "uuid": "c49cc5e1-03ed-42c2-98ee-10cfaf320bfb", "comment": "Malware payload (Mirai)", "value": "f26825e609fac64941d45abcb91167bdb93a9d47796ee72246c3cab3596f39b6eb88401ac0c51037da762a3acafd4314", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858934, "uuid": "9353305d-e2a5-4f83-b468-7cca4fe09d75", "value": "T167E35CD2BC809F3EF8059AB646170A01B122E3B515931713F2533D67EFE90996D2BEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858934, "uuid": "c79f78a8-ba4b-46cf-b4ec-3102ebc11a71", "value": "3072:uAbECHKdmDr1+y2znIt0KOAH12PAYpMcjwD8yKwBcDPBvMG:u548fzIwAV2PHpM6yKhP9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858934, "uuid": "4c2b5ab4-b51d-4022-a62a-673bcd4a1e08", "value": 143728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858934, "uuid": "729766ef-881a-4ff8-9bfb-d94f3199a489", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858934, "uuid": "0e7d4804-8df8-4b42-ad20-5adc096253ed", "value": "e31c14f230db19633f7b2c848caef65b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92291af6-44e8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636852621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852621, "uuid": "da5faa5d-3cb4-421b-8565-1d7fa829dd9a", "comment": "Malware payload (AgentTesla)", "value": "11f5171e7b95c4adcd589ff50d552a9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852621, "uuid": "589f1105-0ffc-4387-938c-05e5bbc633f0", "comment": "Malware payload (AgentTesla)", "value": "ea3ed08696eedadc8878332e3c2e2eeb69b54bdffd12165c8c1b60713cefd849", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852621, "uuid": "4c464f85-cb1d-4f9b-ba23-6d9ae83c85cf", "comment": "Malware payload (AgentTesla)", "value": "1d4621f3e9d39496c0dfb227e458367f88bafb8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852621, "uuid": "cfd0e209-70f8-451f-8e6c-4e6cc09f658c", "comment": "Malware payload (AgentTesla)", "value": "f4fe0a90ff99de0b99a622be04f036be54347a26cac381f8d8043373c9f2bce19d7e270f0b4aa597c50dc96ef8d0bdb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852621, "uuid": "9a0fc2ef-2223-4cc0-87d5-45125d1c64cd", "value": "T189841228775C0F21D478AFFAA7558A400BF9A86E0583F77E2CD542ED0665FA01390BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852621, "uuid": "82b69067-01ad-481b-b448-5025dd168c3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852621, "uuid": "3254e375-9a44-43a1-88fe-b0170884e832", "value": "12288:m92iNC1rmlrcHHvsO8AncwJyXle+mrMYZAT:m91Q5mSHkOJncSEUNZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636852621, "uuid": "d165af11-4b32-4afb-b503-55b2a04c7b1d", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636852621, "uuid": "d9b59dd0-5bf5-4029-8bba-ec11e19b79a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852621, "uuid": "9e101241-9dfb-4587-a46b-852016062873", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd4f860-4517-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636872879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872879, "uuid": "b2d3c08a-55b5-4aff-9f5f-5482ebbef4a1", "comment": "Malware payload", "value": "69d92d9eee0f985652d9a8afdfaf3768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872879, "uuid": "8137b0e8-bebb-4de2-aea6-aad7dba9f802", "comment": "Malware payload", "value": "eb82ace4891074a9c78d6a73f08e2cde43f7db5cc8eb1aab442337210cb411a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872879, "uuid": "84538c6f-2182-4670-8ff8-be1c7654338a", "comment": "Malware payload", "value": "afede92bba9584f02c0626cee9efd4f6fd7b97c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872879, "uuid": "8c3dba13-958c-4eac-996e-0a88bd2ed600", "comment": "Malware payload", "value": "01e756613357b86866d197cff14106092a5493dad6b2dcca39ae2f6f1c6615c0345690e3186d549274fc0490da04d175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872879, "uuid": "d5cf383a-8dcc-4ab4-b055-4c42a9c7630a", "value": "T1AD7612127D49F71CF0A23A3399CB6E5547AFBEF16B3389861E4D96411A532023E33B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872879, "uuid": "7fc844a6-1a09-4698-a062-07349c2759ad", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872879, "uuid": "11bd1eff-7630-47cc-aa36-667ac198e283", "value": "98304:1+QezhQupzsb+sX1ZvbeAyJZgh4Z0FGRABTgtse6vzovkYYpom0l9pzMpqXZ31RQ:1GhQW4CsXDjDyfGZkJMqFKErRVNKNkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636872879, "uuid": "6a767c6a-2575-494f-85b9-253f61237b39", "value": 7191552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636872879, "uuid": "1a8b79aa-f4ff-4c71-8082-ca759e28c815", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872879, "uuid": "5647f8da-d0aa-47e8-91c9-664cdce92bbc", "value": "II6d3u6BssFXwheN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9c9449-44e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636852186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852186, "uuid": "19422451-715e-4521-a676-2a9ccda3d969", "comment": "Malware payload (Mirai)", "value": "33916266529224ccb9ffb50c45446f5b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852186, "uuid": "5f76d7ac-7a22-41d3-b138-8e69557064ff", "comment": "Malware payload (Mirai)", "value": "ec67fbfd0a27f8556a2fac282f661b42cbf5c310e6655291d12e8626377e0795", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852186, "uuid": "b4fb8142-8d39-4ab4-9fff-d4ad07f9458c", "comment": "Malware payload (Mirai)", "value": "12786c09e4a363ca96a555037245aee71650140e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636852186, "uuid": "aaeec7fa-c187-4e04-98a2-d2d354be6012", "comment": "Malware payload (Mirai)", "value": "2221a598086e55ff87a90a9fbaa10d5ebf0f6c52630dae7050885e00e5ba74d7184265846f2e61b18a88348c916ec41b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852186, "uuid": "6cbcb425-585b-4169-9bf4-dd675bf8f103", "value": "T1F9A3A35E2E218F7DF76D833547B74E21F25863E726E1C544E05CEA005E6064EB82FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852186, "uuid": "0caa2417-c454-4e08-8fe7-a1f50dca924a", "value": "3072:x1ovVWqUFgXQaTwmuDv8FAbdPD2wbZnwu:x1ovV10a2uwdCwRwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636852186, "uuid": "e9f28585-b2f4-46e3-95d9-986cf3d9fbfc", "value": 105356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636852186, "uuid": "54319581-f9a8-4406-ad62-ec6d9ab5fa42", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636852186, "uuid": "79111238-9a7d-411e-aa20-65d9890f15eb", "value": "mips-20211114-0109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557673ed-45a0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636931547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931547, "uuid": "56de220a-957a-4ff8-b786-8a73c3967096", "comment": "Malware payload", "value": "326cfd142a7c052954e341d1333a48cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931547, "uuid": "516c0525-3129-4cfe-94a4-91bb2e9be27c", "comment": "Malware payload", "value": "ed03a6432ddea08e1cfc1ee1e8c8cdf04932e2f69ec2ee60cca7f11f4bf473cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931547, "uuid": "64d7cc29-5842-433f-9ecd-b2ffe98300a5", "comment": "Malware payload", "value": "09ccaba0c40981a568a6c60e09d800d072a43aba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636931547, "uuid": "1bdbc299-b0ab-49fa-902f-9d6570d70a0c", "comment": "Malware