{ "Event": { "published": true, "date": "2023-09-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-16", "timestamp": 1694908982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "db17bcc2-7dc9-4334-925f-7452ead6ee45", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bffb085-542f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694827180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827180, "uuid": "2e76c5aa-2550-4e82-82d8-4796f93ce6c2", "comment": "Malware payload (Mirai)", "value": "6c9902d45b451800502ad2eace4c9393", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827180, "uuid": "4e9a37bd-f033-4849-bf7b-a6e2841cd5fb", "comment": "Malware payload (Mirai)", "value": "02796f0ad6c87f70e72944d5c8a42065a97da5caac898bcf0861f43f4d29e475", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827180, "uuid": "bf82ac25-d087-416c-8a94-c9def7813608", "comment": "Malware payload (Mirai)", "value": "e44c8754bb5b69bbe49ca43f4959f02d79f2ce41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827180, "uuid": "96edbcaf-6bc1-4497-bd91-77166179d280", "comment": "Malware payload (Mirai)", "value": "16f43f83069a9b79045406716f58cbdabdfbee74dee9952f2a60461499d55771bfc2fdcf4c1ea62ca437b720f59763cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827180, "uuid": "1a5b34f4-267e-4a84-bdb1-7e1d6e7596c5", "value": "T14B338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827180, "uuid": "36464f39-bff2-4572-aa1d-4e4c3a9b7f06", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvA:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694827180, "uuid": "c1a1e426-969b-4bdc-aff5-5dc2788a5ea1", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694827180, "uuid": "91f4c6f0-3b4f-437e-b039-936738e36c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827180, "uuid": "f72f8396-e777-4df7-a18c-8196a38f63f5", "value": "6c9902d45b451800502ad2eace4c9393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e7ca5f-54ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1694882090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882090, "uuid": "8e444ee8-a37e-4dfc-81cf-e2b0cc1d5918", "comment": "Malware payload (RustyStealer)", "value": "b1c405577c64cb91aceae1beeec5a6cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882090, "uuid": "d7374a89-c11c-4cc0-9a6d-8ae9f0bf767d", "comment": "Malware payload (RustyStealer)", "value": "036db747914ccb896aa34f6c58f9f7b2343fb031c2fef98558925526941ad74b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882090, "uuid": "dab4fe70-5e88-4855-a91f-f1ab48a615e9", "comment": "Malware payload (RustyStealer)", "value": "ba1a03540f1cbe62ceb6523093a288682380d5ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882090, "uuid": "acfe23c6-3ede-40cf-b526-fedc5e8ee004", "comment": "Malware payload (RustyStealer)", "value": "ea7531d1b4074e57f303fde682700a939114b0a6a0944790cc833a3e4ba5c3dd3bcdf5fb071797964bba53a25f83b63e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882090, "uuid": "8a3ec84e-d66d-4c7b-a930-db287bd11d7a", "value": "T13495AF16FA4520FDD85AC1B8424646217976BC880B21BEFF12A8723A7D77BF41F3D618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882090, "uuid": "b8bb22be-7740-4543-9dbc-8a7afba479a5", "value": "1324e912b3362256e05e802a834f2c40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882090, "uuid": "ef7d3e0c-43ee-438d-b884-d72fb0755550", "value": "6144:1A8BdXQQd50VIfoEWlvf4Dxqa0aeytsnHCH5:DXv1VWlX43tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694882090, "uuid": "9548229f-c553-4c13-96e0-25fd6de6e118", "value": 2048000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694882090, "uuid": "b717b228-5c37-49e8-a189-b248dc0201dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882090, "uuid": "4f1ae4e5-2b4b-4c8b-b9c2-f1ad34baaa24", "value": "SecuriteInfo.com.Win64.InjectorX-gen.23076.19470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5bd5fc-542f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694827206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827206, "uuid": "866a3c24-478a-4648-9847-b724dc896964", "comment": "Malware payload (Mirai)", "value": "38322a476fce3553a77d2a5a85d620ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827206, "uuid": "a19353a6-d23e-4717-a8d6-bad781be677f", "comment": "Malware payload (Mirai)", "value": "04027d766725d9153f5db8822ee23d9dbdb6620551b5ac57c6e95ac07805c3b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827206, "uuid": "1ea4f224-a358-4129-bbbe-3aa3d1d49a40", "comment": "Malware payload (Mirai)", "value": "fb78f8f25fb7b24c2fcd8ef6c3aa54eff970fc10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827206, "uuid": "a04fdc48-3aa9-4fba-b5be-93ed9fe6b2ec", "comment": "Malware payload (Mirai)", "value": "5fd4c66f24db3fead4812fd7cfa36c7e9c082c3456754e41d018742086c44988427fa176b12e2787c4353fbb81938f8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827206, "uuid": "fe5b4356-3575-4380-83db-c8f6accc9ade", "value": "T15E333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827206, "uuid": "7a72575b-4c1c-4e31-a7f0-2272db3417a6", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380Dc:dsfIBZeNlJDFj0imvppqmUJP6Lc8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694827206, "uuid": "6d499be7-c211-4809-81e1-8aa33d5bdb18", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694827206, "uuid": "e67ad4d8-e01c-4bf3-893f-339e402ac2d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827206, "uuid": "40a5ae2d-c3ab-41f6-bb4c-97474fd3fac9", "value": "38322a476fce3553a77d2a5a85d620ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9670ed2-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852462, "uuid": "b579e8c3-bca4-477c-902a-4e380fc04b56", "comment": "Malware payload (Mirai)", "value": "d79d4ba2ac2c8f39e154801619368a48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852462, "uuid": "438f2f2a-05bf-4e46-8f9c-4ce7dc3b25f5", "comment": "Malware payload (Mirai)", "value": "05c502d0047587e6cdca4f31f918b072793ceb14bc8c77432c2ccee6ccfcc267", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852462, "uuid": "1b70b8ec-7668-44f0-b289-001800093190", "comment": "Malware payload (Mirai)", "value": "3380fb3c1d422cbe04261255e944065f0aeb6cdb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852462, "uuid": "941c361b-56cb-4daa-bab9-b8efb2e9b057", "comment": "Malware payload (Mirai)", "value": "7683e67fd08ef9540fe2c99f9c51c71fa941b91eb9b6f43ec1b88379f5cfb451148b14871f4b841177570b6e922cda57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852462, "uuid": "44b53916-4c23-42e1-86ba-67e458a60233", "value": "T124C3C63B67170E23C0CA50B101E34332AE75DF8B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852462, "uuid": "86b668e2-ad87-44c3-a286-dde60f92518c", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPTL7ymm/QMurB1nKGNb:SMQplVTamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852462, "uuid": "630fa56b-86e1-4982-8643-3678de787abb", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852462, "uuid": "54597d74-9134-4ad0-8a44-e5de8d28d525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852462, "uuid": "77b37f32-e58f-4d97-b457-651d901f42cc", "value": "d79d4ba2ac2c8f39e154801619368a48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c02c380-5465-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694850400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850400, "uuid": "ed303c64-b27c-41d0-aadb-41632af507ff", "comment": "Malware payload (SnakeKeylogger)", "value": "2ee45a8f29a2a9650ecf303ba28ddf87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850400, "uuid": "67212ac0-bb5d-4f94-bab1-45df0b9d2052", "comment": "Malware payload (SnakeKeylogger)", "value": "07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850400, "uuid": "bd46f392-1c72-4d99-a789-b36e7acd429f", "comment": "Malware payload (SnakeKeylogger)", "value": "36fc7927deda663b5dea936f952e047a28ce1ed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850400, "uuid": "93ffc8c7-7053-48b3-b055-3430cc48a04c", "comment": "Malware payload (SnakeKeylogger)", "value": "ac75a0e95d0861781368968ae9ac2e33f0890c93cf8c5fb4ff95dff96556eb9cd4e1edd77fc62c584af21be4224ba19e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850400, "uuid": "c83eefcb-3a97-4075-8276-9de51d8156f1", "value": "T1F4B4023827EC8B59E5BE9739F470904007B5F26B1223F65E4F4220DF2A667A49904FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850400, "uuid": "08c8ebd8-8dc6-4f21-aed5-98639b4dab59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850400, "uuid": "ad294a70-5be4-4716-a576-39a8ee2e2617", "value": "12288:QjVtZ5/eTpd/upd/E2PKhk246c4MrgrMU0OViUYQF2xRTSns:QjTZ5GsPKWTQMQViUY1Xss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694850400, "uuid": "39d344b7-486c-437a-a665-090833076dd7", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694850400, "uuid": "cf36e17e-689c-4259-970d-8906e1ac11a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850400, "uuid": "d5a2b609-66e1-4941-8570-0bf095363633", "value": "2ee45a8f29a2a9650ecf303ba28ddf87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426cd29c-54cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694895105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694895105, "uuid": "930dfb9b-6e1a-4d4b-9c1c-d33ab9ff877b", "comment": "Malware payload (Mirai)", "value": "e41571be96ea35e4b3fec06642c53435", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694895105, "uuid": "295e34f4-dcf3-4034-a9e4-8bde883d8ea1", "comment": "Malware payload (Mirai)", "value": "0ad16940924082e70bfd83bfe2c9bb71c967dcbc2e0f02fb1e19c63e791439a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694895105, "uuid": "e1cecc82-88d3-4994-9131-310f1cb250af", "comment": "Malware payload (Mirai)", "value": "2b5277b8265cc1d5b52385d000a93906ccba323b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694895105, "uuid": "700001e2-f3f5-447f-bb1d-e0a623f37abd", "comment": "Malware payload (Mirai)", "value": "5dfae23aa322d3471e51c0dcbae05c47238f101fae7c803e247db47018cba9f4cb61e7390fd0191e8048fda74a9de3ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694895105, "uuid": "311a1c15-41c8-416f-8684-a9f62ab205f2", "value": "T1EDB30906BB540EFBECAFCD3706A9170520CC550B32A96B3A7674D878F54B64B5AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694895105, "uuid": "221fc46a-a149-468f-92b6-a99825146503", "value": "1536:WCN1qEAWSXQOpMh5EX/5R5S25xnl3NZSciZ5LI1eCgbefrPKcqIIGO2QwwV:XNUJWSXQOb55sciBb/cxIGO2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694895105, "uuid": "75f617b1-31f2-4df9-bc56-6becbefb484a", "value": 114164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694895105, "uuid": "8261a56a-9c16-4f62-b25d-dd6c759ace18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694895105, "uuid": "23f07640-bc2b-425f-b9fa-0a6524898d25", "value": "e41571be96ea35e4b3fec06642c53435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e44c7f4-5498-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694872415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872415, "uuid": "de0b7e7a-90c9-46fc-b07d-2d2ffb9dbba8", "comment": "Malware payload (AgentTesla)", "value": "9fcf21603085f607c7a635ca03d8b91c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872415, "uuid": "d4827cf4-a7a4-428f-9799-fd5e2e777c1b", "comment": "Malware payload (AgentTesla)", "value": "0b675485123aef301b8f33a5ebca2b1dfb12c7bffcdc7331dc16615c9d6b0495", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872415, "uuid": "f810fa2a-bf16-4373-8df3-e817c13f22d6", "comment": "Malware payload (AgentTesla)", "value": "ea113d8f9332eb31330d13d1b4c2e2a165f5dccc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872415, "uuid": "69d360b5-0169-461f-99e8-9d5027d5dafe", "comment": "Malware payload (AgentTesla)", "value": "2e84570625410854d79244a8a7627a9997dd5619310af08148f01441d3ae7d77756a874f371f1c44de92a68f929cb1fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872415, "uuid": "e1d724d9-4974-4f96-8580-2bcf5d39b779", "value": "T1F5B42394C3E19433D7986F7888ED4E805177F70EA610F77E2B88063E1B956FA2290F95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872415, "uuid": "e840de30-ad36-44ba-84da-69b40cd165c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872415, "uuid": "efd812c5-150c-41ff-b16e-b3059c602cd2", "value": "12288:un2yaWZp7RBGDaSV0lO3jJukZW2WaKYEDbA18WFDtlu1HCu:4fBGOSV0lOVAtYE/+BDtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694872415, "uuid": "93dfed5a-444f-445d-a343-408c58eb9a68", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694872415, "uuid": "b964b394-cf3a-4499-b1a8-afc88c387253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872415, "uuid": "584c5049-b789-44de-8707-951e8a059c5f", "value": "SOA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54bfc29-5484-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694863998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863998, "uuid": "b8eb9ef3-04d3-4390-956f-1930ebdfe27c", "comment": "Malware payload (Smoke Loader)", "value": "67d13f59c9e874b6d1f9166a03615597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863998, "uuid": "2440eab7-5855-42e4-98d2-a9490024309f", "comment": "Malware payload (Smoke Loader)", "value": "0bf5934811056a692ccadd8c86355bfb1818063ad978982483d4f5b92807ee66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863998, "uuid": "7ff08f62-4393-4607-9358-6aa19594814d", "comment": "Malware payload (Smoke Loader)", "value": "6ba437212f760dadca50a6c53fcc3df9e43e8cc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863998, "uuid": "edc52204-379e-4a40-bb23-06bd60864aca", "comment": "Malware payload (Smoke Loader)", "value": "f250c7c3f82d6e525e2987d77dfc38b4d2375bab3bf3dafe8fca523753479fae57f0060babea6199103d619d3a3c0966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863998, "uuid": "0c05491b-b4a0-477c-ba58-c590403a6f57", "value": "T185545B0292A17C21E7294F759E2EC1E4661FB9214F6877BBA206BF1F04B1CF2C163759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863998, "uuid": "c38dbf77-0172-4208-88ca-bfe7eb03887b", "value": "d189d43af23bbb5425431a74f9f591c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863998, "uuid": "1ed65622-148e-45b7-8ec2-b0a90ba41d91", "value": "3072:2RZEUPsYraMflOjyMjvt8UWIc8sHwbqbRzRaW+aKPt:GxPsYO4AfyUWIc8nazUW+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694863998, "uuid": "5159d840-2ed7-46df-849a-4be39ce076b4", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694863998, "uuid": "4c266576-f2a8-49d9-a48f-1b7b03b35100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863998, "uuid": "7e993b67-83f1-4e6a-924d-452abc834ca0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f589c236-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852456, "uuid": "a825f74d-48da-4f21-af1b-fdcfeaa33728", "comment": "Malware payload (Mirai)", "value": "2345a225131b3d8b99af723db0063d24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852456, "uuid": "4b22aa55-c61f-4f29-ad0c-ab72b6ff51a8", "comment": "Malware payload (Mirai)", "value": "0c1caa001f742c0d1b251590c3e1630ec89af6723c0e01a76db22e48695977c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852456, "uuid": "00ddb629-d7f7-4e35-bf6e-f3d55fb4a9bf", "comment": "Malware payload (Mirai)", "value": "788b42cb1d8fae84a3ca5fb37915afa3171ac0fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852456, "uuid": "0ac251ca-88ea-4ac4-a592-a8b1bb8e6602", "comment": "Malware payload (Mirai)", "value": "d7dbab1e0170bd3347b04d79d6301adf6d0b0e91f36f811ccaf4f5b53f94616bee2504bb47cf27ba6e546e90a451d70b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852456, "uuid": "119a6392-c60d-483b-9098-bc106b1ab5a3", "value": "T181B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852456, "uuid": "84f23bb4-6969-4f8b-8f06-8c85fc0e1212", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZ3oamm/QcuLB1niDNb:YuFX0GIk1MHyph4amm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852456, "uuid": "f913620b-fc0b-4b9d-8492-c713ac3c8f2e", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852456, "uuid": "c0285009-9dc7-4bd4-a942-41a3d26b9748", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852456, "uuid": "f6f2a403-501e-458d-b781-f90902ce8ef7", "value": "2345a225131b3d8b99af723db0063d24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0c7bb5-54da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694900703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694900703, "uuid": "691c540e-1f6a-467f-a166-833f4303deeb", "comment": "Malware payload (RedLineStealer)", "value": "bd677338df07f7b7534ee9b0a11dc7de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694900703, "uuid": "9ae4a766-db60-4e42-9817-b1f512dac10a", "comment": "Malware payload (RedLineStealer)", "value": "0f36e18b4aea416cd5af0d04845ec04d9faab74689fc9257ee5872c858baebb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694900703, "uuid": "eb37870b-3b89-4308-af40-544f4ffcf354", "comment": "Malware payload (RedLineStealer)", "value": "7142d9adb0d04c358b2265805b51410664c2ac6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694900703, "uuid": "3e41d428-0fdf-480c-a791-75ff9217c550", "comment": "Malware payload (RedLineStealer)", "value": "bfda3c5206db597db77f8e647cbfd8065eaafea6c5dc20ab3db9b7b714228a64312b77a60274ed691092a6fc13458112", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694900703, "uuid": "0ca56baf-ccaa-4d44-bff6-7843f241c8fa", "value": "T107D49DD377B14CF2E6E2CF316598D636B41FA824478398972BA91C1D3A2B4D052E37C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694900703, "uuid": "6c0661b9-eb33-40b6-b6e5-2c3339a3b163", "value": "fc6316c96fc105fcdafe08845aa690ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694900703, "uuid": "3f8a68ac-30aa-48fa-b0dd-5f78c20cefbc", "value": "12288:WmFzZtT78Tr7IMZ0RzjLSxprrunnnw7NQnsnuOl1xwhL44Ph8Ey:HZtBs0Rz6brnNQnsnuOlkhhPhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694900703, "uuid": "5ce5c3b0-d033-41e9-8ee6-e93e53a5fe29", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694900703, "uuid": "9381e0f4-b07b-4eed-9ba1-42e869ccd4a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694900703, "uuid": "2ebd9901-2d9b-4d00-8e1f-160b80ff6cb9", "value": "bd677338df07f7b7534ee9b0a11dc7de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6accb41-5474-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694857075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857075, "uuid": "fef65ef5-e987-4bbc-a9a1-64e15998d14a", "comment": "Malware payload (Smoke Loader)", "value": "a2b789e166d74ec2865e7a1c70233ef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857075, "uuid": "c4e95446-3829-4569-93b4-89152944679d", "comment": "Malware payload (Smoke Loader)", "value": "0ffab407dd3ebd93f007e24f439bbda8c8b68d50b5ba6537213608608c6f8d61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857075, "uuid": "2baecf11-6ad5-4703-8cde-eeadbda0f32d", "comment": "Malware payload (Smoke Loader)", "value": "d2c57c662861fb847c08045044b30473e7d0f334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857075, "uuid": "6310077c-9031-4779-819d-47922ec284d4", "comment": "Malware payload (Smoke Loader)", "value": "0fac6363e9773cd9c4300f216236a83cecaa8f1fcaecc6e3068c87e7103186d4f8a218048da21d4828df54e7cac50e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857075, "uuid": "18940146-8c1d-4c8c-9ab1-e26db736f3b9", "value": "T1D2447E13B291B960D6264B329E2DC9F4262FF9214E6B775BE3185B2F09B21E1C5F2311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857075, "uuid": "8e215895-5c52-4986-b86e-548f9493f78d", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857075, "uuid": "14e253f7-abd6-47c1-8730-2867056d33b9", "value": "3072:bPNnEMUvutnGAL60p4XKJBjL0GIMzEGjw2hqNJ:bNAvutnGAL60WXuB/uepg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694857075, "uuid": "7b681cae-1188-4e31-a11d-6a8faf60c81d", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694857075, "uuid": "53851ab6-537a-48b5-832c-f759f5c0e920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857075, "uuid": "5e77d4c8-35a6-4566-91a7-4d50ce24de8f", "value": "SecuriteInfo.com.Win32.BotX-gen.2296.21970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bf38b8-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852428, "uuid": "a4e883ba-2e7d-4f43-a55b-3b0ab96c0f44", "comment": "Malware payload (Mirai)", "value": "65df89f4885a3831e0e7a31664fb2182", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852428, "uuid": "c997ae95-274d-4ca7-9848-10d2913f389b", "comment": "Malware payload (Mirai)", "value": "10a5136048b43f6c4dc3d8b660ed0088e8cd709633c03aa05cfa1b83f7953573", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852428, "uuid": "8e04ddf6-c83b-4344-a5fb-cdfe9d827c34", "comment": "Malware payload (Mirai)", "value": "9f07fb692836cc9f90c4283a99210849923ebbc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852428, "uuid": "dd5545dd-2c0c-4afb-8e18-e7805ef47d10", "comment": "Malware payload (Mirai)", "value": "f977d3bb4d5c1cd58664b663a5ac011a5c7f4a2b83b414ed7a668d53477c4533f7cae16f46a31a7896b93ba251fcb1ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852428, "uuid": "9b376272-0efa-4da9-96a1-ea72660ea5aa", "value": "T1D8A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852428, "uuid": "f228aec0-f7f0-4324-b3e7-0d6b11f6be40", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fyHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fyHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852428, "uuid": "3a2c62d3-3c8d-420a-9630-fc59a60cc8ea", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852428, "uuid": "63135328-cef6-4683-882a-3a913c9f066a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852428, "uuid": "9f63788b-70f3-4ebb-a9d3-c1b24e41c572", "value": "65df89f4885a3831e0e7a31664fb2182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95d40bd-5441-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1694835229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835229, "uuid": "3c6f922a-a937-4feb-a538-b496f9338a37", "comment": "Malware payload (Tofsee)", "value": "fd228d66dacf3a914214e849dcf19979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835229, "uuid": "09023c70-1e0b-4c66-86f2-b156ebff172e", "comment": "Malware payload (Tofsee)", "value": "10ec03f362b7385e68ee249d402663469b8b613dd32961bc38c7c5cd3c4b44b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835229, "uuid": "a421c8eb-79b8-4123-9f72-419e5505d259", "comment": "Malware payload (Tofsee)", "value": "6aabf3300d2ab321ea51af659fd1c6a56ce2f236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835229, "uuid": "79d04378-e1f3-4e6c-a9fc-e0c336b6df36", "comment": "Malware payload (Tofsee)", "value": "cffe4ccae8cbb9f8d96e03cc59105854d264225c57f3faeb5a7cea58da0afde80ceb349a8d5acff6914d96ea14df8935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835229, "uuid": "02ca0360-6f63-4070-a7c5-1d4f2c997893", "value": "T154447E12B3D0B861D5164F728D2ECAF4262FB9214E6B775BE3185B2F09B21B1D5F2311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835229, "uuid": "49cdbc5e-25f7-40d0-9ba3-0d1e40c2fd58", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835229, "uuid": "6e71ccb5-cf2c-4c97-a55b-18c7d2df308a", "value": "3072:F8KnEMUvutnG3L6PG4dM2gbDNCbNCpvDi4xSpv3NY:aKAvutnG3L6PVdENCpMu4xSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835229, "uuid": "6252b0a7-9360-49ad-ab27-0573ed7f40d7", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835229, "uuid": "b7f22c09-0fc9-48de-86f4-580aabc0ac11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835229, "uuid": "b4c2cc8c-c6ad-4c3e-801b-9331037665b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec582e11-543e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694833972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694833972, "uuid": "39680225-6c8f-44f4-9336-fbc44d6985b8", "comment": "Malware