payload", "value": "32371ed13fb03e6b2bb2a8cff1a866f540b010ca12a894513430b6e2c7c65b8ae08b0dcd69fd2f626e1a5b77b11941bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931547, "uuid": "c1e80540-ac08-4636-8979-9fa7fe99a1b2", "value": "T156C3173B661C0F43C0DB5AB03C6737F58F69B9A302A71185A90B9E8053B79BD2527F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931547, "uuid": "8b9e2bdf-3ba8-44e7-b93d-34331888220b", "value": "3072:eLl4lle6pEZ+NMFnWXUmm2fckvFicJ3NO:eL8e4E0NMFWXUmm2fckvFicJ3NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636931547, "uuid": "642eadc2-448a-4408-b5a1-52af96e818c6", "value": 125344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636931547, "uuid": "cd8843de-facc-457e-95a9-fdfb9f025ba3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636931547, "uuid": "74034daa-bf70-4291-996f-31e7ca56a494", "value": "326cfd142a7c052954e341d1333a48cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f858182f-456f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636910775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636910775, "uuid": "0c27a510-0383-4a75-9387-708040d4f260", "comment": "Malware payload (RaccoonStealer)", "value": "8b975adfad08a7fc7f1edb2f5a315076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636910775, "uuid": "4ade6bb2-84a5-4a5c-a2d6-93f73457705d", "comment": "Malware payload (RaccoonStealer)", "value": "ed3468785dcb7ebfaa55ce7b8af4fffbc0e3cb1ef53dea99f96cefb6457c3c3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636910775, "uuid": "31203cee-cf5c-41a2-96b3-68217b74f052", "comment": "Malware payload (RaccoonStealer)", "value": "8169baa890aca14a5ca47c2509d7db41d16c440b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636910775, "uuid": "7b101030-a7ac-4188-9afb-b3c06572ac22", "comment": "Malware payload (RaccoonStealer)", "value": "abfe9fa3b58f643e3346a349acd38789b3fc278cf82e101482e68c0d894593ab0e77279e96bfd95da09f2008f412be5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636910775, "uuid": "1a809cda-27fa-463c-adb9-895a47057d37", "value": "T10AB4F1C172E2A53DE4953D31AD65EBA12B27BC32D170450AF774672E2EB33E08A24753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636910775, "uuid": "936e0902-b49e-4525-be43-10bf5539a48b", "value": "9510c947cc2282bdda1a9b4a47d8d006", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636910775, "uuid": "50939f23-2c43-41a6-bb92-2bbfe10bf26a", "value": "12288:bzLXPTKSnteW87AZyCLeJmGUT5p/+wB79:b3P+CteW87EyHJmPTuwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636910775, "uuid": "dcb27f45-47b8-400c-b897-7cdfefd54a9b", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636910775, "uuid": "a63971fc-91dc-4c59-a33d-569ec00d5401", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636910775, "uuid": "44f7dd70-cd12-4b30-82ea-2fa106b02a56", "value": "8b975adfad08a7fc7f1edb2f5a315076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473e0b49-459d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636930234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930234, "uuid": "3a9fdf32-0b36-400f-ac05-38af8f62c30c", "comment": "Malware payload (RedLineStealer)", "value": "2855945a6869f6118a4a0bf2c88fd40b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930234, "uuid": "0bedacd9-ad6b-45fe-93ed-166dfeeadca2", "comment": "Malware payload (RedLineStealer)", "value": "ee2105a3395dc3eb3c83f9c810ab2bb3c33eb9f688fa9702208c1ab1aa9d7f7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930234, "uuid": "a497ccf8-3546-4228-9398-cb0f704f4b24", "comment": "Malware payload (RedLineStealer)", "value": "2c26bb2eaa1f4ebc7a9dd8b00cd22388d8abde1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930234, "uuid": "a735b777-3c68-4a11-9dd7-7a0b1c66a604", "comment": "Malware payload (RedLineStealer)", "value": "4da6cf45fac40de89b6e6375b77e1aaa9a9a135938ca6dfffa6d39a057844c10839ce739f97051d785cedc3f294dd45c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930234, "uuid": "38a2f6d3-9e52-4dbf-91e7-1fad13f7cbc9", "value": "T149C533D6FA9A0E61DE67B67E31946ECC4E5483F384D43396CDFC6BC080716B6C629224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930234, "uuid": "538634e7-ed73-4249-8608-d26aea1ec940", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930234, "uuid": "abf073e0-fe08-41ad-84fa-09ff4e053573", "value": "49152:yuiW4q+PkcaiJ++UeLZJnJPf/7oe/xFQomdlPe9U2asyIVE:58tqH+xLbnFfJxNmdlPeq2afIVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930234, "uuid": "0490a65b-cebe-4f08-bb50-4ebd602371f8", "value": 2680832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930234, "uuid": "b74dc7a8-ed86-4ec3-8cd9-90c5cbfd79f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930234, "uuid": "99f05b90-2810-4979-8728-0b1456221167", "value": "SecuriteInfo.com.Trojan.PWS.Steam.21957.31003.912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f06c410-456e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636910061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636910061, "uuid": "0f12d152-bb63-449a-818d-44cb0eb4eb9d", "comment": "Malware payload", "value": "6f47050bf16f9d26b0747f7affbe569e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636910061, "uuid": "0e713a97-d2c4-4864-bb06-9beeb7d16913", "comment": "Malware payload", "value": "ee3f09c4c4331067b624be360f0ddccc472a5fba9915db0e8aa256bb22514596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636910061, "uuid": "40d5cb3e-39e8-48b8-9ab0-4ddb1337a04a", "comment": "Malware payload", "value": "a4732e657c99f79213ab0aa7d203a4d745d7f4fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636910061, "uuid": "e08e5f4d-7c7d-42f9-83fe-a1d96dadfef1", "comment": "Malware payload", "value": "9527e1ca8451a8e5e72b01ed2df97ea07a505f8c82ce3e162e735cc74581561dc8838c6d04d4ccfec48116e77ca7e379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636910061, "uuid": "d2653673-95e7-48b0-90be-25a3ac78cf0c", "value": "T1CD539F342B92D033C9923435B635D7B22EAC4532206956C6EF353E396F703E196BE745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636910061, "uuid": "84c65a15-6abd-4100-a18e-397dfd205ac8", "value": "1536:x7MLN4Fa+iV9Bb8QJUgs13GGmk5nOTQtW:x74NaewQUqQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636910061, "uuid": "5afd2a02-c97d-49e4-a948-ca6f649dbdb0", "value": 60690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636910061, "uuid": "8d6a5de3-9109-4597-9aaf-48e89c6eb231", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636910061, "uuid": "edbcf593-9893-476f-bf36-e599f61eabde", "value": "6f47050bf16f9d26b0747f7affbe569e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0176fba9-454d-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1636895758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895758, "uuid": "d561873d-a576-411d-84c9-070cc45f4304", "comment": "Malware payload (DCRat)", "value": "d1301daeebd92b0d322edd6a7972d494", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895758, "uuid": "f1fda02f-b7c6-4e87-a560-b7f5d606d68e", "comment": "Malware payload (DCRat)", "value": "eefb1fbb690c0c28f191fbc443793d4badc01ecee0416a7d3a4e46ecd4583c57", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895758, "uuid": "fea64eae-335e-492e-84e9-82806878e487", "comment": "Malware payload (DCRat)", "value": "8391265891151e818bb335de8889a048a57c623f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636895758, "uuid": "a96ccfe6-e86c-4de8-baa2-b207fa2fb9f6", "comment": "Malware payload (DCRat)", "value": "6b8d2bde483dd1d059231d6c59f11d3a42dd2601c325b728c8dbd1ab53cfb01160cf8f39507f2270ab0c8c6bb095e30b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636895758, "uuid": "3b6bb47e-a6a8-42f8-833c-fbd0d89c0448", "value": "T1A0451712BA4ADD02D029163BC9DF442807ECED417B66DB1A7E9FB7686112BB70D0D1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636895758, "uuid": "48c5e8fd-6206-4b2b-8616-4d709a163de4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636895758, "uuid": "2191cf63-cf59-4cf8-b8db-2afe696d11f9", "value": "12288:RMaA2kaP6Wu9LQuhEXfXlpUE2KWuVYCPYPw6AJQOWwoPfSFqNZqn4:tAWaiSEP1p9WcTYfAe8oig+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636895758, "uuid": "4da7166f-3e0f-4764-a17b-d663f96f4d89", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636895758, "uuid": "976ec117-f471-463e-900c-17b9dee75899", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636895758, "uuid": "dee3c94f-8ae5-4e3a-b16a-bc178be7a402", "value": "EEFB1FBB690C0C28F191FBC443793D4BADC01ECEE0416.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf89ca2-459e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636930781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930781, "uuid": "b769190c-f03a-4d08-859b-d4bee26d30a6", "comment": "Malware payload (Gafgyt)", "value": "add8c8a3aa55b696011f4ca4d2356665", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930781, "uuid": "28606e7b-668e-4738-b68f-ea8ab41710d4", "comment": "Malware payload (Gafgyt)", "value": "f034f689900d9949e6d367c1854fe05712a5a66a293dce2d3d81a65ba3a4e9b3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930781, "uuid": "144c7d0c-a1c2-45e6-a63f-3a2a6f152a20", "comment": "Malware payload (Gafgyt)", "value": "53c4bfd380c5b1c692fc11bab4d573055b192015", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930781, "uuid": "e84d2f86-6476-4cea-bda3-3e5ebb3b9d50", "comment": "Malware payload (Gafgyt)", "value": "f36ea5056aae972a429823234a272af1000952dbdb35ac680d0eda368b6e3b1789601cdb5cef57c23086c1a362cfbfed", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930781, "uuid": "18bce820-8333-4eb7-8ee0-de06dbe4f0dc", "value": "T110C3393767B6C9BAC08352B226DFA5E1DC13B47F0B32212BB3846E612B589C45D5DB07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930781, "uuid": "ff717cb3-9ee0-459a-ba58-f5746b10ef1c", "value": "3072:mwVfNK+csdE2KPaUxCrwfsvMmVFz2U2FYOnYm7qSVYV0qKXTNO:XERHCsfwAUAYOYm7qSVYV0qKXTNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930781, "uuid": "68fa3247-535b-494a-ad9b-5c3170954c17", "value": 124251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930781, "uuid": "63f82c31-70f1-44d5-a183-87def1bb875b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930781, "uuid": "efba9356-31f4-44f0-8bc3-ab08fc66170c", "value": "add8c8a3aa55b696011f4ca4d2356665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c502c18c-451a-11ec-843c-42010a9c0014", "comment": "Malware payload (Amadey)", "timestamp": 1636874181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874181, "uuid": "6e0e8ee0-37be-4073-8eb2-a8a1b9fa0bfd", "comment": "Malware payload (Amadey)", "value": "bd0a2011e6b11090989ca522ddd3d64a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874181, "uuid": "76057d35-f4db-4b5d-89df-fca5cd6aae06", "comment": "Malware payload (Amadey)", "value": "f1b2cc9a9fed9992129c1673d423647dd8307aada8ccff1b3d0fea35c2c3e741", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874181, "uuid": "1adc1079-3615-4af6-a8e0-96cdc195f3f3", "comment": "Malware payload (Amadey)", "value": "d21b5f7ac8206a43814e32b8702a3070ef22026b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874181, "uuid": "9f01cf23-2e03-4639-aa6e-aa5e7da3a9e4", "comment": "Malware payload (Amadey)", "value": "01dfe0a4d1f7a21a8922d51dc0bb8ad2c9e44940261940e5520465a80e31e1f540adba1faf36be56410c30f6988997a2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874181, "uuid": "af401fb3-de33-40b2-9f80-275e01f19c2f", "value": "T13B4633271770E26FEEF2CEB6363625F1D8B9B17940C0B7213700694E2418AD7AD1E799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874181, "uuid": "794c90c9-536d-40e8-a398-e6478d20fdec", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874181, "uuid": "fdbe216a-ef4e-4c47-9645-07917c791ef9", "value": "98304:yriZ3iq1/oLFrHC9BdWmW6oxocR6XXMj03A9A+5rhExREF3nIekzmUEOQNYo0p69:yul1/osXfqxCzQ9A+7Ex0LPYo0UODzgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874181, "uuid": "cd83e0b2-3b27-4553-b778-8756e7d2ffdb", "value": 5381653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874181, "uuid": "2adb4afb-843b-4a4d-b7da-2dd749860ecf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874181, "uuid": "917c67f7-5c69-40b3-8708-e5e0fe296952", "value": "F1B2CC9A9FED9992129C1673D423647DD8307AADA8CCF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1d5a79-4517-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636872876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872876, "uuid": "280e0025-c947-4eab-bc0a-1522b67af448", "comment": "Malware payload (SnakeKeylogger)", "value": "1d266f0c170c0662ead23a926d68f9f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872876, "uuid": "a8526704-571f-485f-b1e3-cba68ebf4570", "comment": "Malware payload (SnakeKeylogger)", "value": "f249d6d85e28fe61ec0f5228d301c3087cca2ee19283b6c42b0bae4fbdbd7f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872876, "uuid": "5ffb5dfe-88b1-4ba0-822b-0caa207b55cf", "comment": "Malware payload (SnakeKeylogger)", "value": "fdaf8c3991129f148113dda58c9a70c422b775e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872876, "uuid": "54e057a4-9491-43ab-99a4-a2ee45d4e55c", "comment": "Malware payload (SnakeKeylogger)", "value": "4007ae59ce97550a2d2476f8d02adb482900185cd5aba474c11266ca6391cf3f0e65c275cb0508147cef4f530030618f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872876, "uuid": "75228ec5-b612-47c7-98dc-9825a1ddce4e", "value": "T1D664126553D58A3FC99E4BB76843BA410324A3CE5C4BF7AF4B8C506A3E233D198916D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872876, "uuid": "fa01895d-29ee-4249-9856-5fd65f1fe8c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872876, "uuid": "41e89696-4bb6-4724-b000-ea64ef24efd4", "value": "6144:ww8MwEeMKM/ZbIjrzUYPftG/DuaaVcrYYv3VEcvtICxye:TwEePCZbIbUY8SlVc0Yvry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636872876, "uuid": "4089ad78-0d44-4601-8cd6-1c444ee8c174", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636872876, "uuid": "03e8fb38-d13d-49aa-b2cd-e1ac288f9527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872876, "uuid": "62331223-f7e1-4cc6-be62-237731a8f188", "value": "1d266f0c170c0662ead23a926d68f9f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfdc620-4516-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636872207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872207, "uuid": "051eeef7-fe63-4a42-a0a6-a44f39be55de", "comment": "Malware payload (RedLineStealer)", "value": "39f05be12950695ec2630b8ac25a5023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872207, "uuid": "bc0169e7-e851-4bee-a26f-4dcd480845f2", "comment": "Malware payload (RedLineStealer)", "value": "f2ecb51cf068f86569078fc3021e28d783e6f10dba6ee20f571a0bcdf0fc91ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872207, "uuid": "eb0b56cd-2ee6-4944-84b0-e700645127d8", "comment": "Malware payload (RedLineStealer)", "value": "f3f73696af8863e7b32296e998ac052577e76fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636872207, "uuid": "cc5bf661-1c42-4c09-a3d5-b5c35833d4ce", "comment": "Malware payload (RedLineStealer)", "value": "b6dd4dadf83586d511789d793844537aff8a500749585b65efe44a1d2d93641d201eec66be56f155911c7c6d6bb875dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872207, "uuid": "5fdaedec-a1ec-4831-8b9a-05f564b193a1", "value": "T1D706222C2D40CECDEBE15E37534BE06984B46F02EB5ADEDA24D873C98A759D26F121D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872207, "uuid": "6a1a6521-b2c1-4147-b101-777320495803", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872207, "uuid": "ad38145c-f5bc-413f-ad2e-13ea624d6090", "value": "98304:yEZQDd7A5Q2LObQmDAAW1rXa7wEvsp5piZ4hz:RZCd7A51LnmDFs5p54Ohz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636872207, "uuid": "f308ed0d-12d3-4825-b92e-26201aa303b8", "value": 3815631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636872207, "uuid": "789ee92f-aad4-4e0f-b086-ccb9cf0759a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636872207, "uuid": "fb317fab-8d1f-4ff6-b3d6-e9ecadd5fe3a", "value": "Genshinhack v1.33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17b6fa3-4552-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636898174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898174, "uuid": "c2f16e1b-3449-4991-b4d2-77201ad23b0e", "comment": "Malware payload", "value": "0ed76cd7cb14cc30d04802a750bcad22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898174, "uuid": "0af19d43-33d3-457c-8b72-d9d36e426b0c", "comment": "Malware payload", "value": "f3133b021fd1eb20aa1b624a6295496e0d4cfdad4d6d25ac00ab02ee5cbea8b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898174, "uuid": "bb412dbd-8398-4a13-8207-231b81caccb8", "comment": "Malware payload", "value": "ed719729d7025b6d16399c88a7334fdd58b0d603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636898174, "uuid": "c0d3877c-849b-4a4d-8922-e5db7c7c37ef", "comment": "Malware payload", "value": "15e0c01049e742415be441a6571b9c50dbe90e8574c11524760640f2e5a9aefd7ebf10b92cbd8d4ffa65d716cb542acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898174, "uuid": "6be48bec-4b60-403d-9762-6dc1e315ad4b", "value": "T18634F042A38DD7BDF66C25351072B8B2C9E83E7C961F14BBC3E22E4E49B87D52091613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898174, "uuid": "8814f548-e8cc-4e78-976e-41747a1875ee", "value": "6eb55c173f39a0ca8cec42f6f9709fde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898174, "uuid": "7f3690fb-a1d0-40b2-b2db-ee4a3185059b", "value": "3072:tgi/mWcLTrSMSgtFIqdJ5LJ4r/ububBcSd2on2KxUTrIf1vOOallWT7eevqiQcXr:tgi/xMSpqdJ5L2rnBWonKQfEZCCiVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636898174, "uuid": "f950f1e3-8814-44c8-b6ca-425efdb7b45c", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636898174, "uuid": "de9f6307-6be6-4361-a388-ca2233e09e84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636898174, "uuid": "15bac497-16e7-4814-8caa-9fe33ce61fef", "value": "0ed76cd7cb14cc30d04802a750bcad22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de50a1b-451d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636875351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875351, "uuid": "39439dfd-3834-427d-8fb9-3e2995a19740", "comment": "Malware payload (RedLineStealer)", "value": "3ff81f3b75400d78d260a17590d80749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875351, "uuid": "d79b6c16-24d3-404f-a3de-5569e71171a4", "comment": "Malware payload (RedLineStealer)", "value": "f3be41b2bc5802f2f66b6a88aff430c04fbf8f08c2e7cf1a0f23dd464138630f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875351, "uuid": "f168205a-c5fa-441f-9e06-95a1ec02279d", "comment": "Malware payload (RedLineStealer)", "value": "f691715e13e7ec0deb3f8599dcd5020e9d450f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875351, "uuid": "c387e974-ee23-4af7-9f6d-df90cc2e2801", "comment": "Malware payload (RedLineStealer)", "value": "ca791eaeb6efcb291f76ddccc51ec1362c379ea1082bcf23cbf43ce31325480fc2756da9b699ae09a10438d40d3a5585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875351, "uuid": "5c9c6006-7c62-46a1-ba6c-25ef4bc03296", "value": "T1B574AD023DDCF65C90673E3382FF571A47EA3DE16A32599E2F189B025621542EF23729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875351, "uuid": "684d4416-274b-460c-b7cc-d770ae68298e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875351, "uuid": "bf76cf40-4334-4881-8716-269fffec5a27", "value": "6144:DwL3R7WRHEzF0UKtHlLWYSyHhM5Rzh0c5:kF7fzF0UKZtcyHhe4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875351, "uuid": "b0416720-c4e1-4e2e-a395-db4a4db3ea94", "value": 365464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875351, "uuid": "ff4f2cef-ecf8-4ba7-9ceb-3da7a0a7a993", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875351, "uuid": "236377b6-6252-4483-ba06-467cc487527c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e43379-451a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636873961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873961, "uuid": "e9faa294-2e44-4c86-8183-b077464806b3", "comment": "Malware payload", "value": "ee76a90172e33728f639e33962f649df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873961, "uuid": "7de9c94d-9f35-47f0-856c-df2d87693eb1", "comment": "Malware payload", "value": "f43b8a6ad550a0e29b153e74af577d68a31bdfb8fab77086ad4afd885d370928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873961, "uuid": "4add0e84-7790-4df9-86d6-3fcca6e972f0", "comment": "Malware payload", "value": "81e60c1d746dd428fa9f3171d793178072c5b173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636873961, "uuid": "8881eea6-e414-436d-a67c-8e066ffe2bfb", "comment": "Malware payload", "value": "0e67f396c4ec884ffbe04ea4dc60163d43a2404a45964155f409321a73674b8efe5aaa5fe72261e028cc4c08e17a6eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873961, "uuid": "6c563163-4391-408d-aa6b-ba81b80ca22b", "value": "T10FF3BE2277F80029F3B76F71AAB205C46E3BB9D17D72C90D4648009E1A75E68DE78763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873961, "uuid": "a00487ee-9b47-4344-844f-92d42c7f766a", "value": "3072:7s0XytQyAYCJ5JfPoj8Nd7Ff1zDLsr9PynldozvpnBThq4N:7/YYtPXNNFfRArwnozvXk4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636873961, "uuid": "00be380b-a462-4ac7-a08a-ad7657840c37", "value": 159385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636873961, "uuid": "63482b9a-ab60-4da4-b136-b0e0f9f10e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636873961, "uuid": "0373d68a-0a59-4cd8-8355-a879667b3db7", "value": "ee76a90172e33728f639e33962f649df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e125cf4-454e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636896369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896369, "uuid": "58f59d10-7bd6-451e-bae1-550e22e50954", "comment": "Malware payload (RedLineStealer)", "value": "d181f831b9d2aaf073128112160915f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896369, "uuid": "949fe1f2-cfae-4dbd-bbf4-a5b23e1e450e", "comment": "Malware payload (RedLineStealer)", "value": "f65dc72cc75fb41b108c9fe483cb8943c6b46d108f19f96d899e1156fcbdb771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896369, "uuid": "9bab3d0d-dcf7-4211-b839-b320121bb020", "comment": "Malware payload (RedLineStealer)", "value": "7938d77e9ff0f1722bc65ad9b16004260ec200fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636896369, "uuid": "6c3bd8f4-c59f-4b93-855e-4ac2a0e197ad", "comment": "Malware payload (RedLineStealer)", "value": "371f122855a9bbbe524a08c6ae97718dbaf21d99e7fe0871b2ceb597455fa7e6a3358b36fb0d375d9cafcf12de75f5ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896369, "uuid": "0c2091c6-48b0-4bb3-9d00-af625e284a23", "value": "T19F856C91FC9B90F2EA0B56324997A2AF1331B6051B39CEC7C544AEABED336E10C37515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896369, "uuid": "84f4810c-f9c1-43b3-a410-b35df8b94de8", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896369, "uuid": "014648a8-3c3d-4e56-87ce-36fb380aff47", "value": "24576:4/80D32CcukbrtIRXuT2ZfTUiNBqgt+lDWCkBRdxHs3MhVTF37jWaDfX8z1v:4/DWgPKu+ERzxzX8z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636896369, "uuid": "0993492c-940e-4e89-855b-364ccf55b8f9", "value": 1739264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636896369, "uuid": "4df20ebd-aa88-4e0b-8b99-e81c23f9cdac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636896369, "uuid": "5668ae92-042a-4cbf-9f1d-c35d6b7055d2", "value": "7938d77e9ff0f1722bc65ad9b16004260ec200fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f1aaa8-4515-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636871980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871980, "uuid": "2d199db7-4afa-445e-b5b4-c7293bff7260", "comment": "Malware payload (RedLineStealer)", "value": "155efe82f5280b631fed2116dc92ba6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871980, "uuid": "f513cea4-6b73-4747-ba1f-49969cc33d86", "comment": "Malware payload (RedLineStealer)", "value": "f81d585bfc44f4b92707d848715c2225a863196bade7cec2e5306e36fe179365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871980, "uuid": "af21969c-73d1-422c-a6ce-131f6829ed29", "comment": "Malware payload (RedLineStealer)", "value": "2c8dc0c3e5e57d35b7536af1111a9e958e2d6ec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636871980, "uuid": "7fa8f351-3ef7-445d-8ecb-7c888fd064df", "comment": "Malware payload (RedLineStealer)", "value": "84ad07d2afe0c7ae9d79cb4c2c510f8308fe8ed04c264c5527391f4d91e0ed7493edcf36788be1d07cfde7e48aa04ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871980, "uuid": "0af9dec7-e4c0-414a-83c6-347ec3949016", "value": "T1F8E43F2CEDE3CD10FA667D768BE3AA51AB1625D7131307CB57044AC09F0AA12EF5127B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871980, "uuid": "75a22bfd-03ee-464c-b26d-af38a8c5d295", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871980, "uuid": "71ad41e5-345d-467e-b994-a79352d28742", "value": "6144:ZnX7foAnx23Kj8/yIy4GUAM7b/wr8k77iS9duCvuF/T0IPNPoUdSbcaPYjz7oz/G:xfoAI+N1PiS9d0oIP9oT5Cz7orw1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636871980, "uuid": "c94ba558-6e83-48c4-b7d8-9a76e06a356e", "value": 702360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636871980, "uuid": "d7bd49dd-8783-4143-b82c-a8b3ee4f0f92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636871980, "uuid": "4956dc6e-a9ad-48f7-bbb1-8a4ee57a05c1", "value": "genshinimpact menu 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a02d28-458e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636923754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923754, "uuid": "a7b3a91d-efb0-4b1f-9cdc-67b156a7bb81", "comment": "Malware payload", "value": "37a34d4e4c8658425c1d5a97b66501b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923754, "uuid": "a0110978-8310-4055-b0b6-02a7f064d804", "comment": "Malware payload", "value": "f9b23456d437aa62affe41f13a2b7c8a4470a9ef8befda98a27cba781cd6d0a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923754, "uuid": "089ce4ba-c1e4-46d9-8947-c969bf71995e", "comment": "Malware payload", "value": "a96b2248f464bb5caaab47b5e0b1a031a648b471", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636923754, "uuid": "6c4285e5-c9a4-4dce-a87a-7552dddf4f0f", "comment": "Malware payload", "value": "6b1f7e8a03f9d7a407a789bd2ab080096fe44adc3634c19b171009f7e9c65afbcec7c86282aa7568a0a210e2f22af3dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923754, "uuid": "1a63d415-4b45-4272-b2a7-41c571807249", "value": "T1DAC5230B7F88E967DD1FDB352A930B11E738D04067A2430BB61D86251FBB3D58E0EA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923754, "uuid": "0c8da935-002d-456f-990e-d7c76cbb212b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923754, "uuid": "0a1adb52-c272-468a-923f-b0255c1b37f6", "value": "49152:AGidxiNUqIuJf8nu6Hk9WDfg2kcx+1NEGu2Cd/8VQhv3jDCYCCaWYYOu4X:omIuvYTITstGyU6hPjDGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636923754, "uuid": "a237d52b-f39c-48a2-8397-849e85c5fd16", "value": 2717352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636923754, "uuid": "bf2b2f18-8bce-4ac1-a8a3-017e990f07af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636923754, "uuid": "f024f0fd-f9e0-4568-9d87-c7de4ee840be", "value": "37a34d4e4c8658425c1d5a97b66501b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fded28d-4544-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636892051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892051, "uuid": "d7de9a25-231a-42df-8a48-072dbe4429f8", "comment": "Malware payload (Mirai)", "value": "f0fd9950e6a1ab8808148e8f25b4c7f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892051, "uuid": "3a900e18-ac57-417d-afe8-df01eed23b57", "comment": "Malware payload (Mirai)", "value": "fa2b226f1ee68c9e37289d3b3c9cc35839ba782594058c0fe3b7896eeaabef02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892051, "uuid": "a72161e8-5ae2-447b-bcc7-bebdeea22931", "comment": "Malware payload (Mirai)", "value": "4d704ff4b1346d90cec0a5da2eb1e7f5e059dd0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636892051, "uuid": "a236b9a2-c95d-4751-80d2-7ba7b52ae550", "comment": "Malware payload (Mirai)", "value": "02cc49680fcd88849fa2aa174c65da2feae35fb2da46bcbcbf6a08e7e8755ef4916420819ee9fef42c57b81cc1154437", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892051, "uuid": "a61953b3-e2b0-410c-a183-5e471e63510c", "value": "T132933C9DB4014DACFD87AE7E81164E1EEE2063815F530F2B95BBFDA32C630A59D02D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892051, "uuid": "2602ef96-62df-4012-b063-9a682fb6738e", "value": "1536:8PiijNcr4IVtwiX6NcA2up37Iphtc9+JnZo+i5Uxy53p8irYPyo8ImT+GjaZ54HG:Ij0VXACp8+Toh5G6nrY6rnjcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636892051, "uuid": "68b02b0e-feee-4611-bb4e-62cebd6c6ee1", "value": 89816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636892051, "uuid": "62e8254e-1652-4d52-a5ae-52436ba72860", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636892051, "uuid": "09bf075e-178b-4b99-a9a4-644d280d21f8", "value": "f0fd9950e6a1ab8808148e8f25b4c7f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d10522-4541-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636890906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890906, "uuid": "56f1bb21-8fe0-419d-ba83-a4573c33aaf2", "comment": "Malware