payload (RedLineStealer)", "value": "add1e90b74d8db89354419ea576ab892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694833972, "uuid": "eb731646-468f-46ca-93a0-3122cab2cdf6", "comment": "Malware payload (RedLineStealer)", "value": "11bef9e9d9d25f2c184c8343840dd5231b61dc374b3b360e2d7cd9d4cb5c8063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694833972, "uuid": "6134b4ca-2cd0-4412-9acd-f8655d8a2b20", "comment": "Malware payload (RedLineStealer)", "value": "ca833b01f357fc11ac3a41d729891dd758a38c16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694833972, "uuid": "3f0b0077-4234-46a9-a23d-e5b4c49d11c8", "comment": "Malware payload (RedLineStealer)", "value": "25bbf772d9987137669181eebfb2940e2246889078df0297a0de5c76490b4d1ffccf5f580842a12db8f8fe026ca7ad87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694833972, "uuid": "9ff1dc4d-955f-4a35-b542-393920c46ace", "value": "T19D94D112B2E0B861D5264B329E2DC9F4262FB9214F5B675BE3246F2F09B31E1C5F2711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694833972, "uuid": "3588163d-d943-45b2-a44d-bbfb44bddd57", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694833972, "uuid": "853523f6-c8e8-4d18-928d-05fb36ce06bb", "value": "6144:8F8v1sjHwykPVZ5uZgNSi4fPwu331cl6zuCte+IfPpjHMvzGbL4LSD:8uujZ9Zg6w+8wofPpYv5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694833972, "uuid": "231cc067-5456-4d1d-8ffc-b0de590ed6d2", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694833972, "uuid": "f0564d1a-f5a8-4cfb-8f5f-b9da7ecf9c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694833972, "uuid": "9625cd52-3611-4b7f-ade0-4fd26fcfbd56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edd6907-542f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694827212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827212, "uuid": "fbd2a80c-560f-4506-b532-c9c6b97adb30", "comment": "Malware payload (Mirai)", "value": "31545780cb77f2d7ac6979f308b89a01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827212, "uuid": "b4ee01f0-0b8f-409b-a2e9-83b880bf9a80", "comment": "Malware payload (Mirai)", "value": "13b769daaf0e34fddec306604e8e534e4d914ce8f43e2fe51fb781980aa1156f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827212, "uuid": "8bb81aba-8b11-4b07-ae33-32811d8e71d5", "comment": "Malware payload (Mirai)", "value": "8c4a53fbb323227e37004c5a3232a1180b6370b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827212, "uuid": "bd3a243a-3393-41d5-99f6-20a9b8908c3f", "comment": "Malware payload (Mirai)", "value": "ce9a9b82f9d3d7e7b95647a6c3b652d40a3b659d2ef9b7b23f57101d1a20a5f748b34f1ec4b36b88efbf75be14590734", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827212, "uuid": "ec28df1a-b2c3-4580-8051-66deafbfa5b5", "value": "T19123F21320D7EA13D420947FE9159C687D444AB9B8ADBBB729011294CD20A63FEF16BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827212, "uuid": "34c57ec9-eb29-4f45-9309-943fa33b5be6", "value": "768:SK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFg9q3UELv1Q06pMBwAA3i5j:M12O1LCNguovDPH7Tcr3LtQ/pSAy5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694827212, "uuid": "3505aae4-9dbe-4b0a-b22e-83edcb19a93c", "value": 48716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694827212, "uuid": "42927242-d61f-4a37-a8a8-6059d4e39554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827212, "uuid": "046a2ed6-e23a-4669-95ce-0d3bca342eb2", "value": "31545780cb77f2d7ac6979f308b89a01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a7740a-5429-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694824747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694824747, "uuid": "d4015944-004d-4396-8f11-641c6e05509d", "comment": "Malware payload (MysticStealer)", "value": "a178754cbb6dd0acd73a539f9ebdf0b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694824747, "uuid": "86b671bd-7aa2-4b76-bfd5-5dba9f3ea200", "comment": "Malware payload (MysticStealer)", "value": "1547b0b76d0f6a225ae092bf8e0246b467e92643cb75b0bf35fb67d93efd51bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694824747, "uuid": "87525275-acb1-4416-9617-f4f96daa1470", "comment": "Malware payload (MysticStealer)", "value": "5c805a5ae9687fa9b1864edd72e6f3b5e360d608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694824747, "uuid": "d64a00c1-3975-4d00-8226-ec1f1b29e349", "comment": "Malware payload (MysticStealer)", "value": "0698c830d9f3cbdb1e26212146c9730fa7494ccf61b790366d96755d22818d912d5d31997a1ce8e8b61ff9536a6cea4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694824747, "uuid": "1a56428e-f5c6-4f8b-b994-7ed32c61b239", "value": "T1B774AE10B18285F2F87369364AF4E275563F78A0879569FB27AC4E3F1B189D0D739232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694824747, "uuid": "93fa10ac-69ba-4c49-9397-8dfbd645797e", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694824747, "uuid": "dc01ebd4-0c1a-4b3f-b48c-c60402056ff2", "value": "6144:M/nXR/bOEHHkwxOSeyCKrJz4AOHs2kv+FL2Ay+g8uQ8fi:cnX1aEHEw94Bs2kOL2Ay+t8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694824747, "uuid": "fe3d8be4-9346-4506-9108-f28bbac08ece", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694824747, "uuid": "1bf77d39-a012-44bd-bea7-c145ac74c66e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694824747, "uuid": "bc7c14c8-ed54-44bf-95fa-5c475b7c7c58", "value": "SecuriteInfo.com.Trojan.Siggen21.29429.656.31276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694962f7-5440-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694834611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834611, "uuid": "e728a49d-59d2-4ad5-ac02-a43de3b0e04a", "comment": "Malware payload (Amadey)", "value": "996b3793420857f2c380c78fddced836", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834611, "uuid": "f5e019bb-c31c-4860-a6e0-b6dce2552e92", "comment": "Malware payload (Amadey)", "value": "1622294a3a1c2d8bceb95fa40a2d7ce3c9d22c719726f967b002e1dda5f3af24", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834611, "uuid": "f8b72f8e-fecd-4e2a-925a-d38107c44922", "comment": "Malware payload (Amadey)", "value": "70f60fefe59754f8c34c7697eb2fbc21e1593ad1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834611, "uuid": "ec5ccdce-a4bc-4e50-8b40-bb4ba0fa0aa0", "comment": "Malware payload (Amadey)", "value": "213d9bd2a01a608668a82f3ef52b0217fd7973eb85af7263df3490c5a2dc76bee176de331221b2639aa7cb361ee5ad07", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834611, "uuid": "0276bfc0-0c83-4a2c-95ea-ab5d100da739", "value": "T131547E13B291B861E6224B729D2DCAF4662FB8604E5B776BE3189F1F05B31E1C5F2311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834611, "uuid": "bb2739f0-72fa-4ffd-ac0b-2893181338a5", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834611, "uuid": "1185416d-048d-4b22-aba2-e061ca23ba4f", "value": "3072:EBqVc+MvXLxnMjT1o4qCx7iPcGr5PY9drsk1Np:YqUvXLxnMjT1zqAvuPG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694834611, "uuid": "e38a11b2-39b7-4f3a-b11c-ec13ed592d0a", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694834611, "uuid": "8ac7f8bb-86ae-4de3-b979-64591a11ff5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834611, "uuid": "c35595aa-7cc8-4d7a-b2fe-615b4e8e48bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab05855-5442-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694835392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835392, "uuid": "f18d3980-b60d-4ae1-82dc-7682c63b5ede", "comment": "Malware payload (MysticStealer)", "value": "16ae9307a4c244cf50c2ecc67a164af8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835392, "uuid": "1e6b8cef-4d37-4016-995d-079de8b648d2", "comment": "Malware payload (MysticStealer)", "value": "169bade87dbb2e30e92e126561c47b7ab9b1418c789edeb28d039f1ae1dac165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835392, "uuid": "2fd6a434-b6cf-4179-8287-5266d09fbb25", "comment": "Malware payload (MysticStealer)", "value": "60aa5d5402fc5841a32376e3e3363a607377fabb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835392, "uuid": "5ccfaae6-6e6c-4e42-a77c-48a3b6ae0e65", "comment": "Malware payload (MysticStealer)", "value": "4520543b3a3d6d99eabf03aca356231048db2447cf0fbd8549e6dc8fb1f470a891c2c6f1a322b6dd652ba6373ab2a842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835392, "uuid": "267ed0bd-ede7-40cb-8424-9f41172b47d0", "value": "T10B74AD0837D18031D47231369EE4AA794A3DB4600B426FDF67E71B3A5F951C2BA32F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835392, "uuid": "cb84878a-78fc-4aa1-83c5-aa0809ce225b", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835392, "uuid": "d3963cd1-eebb-4fa0-883e-6fe18e812f6f", "value": "6144:r/eXR/bOEHHkwxOSeyCKrJz4AO8f6q7viSmRqiHdgcHKpKm8fi:reX1aEHEw94Gf6q7iSzcO8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835392, "uuid": "1452ff45-ab42-4ed1-941b-6281ee1fa105", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835392, "uuid": "8c5f467e-173a-4edc-8418-c192ae46b6dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835392, "uuid": "3cd2c11a-2133-4024-bcae-ee7414c37eaf", "value": "SecuriteInfo.com.Trojan.Siggen21.29429.303.32156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4caeb9dd-5486-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694864628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864628, "uuid": "06a4c370-6320-4aeb-97f3-fd407af3a132", "comment": "Malware payload (MysticStealer)", "value": "58d42e7649f53567f1f6272b2467bb78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864628, "uuid": "dc40ea82-116f-411b-9289-804e1a9b70e3", "comment": "Malware payload (MysticStealer)", "value": "18e816bd7e6faac64a412f33031e34d1e1c8be641d1db4f41cd7af382fce3431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864628, "uuid": "d2f233db-f28b-4dac-9f1c-b1741f47d79e", "comment": "Malware payload (MysticStealer)", "value": "dd08946bf0717fb8a2bad299d49ae8e9244d7b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864628, "uuid": "d58513fe-af66-4be4-934e-e8246ee54f01", "comment": "Malware payload (MysticStealer)", "value": "412b9be499db869cc97eb15845114dc4e1fa53885a8e422fe1860f8a7d0bba9e3941edbb5af2804e46a330ca40a81335", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864628, "uuid": "47fbd1b9-f991-42c5-b7b6-3c362c5a8602", "value": "T10574CE1178F00033D9B21A3BCAF45A778A3AB811379655EF6BA44EAD8F74EF14E70125", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864628, "uuid": "7f2e98a6-8227-415c-8a1d-0006f772c29d", "value": "fc6316c96fc105fcdafe08845aa690ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864628, "uuid": "f933a76a-9e0e-44af-b961-dbe457b1793e", "value": "6144:6wcaGEZt20ZSwbz8+Dxe8kVAO5lS8V1y4pi/Vnok1oy/Q4Y0kparh8Ey:6wFzZtT78TH/VXcVnokOkQ4Ydarh8Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864628, "uuid": "74fc57b0-4f5b-4ff2-a2fb-92a1e992d6fa", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864628, "uuid": "e076d3cd-67c5-4702-8004-1261c93713d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864628, "uuid": "fb2a051b-f09b-435e-b77a-b73b99318398", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6862285-54ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694882093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882093, "uuid": "7974f62d-c1e8-4a62-98a0-5015b746a3a5", "comment": "Malware payload", "value": "4359ec34ab4e88d35bce69b4d904ce8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882093, "uuid": "d2a3581f-92f7-4a1a-b589-2b96f927ac69", "comment": "Malware payload", "value": "196789f6c613d99136ea8ed3f7c5e10b0f0ab284036d87fdf782824239c26bff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882093, "uuid": "312c73f3-1ca2-416c-a93b-856a6132b8a3", "comment": "Malware payload", "value": "a87aca2a5384cb2e4b1363bad68b7d420ed78b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882093, "uuid": "4c747f23-740c-4dc4-bbed-9e8bd701281b", "comment": "Malware