payload", "value": "25c60eed9ffdeff756cb7c55d240cd7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890906, "uuid": "f3bc889c-8884-49f6-a48a-62666d584ff4", "comment": "Malware payload", "value": "fa33b2bf7c46d3d764e7f10a84d8a3d8395dc3646c9807a32071577b7edcdc67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890906, "uuid": "f791cc49-34b1-45e5-9760-63c560eb64e0", "comment": "Malware payload", "value": "9dc9d9dd2a830c57f308a38df34e8f106be4f37e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890906, "uuid": "6c8fe936-9d9a-4538-af07-b185c9d94ab0", "comment": "Malware payload", "value": "496000daa1e4e38a43abfa6673041945429723ec33e14751e62f9b9538c130d9cd256c5846bdad443922cfd9e59d7403", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890906, "uuid": "ff435fb4-a5bc-41dd-b794-9f8fe8f3b990", "value": "T15503F10423401F7EE96940B65BFE03D16661DFD26517E9CE0AE8E7448DC709AF4E4BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890906, "uuid": "730fd612-e23b-4eb4-b3f4-8f6b43d657cd", "value": "768:BpSiLWEjK41MCWp8IaxcmkpjQSQ2aW/lTgUXJgGlzDpxYsq:CiLfK3pKxcmkO2zlTgwVrYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636890906, "uuid": "0dcbfe7a-94d9-4dd5-a5dc-105604067aec", "value": 38796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636890906, "uuid": "5213ecf0-b6e1-4020-8815-95277fa0d0f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890906, "uuid": "1abe3f0e-348a-4e47-9260-13854c4c351d", "value": "25c60eed9ffdeff756cb7c55d240cd7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c24cd4d-451e-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1636875589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875589, "uuid": "d65fe542-87b5-424e-95b5-9456fdf42108", "comment": "Malware payload (CoinMiner)", "value": "0a88d1777e0b1f24c646ab5060ef8d78", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875589, "uuid": "c0bd35c6-9656-4a01-ab2b-97307027ecef", "comment": "Malware payload (CoinMiner)", "value": "fad94d50a5980d5684226b644ab844053d7b8555d27a9e9ee1ce58eadebb067a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875589, "uuid": "c54215e7-4f82-4a01-b110-2f472b2f8d0d", "comment": "Malware payload (CoinMiner)", "value": "d61987f3be28a43459701aa469d371502d8f185e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875589, "uuid": "a9702755-7a95-4916-8460-0e367b457527", "comment": "Malware payload (CoinMiner)", "value": "761ec27491bd354fabc1d1d8ff41c4f76ff6493d8caeedfeeb56b1b999aba4c8f054423e6fc38119f04522bb2b5f4b30", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875589, "uuid": "25c33344-719e-43fb-bf52-a4c05eea1e96", "value": "T1CA9533639E95930CF87C1133B0820D02AB943B5185E0F31D6CCA5BB9657AEB5EFA0D9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875589, "uuid": "dfe9a066-44e0-4b70-81b3-33b44d24e6ee", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875589, "uuid": "eb014b95-392a-486c-aa35-05ad0e2dfa60", "value": "49152:9jZPYdDZPBHMWy8SYuMwc8YzzCkO7Du7lNXNi8U5zD9QabN0K:DaP6Wy8JwcDzOvu5NdiDdG20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875589, "uuid": "13e37e6a-8be8-41e9-b837-1646a77de58d", "value": 2045726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875589, "uuid": "29bbbc42-07fa-4a33-861f-ec4486502660", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875589, "uuid": "92f59d8a-f24a-4a0f-bfc6-9b21a67729fa", "value": "0a88d1777e0b1f24c646ab5060ef8d78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51bfd67-44f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636858666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858666, "uuid": "91fcc717-02b9-4b33-a299-e202d00480e3", "comment": "Malware payload (Mirai)", "value": "3a1d2554ee98ab9086f8fed26856ffcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858666, "uuid": "1e377961-7b96-4591-a5a4-1be04d291949", "comment": "Malware payload (Mirai)", "value": "fb146faf7eab2d00b6e7b3b5647f6d62e05ab37cd089abe7b2a655874bd62bd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858666, "uuid": "54da9aa4-ea9b-4cac-9f30-7b6dd1eee315", "comment": "Malware payload (Mirai)", "value": "869d21ecee6a41dc2faca50d85e18fea8467bc82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858666, "uuid": "efaf9c2d-3dce-4c59-b9dc-095127317f6d", "comment": "Malware payload (Mirai)", "value": "9301832b9370e0dfc8bc8b6b1abfe7bd4f274dc8ea1dc3beb63926f3a2070363ce09d32c9349def086c2b5822fe4bef5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858666, "uuid": "719193e7-af0c-446b-9002-7017f249f3bd", "value": "T13333F165C80FC832C7B08436DD1802435BCC6B3E93A963B41E6847B8E7AE58769757DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858666, "uuid": "06669761-194f-42ae-be4b-ff2b1a216259", "value": "768:+RocINiVWTQDZBtXA3oDMw1AL04z4TlZgCnP1JY/i/KD4gkR9VGNJ3s3UozK:+RbIIMQDZPXZxA0ndJY/PDjkR9ENJqzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858666, "uuid": "38390543-62f8-441c-8921-843dce8cbb8d", "value": 51248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858666, "uuid": "8a2433c1-79bf-4dd2-a843-e5a29417a97b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858666, "uuid": "f2588f27-5e65-4953-b2bc-ce8a8cbb2df1", "value": "3a1d2554ee98ab9086f8fed26856ffcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afda10a0-4551-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636897768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897768, "uuid": "4619b313-e936-4dc6-99cf-2e04907c5229", "comment": "Malware payload (SnakeKeylogger)", "value": "cf7f7a71bd935a9ceef4217382b967d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897768, "uuid": "02d401cf-6b95-4a5e-8077-d042a75eb564", "comment": "Malware payload (SnakeKeylogger)", "value": "fb8cee632c556f36a3c1ff16bc911e4887d89c96ff5f336b507f5003e73c015c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897768, "uuid": "037ca372-b0f9-4b55-8387-7cef83e83f40", "comment": "Malware payload (SnakeKeylogger)", "value": "3cc17fa7ad00c9c54f655eb5790b5c3625673d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636897768, "uuid": "b3765956-bac2-4fbd-aea3-b7fab06f73ac", "comment": "Malware payload (SnakeKeylogger)", "value": "f8b85b0f75dfb690deef36b685d195ccfd82029464c019032fa617a18479c6952c096e9c0fc65dd20129d0746bc36f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897768, "uuid": "7ce6aa10-b75e-4737-9445-aa97bd5ad9bd", "value": "T1BEF4F5A1E1400159E2210FB0398686BCB6A41CBF1FE3857D7962F315B57D1F3CA69A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897768, "uuid": "d42ee5ab-9dce-4ae6-a61a-2d61bef40ae5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897768, "uuid": "b2a83cae-1615-407a-8bc9-caf3b8bff181", "value": "12288:h/ld/SAVc/V5mkKhgyY/5X3qdIpKivdZZGiPW2PxHaUrb8dRdXRK9JM6F:Fld/SAVc/V5m45nqCpPXy2gUrbmQei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636897768, "uuid": "cf7574e6-87f3-47e1-b9cf-0080be6d32be", "value": 741014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636897768, "uuid": "7c4a971c-d706-480d-9e47-4c43bc16f067", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636897768, "uuid": "4fccbd0e-14b7-44a0-b034-32d2231bb612", "value": "cf7f7a71bd935a9ceef4217382b967d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0d760b-44f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636858384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858384, "uuid": "f1ac818e-dddc-4b8c-8737-820a9de18635", "comment": "Malware payload (Mirai)", "value": "75e4f9ebea42eb4750e470a4594f2f17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858384, "uuid": "fd33b346-256b-4d40-af6a-24882e738d61", "comment": "Malware payload (Mirai)", "value": "fb8fef5082bd1b19eafa6420d73de7f3f28c78b2c9b264b1966ee5ddea68a135", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858384, "uuid": "e90469da-908c-4362-b51b-324a5671ee88", "comment": "Malware payload (Mirai)", "value": "623635298caecea4916ad593ed907cca4d4562ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636858384, "uuid": "06807f1f-28af-4b47-827d-850745ea3eaa", "comment": "Malware payload (Mirai)", "value": "9aa3055a15aa5c8993173ea767781c86fc8a96c6bde0ba0b0c31aecc0c3a57a7735ce8c1f8648d6fe50bc6105a2749d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858384, "uuid": "66faf314-d9fb-4643-b2c8-354e9faae3b1", "value": "T1664302BCD1413E5DCF7D9C3872FBA3B06A80F1502197673482622C54BC2058EB6AB67D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858384, "uuid": "29a5d0e3-9b36-4940-9178-13087b4c8c03", "value": "1536:lWtfl/lUlXAutEAOALBlnVFjFuZEdHfhgQ87jIy:ikdBd9VVFuZmHfhry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636858384, "uuid": "c91f70ee-1593-4ced-bb5e-d81bcd00cf7f", "value": 55664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636858384, "uuid": "b13954e7-4c04-44c9-af48-142e09af19ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636858384, "uuid": "3ee989fa-41da-40ba-8ceb-16d3c1ed5ef2", "value": "75e4f9ebea42eb4750e470a4594f2f17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f416b632-451e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636875978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875978, "uuid": "e9e43b6c-e97c-4cfd-815f-888439eae0c6", "comment": "Malware payload", "value": "402f6b2a0afbce7cf5918f8264fef746", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875978, "uuid": "71a00e0f-1f92-4ae0-a0a9-98cc6a323b29", "comment": "Malware payload", "value": "fbabf1803548dd3acbaa53363e4c40ca062b5fcb31077155cc6753c03ef069a1", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875978, "uuid": "a40216d7-6937-4afc-b0ad-b687ac875854", "comment": "Malware payload", "value": "47277c049e2e9723d22408bd989aef5c2efe8d77", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636875978, "uuid": "213eeac3-f7c2-40ac-b0d9-5b6311b2806a", "comment": "Malware payload", "value": "9c1965c184c4dc12050091fe80964883030d9059b74608fc73e0917b63f7de1b2012aa0bccebc97c35b5403f42d83e3f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875978, "uuid": "f7d15278-861d-4cda-b74e-e7678487220d", "value": "T17704BE617A84C80AD56A1B350CE2C6EA6B77FC069EA6C3073155F37F7D37790CA4224A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875978, "uuid": "e24f8e3e-281d-4fcf-9be2-232fc3e60464", "value": "3072:TrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAjbuAJbD4DiOpEkOHfehcZHQIawhlujL:XxEtjPOtioVjDGUU1qfDlavx+W2QnAh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636875978, "uuid": "d13b7269-0785-48b4-af3e-3fbdbd13932f", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636875978, "uuid": "ee79b04a-ba61-4500-9edf-a782aae9642e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636875978, "uuid": "ecce606d-c4ed-4850-a4c6-339ace2331c0", "value": "Confirmacion & Pago Fecha.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed427ae-4540-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636890197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890197, "uuid": "31f6decb-04d4-4648-8cb5-930e626488b5", "comment": "Malware payload (Mirai)", "value": "c4e783c96508eddab75e6dd8904c5d03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890197, "uuid": "660a6443-440a-44be-8af7-e7b67ec5a836", "comment": "Malware payload (Mirai)", "value": "fc1da09b83fc8b44491493ff7fa80e325ce2f095e02c0712843316f347ac92ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890197, "uuid": "6db60b10-838a-46b3-9c03-eba8401704dd", "comment": "Malware payload (Mirai)", "value": "c053740be460f9365083f6d6965651a60f5bd157", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636890197, "uuid": "db18b75f-d208-4675-bc6c-9e7417b47d2a", "comment": "Malware payload (Mirai)", "value": "ebfaf4e0287d30b7021c02a45d21ca13e85c82f1ba8818ce36df60af2a49b6b2a56c74cdd4155dfd61c033831f8ef20d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890197, "uuid": "8ef40a73-6c39-43ba-b101-307f1d56a62c", "value": "T149234C45E6C7F9B2E41200BC74AE5BB2DF33F57AE476D9ABD34968328906501A30732C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890197, "uuid": "262829f1-6538-4151-90a8-e055866c9422", "value": "768:iimu5fSajbbClk6Q/XnxRVoIoj0foImjPv+KmZ/YimW5Xwmcwl:Z9KGvpnxRnE0foIsPvJmZQ9Qgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636890197, "uuid": "7af14752-d306-4350-b78e-cfb43a5f22cd", "value": 46756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636890197, "uuid": "f8fde415-8987-4176-982b-998f4043d90b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636890197, "uuid": "98e818b8-ad0a-43cb-b2d5-b88010343f8a", "value": "c4e783c96508eddab75e6dd8904c5d03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ede31a-451a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636874159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874159, "uuid": "c6fd2242-bc15-4d57-a2a1-c076970027a8", "comment": "Malware payload (RedLineStealer)", "value": "2e2142cc8d63b932ca33fc58662b6693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874159, "uuid": "77093d69-d049-4d94-9092-69dbc35e2ee5", "comment": "Malware payload (RedLineStealer)", "value": "fc353994c7c21ec405bd5ea01c1082f56b7e2404d163f9a5a69d593070507911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874159, "uuid": "1a6e91c2-63c8-4bf4-8251-d9e119b5897c", "comment": "Malware payload (RedLineStealer)", "value": "d67631fb8c4d25f0a8e4b6ac48fba728f03023ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636874159, "uuid": "791df082-baaa-4655-bd38-6a26ebd2c8f6", "comment": "Malware payload (RedLineStealer)", "value": "25f3dd8c5dce4e782a8f8024ecacc127400756ba4a51075df262a8cdc57f5031f89cd15ce2d01307d2ee883df3174eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874159, "uuid": "66b15e0e-ced7-4e39-9ca6-5549920b63c7", "value": "T1058463227D5CF75490537FB383CF799A8B9A9BF24A32C9875E09DB4BA1108056D63338", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874159, "uuid": "28b5c7ef-6188-4d2a-9ac4-2db69bedd310", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874159, "uuid": "03f0d130-7883-4420-8c5c-7059a72e99b1", "value": "12288:lF0Hmp3siX/j0f5cPeRiONKVsIZiZcnn4X9+:lF0G5X/j0f5cPeg1kcQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636874159, "uuid": "e9700c3e-2275-43ae-aadc-be497a7f9d12", "value": 401304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636874159, "uuid": "c24d8d03-dc61-404c-955d-2090f0caf644", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636874159, "uuid": "d0b895da-d04f-4b75-ba2e-54a692ac6694", "value": "GenshinPublic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ce298d-4523-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1636877781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877781, "uuid": "5c9c2bff-90cc-43a1-989e-8efd3b59509a", "comment": "Malware