payload", "value": "d4db418bf33fd92b0a9188f079998d4b340f459fb062e7b9c0571ac3341924e6385c14cfb08d9077e1ab9464462ce5ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882093, "uuid": "9693033f-160f-4a58-a5da-e5c2c76646a4", "value": "T1B2E52302BBC145B2D46229372B19CB21BA7C7D312E78C9DBD3549D1DED326E09B313A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882093, "uuid": "71550908-93e7-4370-b565-d628145e6c3f", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882093, "uuid": "20c05bcd-dd01-49e5-8f37-7596001b6a8c", "value": "49152:HdgbtUZyw+RgdNpuUA/50UOKa9cCZL2vrcjgeexFkGcurRxnMbAI+FaoYxS5DIj:H0WywNBuUasKqsageeIJIMbAI+FXcSGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694882093, "uuid": "35467b02-1d03-4675-a7aa-edd93d7e1c3a", "value": 3092040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694882093, "uuid": "912555f3-63a5-43f3-9ea8-e61f45f976b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882093, "uuid": "78b8d695-f22d-4c24-8df7-47ece722796a", "value": "SecuriteInfo.com.Win32.InjectorX-gen.4494.26110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00f7d31-547c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694860580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860580, "uuid": "86bee881-bf28-438f-a7d2-3264f3144c74", "comment": "Malware payload (Smoke Loader)", "value": "b69d985f553f56a90ea6f1f0411762bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860580, "uuid": "84c5cc59-7618-4ced-8c0c-8f2edbe586cb", "comment": "Malware payload (Smoke Loader)", "value": "1ae04fa07154cef3ce6fd3d7d00f8fe13b897107a328cfa516c9f26cf7c22b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860580, "uuid": "fad5e4a1-3204-4ef1-9b30-43bfa7d40e59", "comment": "Malware payload (Smoke Loader)", "value": "dcd535a836d56cbde0e0efaaeef2e450806429a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860580, "uuid": "e97c617a-e219-4e18-b0a3-18c2134efffc", "comment": "Malware payload (Smoke Loader)", "value": "ceea14fe4051f30b469acedffd6a20202c725bbb97bbe198a11cdc38b7e650dfbe27e2e46756751aeac3fd6e8a776df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860580, "uuid": "240c606a-3985-43f6-bc0d-9d4d2a2e9ab5", "value": "T1C2546D1397A17C61E6164B328E2ECAF4762FB9218E5B776BE2185F1F05B31A1C1E3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860580, "uuid": "40a50fba-0074-4c9f-ba65-0890b6e746f3", "value": "d189d43af23bbb5425431a74f9f591c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860580, "uuid": "119289ba-ab4e-41d4-8fdf-c452f6facaa8", "value": "3072:mUHp3UPrWp8GCSV0pdmp02MDJivyghDNczW:rJkPrWSdSVh02hNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694860580, "uuid": "b2296c2e-44f6-475f-864c-63d926e1b0e6", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694860580, "uuid": "3cc1f9a7-8fb7-49a0-962e-8768e322cff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860580, "uuid": "c4e37a8f-6c18-4f03-b4d5-c843fe21f0c3", "value": "SecuriteInfo.com.Variant.Zusy.489697.9601.4695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139edb98-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841339, "uuid": "c6d81d7b-0a3f-4630-b881-9de159b32e1e", "comment": "Malware payload (Mirai)", "value": "9eb2367bd5c321c346eac1ee9aa8bfdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841339, "uuid": "5897c67a-6838-448d-9fd8-47d4f99ae12a", "comment": "Malware payload (Mirai)", "value": "1b8927152ad23d41a5003d01ab4b8c3ce5ccbb63bfda9a5480d5de62ca908ca1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841339, "uuid": "7c2b5135-bd4a-4200-897c-f17e83072b1d", "comment": "Malware payload (Mirai)", "value": "7fb24118fde02b90b064cb87801ffdfb7d4b1b5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841339, "uuid": "22b5385d-98eb-4b40-b9c5-3f8df35dc367", "comment": "Malware payload (Mirai)", "value": "ce8c82247b29cdcf57fbffda2e1baa6f0a15a6e69517a75cc72381b94dc7c0dd94437289ac7ea965bd3df789bb4589d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841339, "uuid": "8d457831-34ef-4ab1-a827-cbfc357fdb62", "value": "T1C0336C36E029DED0C6560134A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841339, "uuid": "e6328d3d-524b-4bfa-b3cc-6d8b04a80282", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841339, "uuid": "b04cde63-10c8-4454-8823-56c6797345d7", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841339, "uuid": "4e22dc83-2625-45c5-977e-4a257d8bdf68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841339, "uuid": "517f71ac-a1e4-4818-b6d0-51d5df591799", "value": "9eb2367bd5c321c346eac1ee9aa8bfdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a702895a-54a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694878523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878523, "uuid": "e4bab158-ac6b-489d-8a82-35f1198ae869", "comment": "Malware payload", "value": "a7063611eb06ea4778895b3630c97a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878523, "uuid": "72eb2e47-8575-4191-8b3d-fd4d18149273", "comment": "Malware payload", "value": "1bd1f4a2f04635207558b2c8b98234eba7ef88fd2f3a9823d1ec3dcbed62bded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878523, "uuid": "27aec1d3-161f-4451-a98e-1386f7f76b03", "comment": "Malware payload", "value": "3df62fbb4ccf03425eb5790495b43932a57a8db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878523, "uuid": "eebbe6e2-5025-4c45-87e7-b286af875ba3", "comment": "Malware payload", "value": "7b91df6596d48dbcf0161f6ad86d0106546aa96ecd3468dcda11f6aec04bbf30d192fcb2976aeb1fb30c839604738871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878523, "uuid": "09c96c63-3f6c-4a95-afb4-f2fec379ccb9", "value": "T17EE5230237C557F2E1B254339A39EB40B52C7D344FA686DB63C05D1EEA622E06932F79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878523, "uuid": "b907c19c-912d-4e2f-8d20-0c5d7248127e", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878523, "uuid": "e1cb019d-9a54-4352-8a36-28a34a4e82af", "value": "49152:rLLpJcN/nuu6qbuRsVoVjukDJgS7NlfSamZUwxPbLGgvkqB9ZKT:rh2unqbuRaMqkyS5lfYNbBvn98T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694878523, "uuid": "48e2b158-c21e-4dff-9405-d3af4cd60bfb", "value": 3209947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694878523, "uuid": "8f8aa363-ad28-4d24-8f01-a5c7871430ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878523, "uuid": "668c2771-0d6a-4cb4-a5e1-4f442daf6559", "value": "SecuriteInfo.com.Trojan.Uztuby.4.962.29039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb08deb-5436-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694830513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694830513, "uuid": "ff08e5f9-ba60-48ad-8fac-6dd47e5b8a72", "comment": "Malware payload (RedLineStealer)", "value": "8785936e87d2736df80256b494473596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694830513, "uuid": "351e56ae-76e5-437d-a5f6-de0f14f44b1f", "comment": "Malware payload (RedLineStealer)", "value": "1c20d625d138b20e5c5ac13a3fcf60b7530ad0fbd6ecc95b30c995aa54c6046a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694830513, "uuid": "44178b04-5a73-45df-96f1-465598aee0b3", "comment": "Malware payload (RedLineStealer)", "value": "85ed9b83d48fe9ac00c1bab3c3ce2640dbb39c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694830513, "uuid": "f3fb9a51-7f0c-4bf9-af44-31ecf4fd0e2f", "comment": "Malware payload (RedLineStealer)", "value": "05d8eb7de3a491f94542a62dcd0943198d5c2b7a4a1ffc06a67ac2c3ce3e6acdf3ce6104d31b1e2165beaa0e153c08ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694830513, "uuid": "7ed6782b-86af-4928-b407-c5695c87498b", "value": "T1B1B5AE166262CE1AC7962B7BA45288584BF1EB427263F31FDE7F21972D533B10E413D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694830513, "uuid": "738cd3cd-5c5b-4543-a415-ca9367d75244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694830513, "uuid": "dd32e8f6-1bd2-4d11-9a20-576198be19d9", "value": "49152:1TrAfrzERo+CQPFQlA7876XreAvS3Zuu+irFak3ZO:1TcfkRDG6aAq3dFaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694830513, "uuid": "cc0948ce-c1e3-4c91-982c-72f6ba992819", "value": 2279936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694830513, "uuid": "f94f3d0f-3a36-4a8b-833e-fffa75724fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694830513, "uuid": "b04f65df-2422-4a04-a9e9-bdf46b7db939", "value": "1C20D625D138B20E5C5AC13A3FCF60B7530AD0FBD6ECC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522340fd-54d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694896420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694896420, "uuid": "214ee95a-9d0c-48c0-9d4b-448759cdb7d4", "comment": "Malware payload", "value": "7bb95824bbafffc024332a3d3160b236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694896420, "uuid": "38cba94c-bfd5-43d2-9f44-60b59f1f951f", "comment": "Malware payload", "value": "1dbf49feddb03d2094466652382ad174f0a44f9ffed20ec55d0dad744b0ab5bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694896420, "uuid": "0a8df0a9-169e-40b4-acfd-b8a1ea0fe54b", "comment": "Malware payload", "value": "8fd57c76c854e6ce910183aa4004b172302f60c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694896420, "uuid": "b4076ebb-9279-4e2a-bcb9-80258c4fdfae", "comment": "Malware payload", "value": "41596bb5f055b4b3180e54e9d473d9765e76a3ffa2576c02e8a4f6c0ed9d998b60d038a03aa16d73d0be0598790d791f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694896420, "uuid": "1457673d-904a-48ea-a736-0c0253f95c8a", "value": "T189E5338175C08771C27B08326A64D664B23EBC501B35CACB63A1C76D5B7BAC09F3679B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694896420, "uuid": "427f9285-c819-4bb6-8f3d-6ca4d959a50e", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694896420, "uuid": "98fa642f-02f4-428f-82e7-2858a9d07e95", "value": "49152:nILlFSaC/Nu5NhERKqtCl/EQYy1qpfB4lTMiS9n3DQuGJgHAyO5ZihS4CPOxxadv:nMlyN8aKqY/EQ/gkd3uFH17SSxP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694896420, "uuid": "fbc70752-aec8-4513-9213-24ee2260a77b", "value": 3285078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694896420, "uuid": "4e3683a1-2c7c-44dc-b3a3-b3241ceac08c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694896420, "uuid": "660df660-b6ca-4690-8f15-eadf24880ccf", "value": "SecuriteInfo.com.Win32.InjectorX-gen.16405.6884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb73bb6e-5460-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694848520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848520, "uuid": "92336dd7-be9f-4bbd-b5c9-eab4546ff870", "comment": "Malware payload (CoinMiner)", "value": "7fa546aba2dbd4ed160339246ab8b6be", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848520, "uuid": "cd794f74-53c7-4be4-925e-c16c49624555", "comment": "Malware payload (CoinMiner)", "value": "1df5c1a5b3e7724fe0db734fc8ad007f7f346cb02765050c05820d127df94b86", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848520, "uuid": "a62442df-d742-4f2b-8988-a021d11f175c", "comment": "Malware payload (CoinMiner)", "value": "d4fa5e14b9b0284e8837a77d62c91d6aba5c2eab", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848520, "uuid": "7c16389b-5e45-41aa-b2fa-1af6f8e0be0c", "comment": "Malware payload (CoinMiner)", "value": "cea7cea7d0b91d89489e41ca0457bb1cdd8ee5619f8d112f6c7256e992d3639f8728b8a09ecb3c0360f240c8a66705ae", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848520, "uuid": "7b189de3-65bc-4b34-a285-585fa25142ca", "value": "T11B547D13B291B961E5124B329E2ECAF4262FF9204E6B775BD3185B2F05B31F1C5E2750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848520, "uuid": "2c842875-8bf8-466d-bf50-27db6568b002", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848520, "uuid": "83ce0c3f-714e-431a-8577-03f2cadc41a3", "value": "3072:jbabgQYvylv4QPQXx4CnO1cIILEG5Og+gvaDThIR7vcryIMzJ4Nw:PaMvylv4QPQXeCvII1ldvaRItJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694848520, "uuid": "03493b11-7737-4214-977a-0050e34b888d", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694848520, "uuid": "2b37c9bd-7934-4909-8ce5-ec4c74dbfcfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848520, "uuid": "a29685d7-01c7-44fd-b3e6-08eb5dd0152b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f29559b-5441-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694834916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834916, "uuid": "571d02ca-a61e-43dc-936f-e21440e7dab9", "comment": "Malware payload (MysticStealer)", "value": "f9e676603b5ea3bd54d41ee75664ea1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834916, "uuid": "bfabf24e-c4b1-4cce-b7c0-46d61c594a35", "comment": "Malware payload (MysticStealer)", "value": "241bae65439f912b6285d92f361003ecf704ef4202fef9e96604ac9755150fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834916, "uuid": "91eb255c-0679-4c28-a56b-052e73845f54", "comment": "Malware payload (MysticStealer)", "value": "1b09094dc25d1dd2decd1a0f75373629be152a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834916, "uuid": "fc9de386-a161-4fd9-aad1-6bf1ffbffd08", "comment": "Malware payload (MysticStealer)", "value": "a35cf18cb5e447f0e2a4bbb5bec9058162f2b550b70bc499a5a6692c25f2d76ff6e215d34becb6a5db7da6cb76016523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834916, "uuid": "114ee5c6-3d42-4163-95c2-90b9c701904a", "value": "T151749D10B681C172D972513289ECC6E4753DB8608B7A9FFF53BC0E6E8E201E1A5356DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834916, "uuid": "428f3c5c-fd7a-4bbb-9dc2-6a5d8838c155", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834916, "uuid": "49423bfc-4ac6-4166-9b22-451dca9e17f6", "value": "6144://dXR/bOEHHkwxOSeyCKrJz4AOso8mZFnBBCn6Vf2Z/in3y8fi:ndX1aEHEw94Co8mTBMI2Z/F8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694834916, "uuid": "9a67427f-8bf8-49df-ab67-8cd1c27c2277", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694834916, "uuid": "fc19a563-ceef-4fbd-836c-bef80f113190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834916, "uuid": "bbbcbc64-5010-4585-9324-37e48b326266", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215538de-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694835779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835779, "uuid": "392f836d-b19e-4ad3-93bc-252e25a226dc", "comment": "Malware payload (Mirai)", "value": "42ba9b5213b82701693f3e12622ab8ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835779, "uuid": "deb7507e-8635-42f6-b863-497b29ca205e", "comment": "Malware payload (Mirai)", "value": "25a25f1a857eda3c6e62e8d2831b5ef208a27cd396f3c350be08db41f4556bfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835779, "uuid": "22bce9de-2547-487c-b897-2aef24d6d2eb", "comment": "Malware payload (Mirai)", "value": "cb19b908ff1d048a31f3de15c8a9dd18646121a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835779, "uuid": "e27077bb-a126-4ecf-85a3-5d0f7b2dadc9", "comment": "Malware payload (Mirai)", "value": "7106e2554cd4c721c9deb688e27865adc33b9da158f797de3e2846ff711d65981c6a0336751bb6c2a59b383774309043", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835779, "uuid": "35bf1c48-983d-41bd-a5a5-8900a432945c", "value": "T130934B31B5391F13C0E1A47A22B74715B2F257DE25A8CB5F7E720E5EBF206502907AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835779, "uuid": "f6e38600-08d1-4b0f-ba71-605436eb08ed", "value": "1536:qMFTwcvMNWuJEZewCOcLv4ZpdEhAxDSnTD3YhCpUr2FT59ZtEQHc:3OVAx2nHCq5FNuAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835779, "uuid": "a65f72e9-0ef7-4058-a3b2-bc2497df2734", "value": 91472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835779, "uuid": "badd8cd2-ec4f-48c1-9786-2bb5bec594ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835779, "uuid": "6a558d88-eb32-4e46-9857-eeff10123cd6", "value": "42ba9b5213b82701693f3e12622ab8ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05953d4b-5487-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1694864938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864938, "uuid": "7b0b1253-a6a0-4f1b-b6d1-def3b2f86587", "comment": "Malware payload (Tofsee)", "value": "3e90704c45da9d02010aacbff50d26ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864938, "uuid": "bebb7279-4986-4fc7-9930-2ea49b33d92f", "comment": "Malware payload (Tofsee)", "value": "25afca27a502b381d25bada62119a8462e372d369bf880bd5f1da366572f5849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864938, "uuid": "3423cf60-92f2-4ee0-a40c-aa367c1eb6b7", "comment": "Malware payload (Tofsee)", "value": "ec2f7ca465a7e5bf8be385a5aff7f00cdb15bca7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864938, "uuid": "f3f07543-aee2-489c-bbd9-d7551b6934f6", "comment": "Malware payload (Tofsee)", "value": "d3d444f6037f3cc174e2a58e13d3115b770ad1b3459e2cfe77b3e7d4a487881d6e8b7c496c96730f1906e5ad67cffde0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864938, "uuid": "3f4b4439-db61-43c8-a264-6030dc7a9cdf", "value": "T17C546B0292A07C10E72A4F769E2EC6E8261FB9214F68B7BB52167B1F04B1DF2C173755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864938, "uuid": "dfb9b84d-ea34-4321-b01e-bd3af642ea81", "value": "d189d43af23bbb5425431a74f9f591c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864938, "uuid": "b352a08a-85f4-47ab-8483-1fde46abeef3", "value": "3072:Onl0kPNTVxpZLM8IveNUjqUax+eDhZk+/O2zcADKIt:QlPNT3vM8ZU1a3tC+W2zcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864938, "uuid": "a18712b4-47d1-4495-b194-45e3375a8c6c", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864938, "uuid": "3086d57e-4a36-4f5d-a7f8-b3d06f80b0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864938, "uuid": "80e51711-9f17-4dfc-8ce9-f3d3b32ebeff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418e89e1-543f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694834115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834115, "uuid": "ea5e377a-5550-4bce-a636-2c2eb4bebd61", "comment": "Malware payload (RedLineStealer)", "value": "a0e48b77cd0c5a19d00bad86178cd8d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834115, "uuid": "dc98db55-093b-484e-9b77-1119499c2e7c", "comment": "Malware payload (RedLineStealer)", "value": "2670f424e6bbfd93d5b2e6a8eff45084544803d943d55e55d0a78f4098ceaa26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834115, "uuid": "90843095-1e8d-4907-8400-07749995a69b", "comment": "Malware payload (RedLineStealer)", "value": "f0eb537d558f007efc8c1ee326be17ff9e2f901e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834115, "uuid": "c08a96ba-8f0d-440e-a574-f1a6590e8835", "comment": "Malware payload (RedLineStealer)", "value": "06958eb5f7e279370434eee793b4b91d3b9fd344258e2be352d5d181d2709072055687973e873000b4b55458245295af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834115, "uuid": "e4b4191c-b779-498c-a47b-38a46435975d", "value": "T1E5A35D3067AC9F19EAFD1B75B4B2012043F1E08A9091FB4B4DC164E61FA7B865917EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834115, "uuid": "dfc0df18-f54c-4fda-974d-57dcd88aef1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834115, "uuid": "ce885e91-cd3f-4fe0-b6b1-21801615d512", "value": "1536:BqsCWqm2lbG6jejoigI743Ywzi0Zb78ivombfexv0ujXyyed2ZteulgS6pUl:v9B+Y7+zi0ZbYe1g0ujyzdlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694834115, "uuid": "888028ae-7db4-4757-a903-0e0f27d19505", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694834115, "uuid": "4ea30840-dcd6-4427-8da6-78398e52e95e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834115, "uuid": "4a20d317-fa7f-45f4-915e-2342d5cdf08a", "value": "a0e48b77cd0c5a19d00bad86178cd8d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fadd588-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841333, "uuid": "648e8315-111f-4193-a0c3-5c45538479fa", "comment": "Malware payload (Mirai)", "value": "08d211cd6c6dd01b526b8fa08adf3e56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841333, "uuid": "1d3d9231-49b7-42ff-ab52-3780e0c922a6", "comment": "Malware payload (Mirai)", "value": "284f4b205e9da90b5f436a7d4713f4f7e310317c347379b59e9a53ac3ab693d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841333, "uuid": "3c9341da-7176-41c1-85fa-d8a02012bbe1", "comment": "Malware payload (Mirai)", "value": "b28562f92ce4de01cba6831963bb703c14b6de59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841333, "uuid": "1b9d07e4-bd08-450c-b706-8b4ce648d973", "comment": "Malware payload (Mirai)", "value": "04b94f7f49eb8eab296a1f4e141a38a8f279eb4ad2c5944c4ae449403184917cde64590c28aff0d3462fed56e5d0f9c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841333, "uuid": "5870ca4b-dc0d-4a34-b8b0-793ffde57e04", "value": "T1E9230271880F9EF124303C76EB999393AAE12A71C6673023D6290E382F757531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841333, "uuid": "6063170d-d41f-41cf-a803-0c893fd9ac32", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b39E/9q3UELbUXfi6nVMQHI4vcGpvr:DECFd+A6YHAxiuLRQZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841333, "uuid": "d5fd37e6-df61-4d20-b933-044bc34d94d4", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841333, "uuid": "7db2c45b-4310-41c4-931a-810b784a2d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841333, "uuid": "5d3b0d3a-e80c-4eb9-afb5-c2de529bdd16", "value": "08d211cd6c6dd01b526b8fa08adf3e56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9b37b0-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852469, "uuid": "a0335cc0-65b3-4f94-8e5b-518884da0f76", "comment": "Malware payload (Mirai)", "value": "c5472484e29995c4773acdc878df1f66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852469, "uuid": "c9688f5b-5f98-400b-85ed-542fbe89dcd0", "comment": "Malware payload (Mirai)", "value": "295b2b6dfc7f46792ec9201b28bff644664bb45c82f98525b2a9d22f279a4c39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852469, "uuid": "5877f212-d80f-4ee6-928f-e6b8f38c1d76", "comment": "Malware payload (Mirai)", "value": "0a6769d13c760fb115166624ac050c1cc30533dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852469, "uuid": "a3e24f44-0557-448e-a49c-db4a3f86bbcf", "comment": "Malware payload (Mirai)", "value": "431b86faff1121b42299ff3d27900c74865b7c39bf9663c5af8390325c0544fa7391f4725bcaa56975d07a9cbf33715b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852469, "uuid": "7b4ed3c8-07bb-4cef-9919-f7dcffe8784c", "value": "T1B5B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88773CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852469, "uuid": "f8ce71bd-daa5-4743-9ba9-399a34e504c8", "value": "3072:MDVLSItJP+Xsp4JlN3H8jmH1cuEgvniuN/:MDV+ItJH2l3H8jmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852469, "uuid": "cfa3ff3f-a014-42b5-a8b1-cebc9a4bc641", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852469, "uuid": "796b8b8b-0263-45a9-ab0b-5a1903eaeec2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852469, "uuid": "1dde4430-6aa1-46cf-9cb8-d065e220349a", "value": "c5472484e29995c4773acdc878df1f66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5af4b7-54c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694891041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694891041, "uuid": "00ad6d9a-70fa-4f3b-819f-c5cd7a2145d7", "comment": "Malware payload (Smoke Loader)", "value": "0e7484fe60bdb1a5df6d2ea412f9d4b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694891041, "uuid": "dd97cb26-b0c3-4e5a-8fde-009e080610cd", "comment": "Malware payload (Smoke Loader)", "value": "2cdd69c31af8dbe568ae6233c67b3ef96f32dadb024212f05f96d412c44cd124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694891041, "uuid": "ca6aa31d-6905-456c-ba2b-368c7e026bbc", "comment": "Malware payload (Smoke Loader)", "value": "f72a6e76f744aa7f8ac7c0eb159b42ebc2606e93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694891041, "uuid": "59a010ee-bf9c-4522-8d01-bab269253202", "comment": "Malware payload (Smoke Loader)", "value": "33fb7dda0ec367446eeaa9734b7cde8e2194256b5ebe4afdd39b1d59e54099b55669b0e741db83090ee071fc8f2fbf01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694891041, "uuid": "08033800-ce8b-4ab5-9ad1-2b56aae23970", "value": "T12844BF1263F16C20F72A47398D2EC5F4762EBC624E68977A2207772F18B0DB2D563719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694891041, "uuid": "6ad3c701-588c-4444-b2d6-33e55ed1cb6d", "value": "bb9eb0cb309094dee794967585ee1533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694891041, "uuid": "63e06dac-fa6c-4012-a70a-0b78f4e457fb", "value": "3072:aotqPw9tZrLPydf1QeEdgoHp3DCtej7dMCBMy:aNI9tZfP0uBFDCtetB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694891041, "uuid": "8f800b0e-12f5-4f0e-b6c7-a0772d3d77d5", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694891041, "uuid": "6d328337-4f51-4761-a043-af6d0be3ad4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694891041, "uuid": "0d8cbf33-b1cd-424a-bc32-72c4dff3c313", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d963fd80-54bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694887627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887627, "uuid": "e4330e57-84f5-4d11-b778-4816883ac36b", "comment": "Malware payload", "value": "59d79a9daba8c4513bba1ac19c0863f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887627, "uuid": "cac08e15-73bd-4d2d-9198-f7903179a2e6", "comment": "Malware payload", "value": "2f873636253d43263c430743c60a5dea61dcc76ceacfe280f9cedd07b1aab132", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887627, "uuid": "45bc66eb-4891-4de4-bde8-4579c6777cf1", "comment": "Malware payload", "value": "3c4b89d799776ca41aa3730c24d416434f291d3a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887627, "uuid": "aa25de2c-b708-49a6-8e9d-d2f1bd3a8c23", "comment": "Malware payload", "value": "1c94ec3ffc1152b9161418035703c59f4aba2c34974c026c9f2ea0fd7210c4ba4082aef8ea8b7b5afc34affc1855933c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887627, "uuid": "177f7c0b-ab06-44bb-980b-7d87df38bdc1", "value": "T1BBC4DE103BA4CC509B2D56E968DB97078B2756A7EEEFFF0306A28174492B96357003CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887627, "uuid": "b82e55df-6bdd-425d-83cd-36f390297801", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887627, "uuid": "51111832-8b70-488b-b52e-456e85e698dc", "value": "6144:/rqWiTMXQWgWj8+TKNtuk1VB4d0Ic1yQpI80C0LC:/ziUg0KNtHS0ACoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694887627, "uuid": "c1752db2-02a1-49df-af8e-b2a89ce5764f", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694887627, "uuid": "f7e46763-198f-47c5-9c5f-3b666b73d90b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887627, "uuid": "89d32ef7-a0a6-47a6-802f-a998035a7440", "value": "cABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZk5lBExG_FSuFVLkQORQi6YPMX7_JJdVVk0DE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f32137-5481-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1694862627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862627, "uuid": "1ba255e1-dfb5-4f9f-8376-3931f5c3d0d5", "comment": "Malware payload (XWorm)", "value": "14711210c0f7e1bd9af1f8dcf1c41f35", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862627, "uuid": "3e0731dc-3904-4f7e-9737-0e45d282a8e1", "comment": "Malware payload (XWorm)", "value": "30e9d6da81c87ab58d9575188664de49b2c434f6b1346a2a5033b49992254464", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862627, "uuid": "20fa7976-a37e-4d59-8d92-609a68933065", "comment": "Malware payload (XWorm)", "value": "4a48a0793671a0ad805b336e0e83268432f34d06", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862627, "uuid": "d6eabd8b-9a5a-4b17-8563-8b53a7522a29", "comment": "Malware payload (XWorm)", "value": "7e12a5d07ce9fa596bd640d9835da36b38f5afed6ebf8a06aba870524681048d48f57f7efb6754bd4504a5b656dd79a5", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862627, "uuid": "c624e28b-3cdd-4a45-9927-f58f93c2a11a", "value": "T1C1B412E4EE36B8A8F01AC2BB8364A91FED7C2217CDCA554E4935708419E7172FB065C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862627, "uuid": "42cde230-46ba-42a6-8922-ba76a399aa62", "value": "3072:gqaeEOk3gWdflsgC72aemzez6mTTEQOPM5TfL+E9waiWdsokN1cx24dG4mmjyVcT:gkBQgWp3emTuPqCESIdsfPcxLJ5xRsTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694862627, "uuid": "1258c760-4e07-4441-8390-f2b0ae3b4389", "value": 531985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694862627, "uuid": "56537b76-36c0-4843-b6ab-8b421581cd1f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862627, "uuid": "efbd87dd-cb1b-4a48-9e27-96e7d7bd2c93", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7827521a-544a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694838931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694838931, "uuid": "9963a48b-8293-4497-9413-dbe925e07945", "comment": "Malware payload (MysticStealer)", "value": "581f33b7150b77f2dc3a076f9f1de0f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694838931, "uuid": "76209cf6-22c6-4cd4-b35c-002ba73bde72", "comment": "Malware payload (MysticStealer)", "value": "33a096997eef79cb58caa36bde06df6df04d790873cc098468b3fb1d682f26cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694838931, "uuid": "161a8c42-5517-44a3-bc83-10b01e3f01eb", "comment": "Malware payload (MysticStealer)", "value": "9d2f77fe5e7ec8eec011fc07befdfe871150795f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694838931, "uuid": "a004977b-16ab-46b1-b064-daa22ef25491", "comment": "Malware payload (MysticStealer)", "value": "b30d01374c59459cd2ebbf2372efaf319c61a22eeff71628e120d2dd0e3c7f175df7574d8b31229f756c6148db9a125a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694838931, "uuid": "c4f65c18-675e-4b95-91dc-006b1fa2215f", "value": "T1A974BF08B7908036E47325356AE4DFB86A7E74644FA205EB67D83A7D4FD03C0EB70696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694838931, "uuid": "4a6c40ec-13a5-444e-b6a0-9a3c6fadae9f", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694838931, "uuid": "4375e948-e3c3-4338-9784-4aa4fbae5f42", "value": "6144:R/dXR/bOEHHkwxOSeyCKrJz4AOaLlXMca1XU8YQNjmrNqvY4kGVC8fi:ldX1aEHEw94k9Mc98YQNmrsvY428fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694838931, "uuid": "4ac8ea33-df19-40ec-a1d6-4597ec4fcd31", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694838931, "uuid": "9a997e01-979f-4d51-8757-2c3a61dea9c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694838931, "uuid": "70ee26d4-cf18-450e-9bb1-63d2e6f46340", "value": "SecuriteInfo.com.Trojan.Siggen21.29429.31834.28766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ba9a26-54ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694882091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882091, "uuid": "1cb361bb-8666-4490-aae6-48e59807a57b", "comment": "Malware payload (Fabookie)", "value": "173eb4f9c0dcbce62177b1cd4397a549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882091, "uuid": "6c89f76e-28d0-4d07-9849-f3b1729b2e6d", "comment": "Malware payload (Fabookie)", "value": "34a854115367951a8347c6134d3d484e12f5cdaf40364665682708ff2702717f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882091, "uuid": "c6c58405-19bd-4a91-a137-16afa9bd0f76", "comment": "Malware payload (Fabookie)", "value": "bdf17b961b6f3a505fcf7aeeb01f377262c83450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882091, "uuid": "57a82ee0-86ef-4b71-8cb7-5f07590884f0", "comment": "Malware payload (Fabookie)", "value": "3a39de8c4c5ae3f0849565be84a81d34454b9f795d187f344f30d1dd584e777e08cb76060244f1de0acebe7940b5ec19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882091, "uuid": "e23a07b1-2bc3-48f9-b509-f8b741811fae", "value": "T12915CF15B7A9E942E0EA5235ACF3D30AA377BDA0A30317C7745C691B3F317911C3962A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882091, "uuid": "91f1e595-5714-49e9-a14e-4e6a4761e1bd", "value": "02bc376d1ae63a2fef892492d891a666", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882091, "uuid": "9de58085-fdfe-465e-bc60-718741976017", "value": "12288:CuGetS/ITJqrraq/t2qny6xdRhMAK4vcmPEl0Io:+uS/UEn/tUIMGPEl0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694882091, "uuid": "7ef3251d-960f-435a-9d6d-1339f83232b6", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694882091, "uuid": "32f0d489-7e47-4e73-bbc5-f656fff78900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882091, "uuid": "086ba748-499e-4223-a73f-f7056d766708", "value": "SecuriteInfo.com.Trojan.DownLoader45.63083.12118.8880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e0ff94-54ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694882088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882088, "uuid": "56e1ea50-3707-4e1a-8716-f26e4bcb741b", "comment": "Malware payload", "value": "dd04d8c09d56d64b42b35c03ea1f7160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882088, "uuid": "cb792485-d85b-4875-a5a5-4b45106cad47", "comment": "Malware payload", "value": "34e973677d92ac014dc9ba760b88b29df4375cf0527518cf3f8e678dc58f0114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882088, "uuid": "fcfd291c-8d5a-4335-91f3-e52031f44dba", "comment": "Malware payload", "value": "68c851b4e5bbfeb8f4d07565f3bb48f27fb20005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694882088, "uuid": "0810ee3c-4edc-4808-98ed-251f6117e952", "comment": "Malware payload", "value": "a9ddcd794fd0382acf42baf04aa91a8674dbaae56faec3485d49a330b1e9da7374cd6507729848e5dd4036933f4ca8bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882088, "uuid": "29d37270-e81c-49ce-81ea-460d10b57ca9", "value": "T15715CF15B7A9E942E0EA5235ACF3D30AA377BDA0A30317C7745C691B3F317911C3962A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882088, "uuid": "59b5fd4e-2c81-46ee-a739-3d1ce68fe3bd", "value": "02bc376d1ae63a2fef892492d891a666", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882088, "uuid": "8fb61ce6-9e39-45f9-92d3-61813fe673e3", "value": "12288:CEGetS/ITJqrraq/t2qny6xdRhMAK4vcmPEl0Io:4uS/UEn/tUIMGPEl0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694882088, "uuid": "cb35b338-9ec0-45ce-bc85-c029ded9cbb5", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694882088, "uuid": "fb8013d2-8932-4be0-ab94-4359a2bf17a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694882088, "uuid": "83026f26-2bd6-4e0d-8f7f-0b90f4cebd3c", "value": "SecuriteInfo.com.Trojan.DownLoader45.63083.5087.1288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201f7f09-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841360, "uuid": "e1be6912-a6f1-4cd8-907a-4fc693381452", "comment": "Malware payload (Mirai)", "value": "5ae96b552417bb57949c18d92ae6e0fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841360, "uuid": "3dd9ab10-a5b4-4f24-88fb-4e8179235c0a", "comment": "Malware payload (Mirai)", "value": "37649a168529bf1415e10d50e7d425d04c6982936af3514689d67e1b1b1d1b9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841360, "uuid": "c7ebd35b-a003-4812-a87d-19272fcaa699", "comment": "Malware payload (Mirai)", "value": "43f7a0ed40f7829e91d5e09885068640e620bd47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841360, "uuid": "e5fcc159-76d2-41fd-9e62-04cf75fe4818", "comment": "Malware payload (Mirai)", "value": "6235242c39436929db9cc2c90f6e3432bbf5a4dd8550665ff4731ea1da726a72c045d64cef32e2f1e2c034ef9b9f9c2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841360, "uuid": "20742583-3b5b-49a7-b812-66e17b216ea7", "value": "T1BF82D03021AB74E8CBF14435EEADCEC667160BF9D1FC36A317586B388A4210651F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841360, "uuid": "11edc1cc-fae8-406b-a23b-9e713e4c4f23", "value": "384:MnozRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaPHGhymdGUop5h5lA:2sV0P6+kom0tVAoNvm+to1+s3UoznlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841360, "uuid": "988118bc-fbfc-4f12-8279-f8538cca12f0", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841360, "uuid": "88e21cfd-1c8d-4de3-9df9-473d2c82e40e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841360, "uuid": "79acd71c-1887-4528-8084-add091adef47", "value": "5ae96b552417bb57949c18d92ae6e0fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89407146-5444-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694836383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694836383, "uuid": "515ffe6c-6e99-477d-bd57-d787aa90b6c6", "comment": "Malware payload (RedLineStealer)", "value": "8aed2e8dca5b0bf6709b40d001006850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694836383, "uuid": "262d77e9-1f04-4a87-9791-1b5b54d6e8dc", "comment": "Malware payload (RedLineStealer)", "value": "3802d37e9c121d5932c859bc507aa8422c0e9887cfde51c969fd347f776d804f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694836383, "uuid": "7fd3328b-9ec2-41ba-8f38-605d8642b626", "comment": "Malware payload (RedLineStealer)", "value": "5eef58b70dfa43887d85f9c8bcd9c2075b7455c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694836383, "uuid": "52c4af4c-fde3-469a-a1db-1035f895ce81", "comment": "Malware payload (RedLineStealer)", "value": "8acf366d4890ba70436641fa3c59e9e49120cdbc5fd7e38acdfa3b835b2980cd889d4b5c0e1b6f17b781da80b574087b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694836383, "uuid": "fb51a028-fab8-4d5e-843e-3d05ef78357b", "value": "T17575AE7139C582F0EFF210F9469DB432526DA3A003E749D736D41BEAC69E6D26B36183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694836383, "uuid": "a7ea9b9e-1898-4590-9f90-bf4ebf62f193", "value": "7429a55998cdcbbefa3f6b7825280de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694836383, "uuid": "b4fd41e5-0d1c-42be-89cf-38babb38a05d", "value": "24576:84/kLASoMc42yNuvyjUD3mZiE9s73madiK4lnIDMe6:8IMc42yRg2ZiEu73wKOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694836383, "uuid": "b917c4f8-794f-416b-bee3-f5695244eb06", "value": 1695744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694836383, "uuid": "365726a7-741f-4967-a5c7-a9663313e4d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694836383, "uuid": "70a4b883-199c-4174-b4e2-35d7620b22fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1983c1a7-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694835766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835766, "uuid": "b43af2e9-8819-48b4-af64-b64ad89a3058", "comment": "Malware payload (Mirai)", "value": "e3507bc35382cbbc8f4139117f4ff3be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835766, "uuid": "987fa9a2-c55f-4615-a61d-2b83ded0c1cd", "comment": "Malware payload (Mirai)", "value": "39413f0c64b10095f5074579cacf8c350833b8bf3322a0e80baf09e8a8baf3bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835766, "uuid": "dd6c094b-f77a-40dc-a4d9-f7d35bb7eb26", "comment": "Malware payload (Mirai)", "value": "5ddd263b689ad5975ac30335f1d53b5276a41eef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835766, "uuid": "133e2293-0895-46ca-bd0e-497bd0203982", "comment": "Malware payload (Mirai)", "value": "9227ad5af1a378b5c8225360c4a830f9143d169e73747c9d3494774aabe1b37a00b609468af62ffb7e02a73ba1f4ecc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835766, "uuid": "7c15ea4e-dff7-473c-a8b2-62dee25c6140", "value": "T1B2A2D01091D65B31C5705C71BBA9CB0BA1A6037CE1B9323B273007955BCAF06997EDDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835766, "uuid": "8af7eeec-518f-4ac5-923e-0eb60b2ffd89", "value": "384:1jjCwY4OSCfT7zP+2X6e3OTE4xJlbNTLn9+S84Ym/rsZoDRMDIsI5uhymdGUop5W:1HQbT7v66O3zlbNTx+x4v/rs6MDy5usI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835766, "uuid": "6f839b89-3d73-4989-bc8d-7c641ee39cf5", "value": 22748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835766, "uuid": "3437d843-5852-47ac-a2d7-2d7424760dc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835766, "uuid": "d67d2a5e-72ca-4599-a32b-210cd664922b", "value": "e3507bc35382cbbc8f4139117f4ff3be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24e9cf7-5486-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694864852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864852, "uuid": "c06cf5e2-14f1-4d5d-827e-c3689ddb20a4", "comment": "Malware payload (MysticStealer)", "value": "dfd8cd9e6f608febaa0875cd71034ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864852, "uuid": "fe13a684-ddd6-4004-924b-ccdca235db9e", "comment": "Malware payload (MysticStealer)", "value": "3bc177dfd2b3f48c80a07dd0948a1e504bb1173d7bbfcb1167ac6c2dc00e0fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864852, "uuid": "fb40bd55-7106-4484-98f3-f5d7cd5d5bfb", "comment": "Malware payload (MysticStealer)", "value": "c3d8751f110db574c0785ecdbffcd22199e89008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864852, "uuid": "94664d26-6882-4e79-9952-68df3d2b013d", "comment": "Malware payload (MysticStealer)", "value": "63f10b2224eaf8ea9b359a995725679af7ddd972e22f62cfa9b4b6404647c4833b78854ac4546225a15ea8617ed01bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864852, "uuid": "17eb40d0-b8a0-4177-887d-e3b77631e534", "value": "T14E74AEB07580C871D8731D3A4AE5A67A963A7420079B46DBA3F4DEAF0F782D0F6F4056", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864852, "uuid": "a7a01077-b964-4d74-b47d-f8c3f9345096", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864852, "uuid": "99935348-1bdf-48e1-8cab-790b529ad7d0", "value": "6144:4/sXR/bOEHHkwxOSeyCKrJz4AOz+Km5TrZLvzThTs8fi:wsX1aEHEw94pexNy8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864852, "uuid": "3001d169-e839-4e7a-ba1a-802e8051bf99", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864852, "uuid": "27e115fb-78e3-433e-8067-56663d82a912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864852, "uuid": "269b225a-413a-4cbc-9e87-2c09f6b91b61", "value": "dfd8cd9e6f608febaa0875cd71034ce3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d87cc7a-549e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694874884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694874884, "uuid": "ac503236-6022-4758-b304-56a065998fbd", "comment": "Malware payload", "value": "042952067d67d17155e1d5ede3cb06be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694874884, "uuid": "39fee05f-9ba3-4dbf-acce-b9919b12d6ae", "comment": "Malware payload", "value": "3d3728510fa38eaf4d2d2801d2abb8b9624a2dbc660a5f52048036ba16fc72be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694874884, "uuid": "03be34ca-ab9c-4e2a-8251-bc22dd2bb207", "comment": "Malware payload", "value": "c530461c1a9a0797011e93ba5c5ce3a2f321c89b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694874884, "uuid": "412fbcf3-4826-4972-80d8-5acc20e58056", "comment": "Malware payload", "value": "713fa08a0082a984ec7f9c278a46332e8768e347802ffcb422f685d4a481640a74bc5e99c16835f79789c898e006773f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694874884, "uuid": "e3fe29b1-08bd-4e15-a0f7-de7aab7d9bd6", "value": "T11842B606C30042BAE4B745F661755229B93C8B7113506DC35AC3BC2B496BBF7BE306EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694874884, "uuid": "0ee12a4c-d205-4ec8-8041-7bc519057296", "value": "6eee0c386b26d7da0deb47988b854f66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694874884, "uuid": "518d0bf7-3b98-4305-bdd6-bced59b9600c", "value": "192:8QWDl74xLyLyTeWxL2SETZrip4pYgH06tSzGZbKWzAzNTYg:nWyxLyLyB+ZUQ3Z+MAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694874884, "uuid": "2e73a380-4cca-489a-8893-c7ede744d19c", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694874884, "uuid": "7136c5e6-a004-4101-879f-99324d813c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694874884, "uuid": "7b2dbc6f-02f1-48c4-ba0d-6c41d93c2149", "value": "SecuriteInfo.com.Win32.InjectorX-gen.28746.5508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440400f8-5486-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694864613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864613, "uuid": "d0fc5a2a-aa72-4f07-bb55-dd3f0f438a36", "comment": "Malware payload", "value": "e482476de6038a9c4bce8768b2e36aee", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864613, "uuid": "bac0f7b8-a0ba-470a-9056-dd73d62ad001", "comment": "Malware payload", "value": "3d3f0bd7a5ef34a2e60ed3c1a39bba4ab653e97db6ed65c584b10af86318e6c8", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864613, "uuid": "ba334511-4a08-4670-8e21-81a90d232888", "comment": "Malware payload", "value": "5a87389315a68f00f7e8558cec3e7d33c0282d61", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864613, "uuid": "22d7e4dd-7f0b-4364-8c19-99d440e128da", "comment": "Malware payload", "value": "ef254b8bd8abf241d92ab9049b00ee508968e52d140a95d8ce492a291ce51f118040987292bc7bf71d6f2233704c0152", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864613, "uuid": "2316b342-e387-431e-8759-3205d184a61d", "value": "T1D3319DE9A883DA450DF747E242048895CF56C1AB253A941F7B8CEC883F343E98AF19D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864613, "uuid": "0adf3781-6872-4efd-ab88-2344f109574b", "value": "24:KqaAwAiNRfX+Ir45wkQ1kLMBRH/zSXLtGL35Mt45FLZYvgGdGDEoG2XGV19I/Fep:QrNRfHE5wkQ1kKH/wkVMsF1YLoHc19I4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864613, "uuid": "132f0ff7-eb55-4490-8552-5b96bb5ce73d", "value": 1451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864613, "uuid": "3047b495-ce90-4931-acba-02b44d98592e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864613, "uuid": "d1b8604a-1d8b-4091-8638-ec8bc198a8ea", "value": "fud.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5993f34c-5435-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1694829860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694829860, "uuid": "a5363ba9-ca9b-421b-b0fc-abd98411e39d", "comment": "Malware payload (NanoCore)", "value": "fcc631505adee1c8b0d922049de0c493", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694829860, "uuid": "47446774-9c7b-4bc1-b13e-4bddb7084e09", "comment": "Malware payload (NanoCore)", "value": "3d5aa422a120da634ebad364a3af6cee0be02a23210cec73bf692bbee545d472", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694829860, "uuid": "53a130c2-7ccb-466a-8be6-1e3d3394be6d", "comment": "Malware payload (NanoCore)", "value": "33eea0ce0507009eb110676877f9badd94135202", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694829860, "uuid": "a7e18e37-a7f3-4718-8342-a7578893eb50", "comment": "Malware payload (NanoCore)", "value": "7403b8087bef512fbcea7951040a2907fca90a4e61ec03ff6e294fe7de65789c9a51a64bc4739dfa7262a56b2c9650d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694829860, "uuid": "edc5ec9e-d298-41f2-8265-3c1b3e633b3e", "value": "T10FD42240F265CF13D6B93BF608A64CA907B3DE0607B5F6651DC961EB2371F8601A0BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694829860, "uuid": "44811a51-6714-4ef5-a00f-b5b3d108e9bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694829860, "uuid": "1af5f2d3-0c3f-48a0-8e36-5f4abd83b519", "value": "12288:uG2iNeSFnSrFijvsxF5FK1iyQ9bbMvR43JRTRqq:uG1M7wMFW0ttbMp43J5Rqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694829860, "uuid": "9cb38197-9f4c-4623-9c75-c1a93fa967c2", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694829860, "uuid": "6aaf95df-0531-4c33-a000-29d5101569f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694829860, "uuid": "fc9d75af-bd8f-4b47-9801-6148b5998312", "value": "fcc631505adee1c8b0d922049de0c493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301c9d79-54c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1694890350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890350, "uuid": "00a9dffe-934c-45d4-9064-bfff6c7f7ff5", "comment": "Malware payload (Tofsee)", "value": "e34c43fe5992290c781753f2b03b87cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890350, "uuid": "cec6707f-804a-43cd-9c1b-db3eee37c6cc", "comment": "Malware payload (Tofsee)", "value": "3eafc20eecaacb30ab578ae3e94869025c587d94b3c01520f9fd829f9fd5a9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890350, "uuid": "7f970c87-f5ca-43df-b0ac-6847c3afa06e", "comment": "Malware payload (Tofsee)", "value": "aa07bbbf14b98bb62ed90f4ef57d222dc731725e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890350, "uuid": "05dbfa00-cd58-4319-8850-c3b7eb2b1056", "comment": "Malware payload (Tofsee)", "value": "19b48fa74a95609105f2711cd2ef61c6bfdab19f6bdd06a17661da374f6d2a0e616f6dca5f3dcb78e209dc1c4137f1df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890350, "uuid": "22245217-6c1d-4080-8bc0-6ab8d06a2fa7", "value": "T13E449F0392B0AC30E76E473D8E2AC5F4262FBC215D69A6762347772F0570EB2D562729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890350, "uuid": "b6d83ecd-e05d-4390-9da0-a0052aafb536", "value": "bb9eb0cb309094dee794967585ee1533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890350, "uuid": "176fc901-0add-4035-a76e-dfafa4732a46", "value": "1536:a4gEM8JQ97SePZ8THLAUIFfwPNlXrtkKJy6+hO8PcV/ExhHsUoYeafUVCEx7PjQ1:a4gEbQt0JSIBJTJNj8g/VU5UgExV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694890350, "uuid": "2b52cf5b-94c7-4fdc-acc9-c1eb2171caf0", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694890350, "uuid": "e756810c-27fb-4e47-a97e-98a0810f9e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890350, "uuid": "2c6f2641-96e2-44e1-94db-ab2879b72258", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55626b5-545d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694847275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847275, "uuid": "1640b526-61da-4c3c-b231-783a8edfecdf", "comment": "Malware payload (RedLineStealer)", "value": "1eba45a4af6963fb53a0fa356a3d867a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847275, "uuid": "c3e877ae-f7af-4892-98f9-d1941753810f", "comment": "Malware payload (RedLineStealer)", "value": "44c6cf15e97f4846fa04bfdb1e876b9ea5174f1fcd641a9344f6429624430af1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847275, "uuid": "20c450eb-d36d-48a5-a4cc-b800fcf05fb1", "comment": "Malware payload (RedLineStealer)", "value": "2af2047e8b9b9967cef1607b7ec3d1a02f28c3dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847275, "uuid": "3c50d4a3-98e2-4b0f-9848-f90d52afc6d9", "comment": "Malware payload (RedLineStealer)", "value": "4c9e4b65168bfd67b5d832ec08ec9a8f088d9bd9d6f2a63811f76b39da80dd3974c417da007bb1881dce5e286e08e5fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847275, "uuid": "2dac16a3-91ea-428d-b22c-1a4d0e2defef", "value": "T10F94C012A2E0B8B0D5164B729E2DCAF8262EF9204F6B7757E3185B1F05B32F1D5E2315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847275, "uuid": "4cc367b1-758b-4d8c-8d86-b4f74111adb0", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847275, "uuid": "35666f46-281b-443d-a4b6-ad4561167c32", "value": "6144:kPvvBigoF6oDoParOuIyJEz760ZihFS82kPvY8EvLMJ1:k/Yg1WCN1ZmFrPQ8aO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694847275, "uuid": "47f1642d-4eb8-4cde-870e-44a355afee82", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694847275, "uuid": "8487f669-e140-48e4-b368-913f26ea9d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847275, "uuid": "1d2a7961-5345-4619-9804-b9b1402b0c95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26124db7-548a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694866281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866281, "uuid": "5d041125-4456-4be5-8e44-1537397a1338", "comment": "Malware payload", "value": "4556ab83582d4d9e90854316c80db3cc", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866281, "uuid": "ffed7204-ef6b-4b98-af82-f40c0ef2d7bb", "comment": "Malware payload", "value": "4868b2ca4c9ec3ad14ba82c678316d7c43cf5081d2fadf2fa0cc592c84356b90", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866281, "uuid": "2758b010-d982-416d-a86e-47b358911f0c", "comment": "Malware payload", "value": "d1420372fa8bc962a9b60e2a8929c581e7e6cec1", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866281, "uuid": "5b777d8a-b69e-4492-91b5-b331a0ded5de", "comment": "Malware payload", "value": "f2b6b6ac2b542bd07a9bea8965f04d009ae244fd745519553d4f0c964f0010f4a7ca8bd909f1d83e21225248def48b25", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866281, "uuid": "b8e768ca-f55b-40ed-ba4e-933c2fcf39cf", "value": "T193B51220F5593571E95EC5B025F16CA413F2AEB8136B83C042B1BD6F92B3FB89EA0535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866281, "uuid": "545f2cb7-d974-4c5a-8cd7-cfee31061078", "value": "12288:N0SuaWyh0opZ0Q1Y8cdIZzDZZxKWXCMDx9eX55R:NvvroQ1LMIZzDNUMqzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694866281, "uuid": "4d59e68f-681d-41cc-8c74-5830da4a15b8", "value": 2483707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694866281, "uuid": "fb80c900-d2a3-4336-aa00-7238af16417a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866281, "uuid": "7ef32444-e934-4cd7-b94d-0f8df344e83d", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db54ddd-5467-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694851315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851315, "uuid": "0b9d0229-268c-4ec6-9ac3-1856b35eb676", "comment": "Malware payload (AgentTesla)", "value": "23189dc2f5accd014114c72ce654fe98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851315, "uuid": "81c1a6af-c502-494c-9497-46d609919f3f", "comment": "Malware payload (AgentTesla)", "value": "4987bc757cd10db18bc573b0b3bba52b79058500a0c1fdc08eb92dd1f49076a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851315, "uuid": "07286e8f-bd77-42be-aa91-d6afe6261d7d", "comment": "Malware payload (AgentTesla)", "value": "edd8ccb6ce7984df4cd35714d4f36d1c2b5c49da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851315, "uuid": "7a90e260-c513-4e42-add2-ccf681f444b5", "comment": "Malware payload (AgentTesla)", "value": "a56c5e228a25d99507d0cb1425a8cf73f112d4fbdc228c6c7273f76ed110f55c7b6a36e736b7bbb6b3dc33953c0c5bca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694851315, "uuid": "8918b74e-3134-46b4-916a-9a5320704e32", "value": "T11D25539C1C63920AD870143D7A97E4F48A243DBEC48595DB1DE2ED3BBA1D5C22FCC626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694851315, "uuid": "274e7abf-e7dc-4bd2-aafb-e8ae147d7b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694851315, "uuid": "b72c8f37-fd36-4b77-a7bb-bb20881ac4f2", "value": "12288:02NKVY7O6MavWMO6MavWX5opDJ1xGBnvTLeE0MKmeeCLVTk5dx:02NnO6MavWMO6MavWJoJjan7hILK5dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694851315, "uuid": "b476f55a-25e2-4b73-a216-1548db3c378c", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694851315, "uuid": "1052240c-876d-4d67-ac21-42b7135072df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694851315, "uuid": "c3723196-f150-434e-a02c-1ba44a9295f4", "value": "Quote 230901-VP.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3a3632-54c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694889431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889431, "uuid": "534ff302-29c9-46f6-ba17-e5c5d5645c97", "comment": "Malware payload (Smoke Loader)", "value": "57a97f8ec8b8a6efc1f4db6aac6c5169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889431, "uuid": "97c502e7-2b1a-468f-9cdf-ea80cece6853", "comment": "Malware payload (Smoke Loader)", "value": "4cf59b40ea20ed9a21d5a44d8cba91143803f0f4757f2dfcf1b017e6a4475c41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889431, "uuid": "35fdb340-a804-433f-b6dd-d60919d88d2d", "comment": "Malware payload (Smoke Loader)", "value": "f75ea3862f7dc27710c1034771e23a439ddc0780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889431, "uuid": "599105bb-8ade-4412-8450-171b94355c9e", "comment": "Malware payload (Smoke Loader)", "value": "42e03a4a7721916ae39aae52ab2da06bdbbd81e1c3d61c45b5c1c200393fb29fe90e2dcb5c93174e11ccb2968d185e18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889431, "uuid": "a714a5cf-1608-45ef-a801-2642a869cb7c", "value": "T1FE449E12A2F16C20F72A8B3E8D2EC5E82A2FBC114D35677A234BB71F1871D72D552719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889431, "uuid": "9f876f6c-61a5-408d-9a68-9fce8eb99ff5", "value": "bb9eb0cb309094dee794967585ee1533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889431, "uuid": "d950fe2d-eee1-419d-8381-accd280c8f8d", "value": "3072:aBv0hQt7JFiZ5KKrbWe6CQiymCp6XQudz7i7r:aWCt7JP7CQiymw2dd/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694889431, "uuid": "85920811-4e98-42ee-81e8-337986270757", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694889431, "uuid": "2856f8d1-8185-46c4-b926-6bfcf639ffc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889431, "uuid": "83b93d80-583b-4260-adb6-2a3f6c46fd6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f3b522-5459-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1694845214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694845214, "uuid": "4c6f86cb-3912-42ef-a3c0-f0fe7e910235", "comment": "Malware payload (QuasarRAT)", "value": "a68021631c71d0a33aaf605de9b2a64a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694845214, "uuid": "7047ee6a-d9fc-4e98-9f37-d4e776867f65", "comment": "Malware payload (QuasarRAT)", "value": "4d3570b47aa54653c383105500047551de5457e05a1d58ed341bfc43c279bcf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694845214, "uuid": "cc8c1b2e-f054-49dd-b795-132689229b2a", "comment": "Malware payload (QuasarRAT)", "value": "a0dee572bb0dd6b71faafc7b43a2946113a67f6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694845214, "uuid": "750be93b-b775-47ca-88c9-2439b3677e5c", "comment": "Malware payload (QuasarRAT)", "value": "c5d06357eca19588c3e2f359021b0652a43d1fe38358a6e4049e098346b0d3f89ee0283c6fe8c74232b56ba3b7d890aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694845214, "uuid": "6328a382-5f0c-41bf-a3a8-33288f972967", "value": "T132E55A0437F85E32E17AD6B3E5B0511263F1F83AF363EB1B6181677A1C93B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694845214, "uuid": "daeb25b5-b56f-476f-b368-5df8c7e2e89c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694845214, "uuid": "ccefe828-ad03-4a00-9199-48e2f51756e8", "value": "49152:HvyI22SsaNYfdPBldt698dBcjHD6FFoGBKlUTHHB72eh2NT:Hvf22SsaNYfdPBldt6+dBcjHD6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694845214, "uuid": "b103b4e0-faed-44d0-9be2-10acef7b5e70", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694845214, "uuid": "23fa9f99-1f55-45f2-b39e-8f4b0b0afe24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694845214, "uuid": "627f30d4-ffd2-4713-b550-1e81694d9228", "value": "a68021631c71d0a33aaf605de9b2a64a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f48d327-548f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694868390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694868390, "uuid": "1e7d86f2-ceb1-41f0-9099-4a49b17965f0", "comment": "Malware payload (RedLineStealer)", "value": "0ce4735ef6b7d77652abd32d08087704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694868390, "uuid": "e01d5511-afaa-4179-a6ef-d50c65c11849", "comment": "Malware payload (RedLineStealer)", "value": "4d689288fda075e937a5bc00afd4b2fb077d5aef8ac767fb415f8b7df31fadd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694868390, "uuid": "1b55d02d-17ef-4b56-9c39-9f8c99b3c8cc", "comment": "Malware payload (RedLineStealer)", "value": "3fbc5fc64467dbb77e66f93ab7430f21482a2bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694868390, "uuid": "e6f692f7-47f8-407b-b236-0a9c6ef0287b", "comment": "Malware payload (RedLineStealer)", "value": "9e047e06f5b16f768aeb9e470efb4669a9fbbada4be101a9120fa682d1494500484111fa6de3333ada223fb29bf703ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694868390, "uuid": "5f5ef2b9-b85c-4ca6-a178-c3dc33e356eb", "value": "T1B8846B1032E0807AFC361379AE6