payload (GCleaner)", "value": "c0e56323a90c765358a4d14f60da6d78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877781, "uuid": "329debce-769e-4641-bc6d-138ed1d8422c", "comment": "Malware payload (GCleaner)", "value": "fe3ae99417e0d632995ad5ceeccc4c0b308b8a30d2c93031f15837b607b8552b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877781, "uuid": "db43cb4e-a173-4ca0-8233-733d18f84b15", "comment": "Malware payload (GCleaner)", "value": "1d2f20c7b29b15a65900a2be840b664a75e30a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636877781, "uuid": "1ab6aa7a-16b1-454e-b40e-4b93a18d6c10", "comment": "Malware payload (GCleaner)", "value": "a62640373ff47ab6d6e38d35b301f4b89f6971cdc2d463ac6d9532eafd4f666ec58f0610ec2d2c88a06d2af986590532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636877781, "uuid": "9cc3d3d1-b8ee-4a43-8a1e-7bd3bdd0cad4", "value": "T13EC533503F96C5FEEB592430A5083F75E2FAD34C0A205CDB3B90C5094F394B5E52A6AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636877781, "uuid": "433ebe83-5dbd-491a-91a4-d63b19ce9aa2", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636877781, "uuid": "17bde204-00a5-498f-8106-67879525c88a", "value": "49152:xcBjPkZVi7iKiF8cUvFyPL6eLZiVY6q9PmDdJ/jl+EwJ84vLRaBtIl9mTiPBkcJ:x7ri7ixZUvFyPBLZiVYvRIrxtCvLUBsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636877781, "uuid": "574595d4-c5e3-4ee6-892a-6b5c7787d55f", "value": 2732427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636877781, "uuid": "82c2d581-eb61-42d9-b3e0-eb0b652972c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636877781, "uuid": "86b30a91-965e-4577-8fb9-c07705182f3b", "value": "FE3AE99417E0D632995AD5CEECCC4C0B308B8A30D2C93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f93917-459e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636930788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930788, "uuid": "9302a2e5-fc2e-4d51-8ca4-304785e50588", "comment": "Malware payload (Gafgyt)", "value": "f7a7c494498cf3828d6d0d3918fe13d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930788, "uuid": "3bb43f11-a71b-428d-a092-f1c4c37c581f", "comment": "Malware payload (Gafgyt)", "value": "fe442f6df612a359b1abf1fd133e74a44445a244da120e4f0a67d82d973b91a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930788, "uuid": "d7756583-faa6-4da1-a994-7aa2d0452519", "comment": "Malware payload (Gafgyt)", "value": "f33d901219bcf9e2ad9a887ce55461e135702927", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636930788, "uuid": "1fc8f74e-3b98-44fa-81ff-de8098a8592e", "comment": "Malware payload (Gafgyt)", "value": "8c13c7747cfdffddb5c9029c69ade0b9ea3baae977b6f95f4711882781c8c78815411e45ced54372a6839059076e1512", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930788, "uuid": "8b33d18b-090c-4bd1-8156-d4feeab97b2b", "value": "T127E32A24D450475BC2D313BEF65A429D3F231BBB939B33255A349EB81BC1BAC1E39560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930788, "uuid": "ba607764-9bbc-46e3-b228-7fcab380e62d", "value": "3072:xdKdPUr3vbRDC69t9alAQ92oLD8lIRP+PysTNGXZkmhdQeOYXMN3:zacrvbRuY9alAQCIRP+PiXZkmhdQeOYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636930788, "uuid": "919c12c1-e67b-4cbc-9068-b778ebf01506", "value": 152205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636930788, "uuid": "1491b4c1-f9c9-4694-b6be-3f3d37e5a6f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636930788, "uuid": "0c0483b1-b6f8-4614-9224-9cf660c725f1", "value": "f7a7c494498cf3828d6d0d3918fe13d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22b64b2-44e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636849668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849668, "uuid": "131f4fcd-7037-4285-a025-5b42e8fc5dd2", "comment": "Malware payload (Mirai)", "value": "1ab01df7bfc97e1d2da4bd6da3d788d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849668, "uuid": "4b328f43-5200-4692-bedf-fae07b000e93", "comment": "Malware payload (Mirai)", "value": "ff88f593f6ee1427f7b57257fe54cd154b47c9992c9c157927b0e67347cb5214", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849668, "uuid": "d523f8dd-9651-4d5c-8bd3-56846f3e6c26", "comment": "Malware payload (Mirai)", "value": "19c1132c98eccd81d332e658c6ecbc6eeb17ed1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636849668, "uuid": "96c68c3c-52ae-423a-a5d7-8ef41ba0bcaa", "comment": "Malware payload (Mirai)", "value": "49db9ee48a93668fdc351fe2e9d51ccf8ad382f1f4fd24fde92e2033962722b1dece45bad07f4dd5e3d9a2720ad740e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849668, "uuid": "f84a592c-716c-44d2-9609-34071aafdd06", "value": "T15CC30A007BA49F02D54A58F9386907C8C7EFEEC112F8B180564E9A2F1135EA75CADF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849668, "uuid": "1d341020-4ced-453e-8196-b158fb935763", "value": "1536:5WEr8R1oFfAS+BxMG0yJOmViQalskB5qdjD3eyzqn8:5WKAj8GbOo1kyjTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636849668, "uuid": "39bc0450-7d38-4fa6-8587-566f7eb3df44", "value": 120376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636849668, "uuid": "cae3a5f9-f954-4b58-8fa9-b75c06045710", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636849668, "uuid": "d722f3e0-89b1-4694-aabb-74efcccb5bd5", "value": "1ab01df7bfc97e1d2da4bd6da3d788d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4f5948-44e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636850518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850518, "uuid": "27b8b9bd-a315-4178-a5c3-f86d631f5b86", "comment": "Malware payload (Mirai)", "value": "7602c8a42da0b62775e49ac42075eb47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850518, "uuid": "1273d1a6-b4cc-4326-bf9a-53d3bb3cef84", "comment": "Malware payload (Mirai)", "value": "ff906b45e3e292b2e09a9324617a0a39ff33908d6c66e361551dc8e948aee661", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850518, "uuid": "91a8c214-af33-46ab-b5e2-bf714635ff0d", "comment": "Malware payload (Mirai)", "value": "b9715df3fc27a638c4556b1bcf573551118068a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636850518, "uuid": "2129d24b-9696-4d60-a2a7-cc0fb92d06a1", "comment": "Malware payload (Mirai)", "value": "6d5256055c53313597a0d24778c522cba30a0a2a1adec804d39f454006db870d14ffb2042a2b22067f5b0be76f2d8774", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850518, "uuid": "11b05511-96c8-46fb-9487-a9bc7912c28a", "value": "T1C0B3F88DE593687AF84881B430A75B33DA77E5BB213EDE95D3FC69725820E01D4009BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850518, "uuid": "7b8bd708-538d-4511-9826-bfee61ad90d5", "value": "3072:ixewoPHgARXvyYkAxPCAx92z8oBN8HirrJeiu4Xj0Rb:iMFPhZvyRAh59CVBnr1jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636850518, "uuid": "f2a7c7ef-f1bf-4fb6-b2fc-62f938d46fc4", "value": 115472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636850518, "uuid": "c31ca8c8-9d6d-475d-91ca-4ecdb921da5b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636850518, "uuid": "42d8c0e7-daad-49c0-9c16-cb7a3bfeea19", "value": "7602c8a42da0b62775e49ac42075eb47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }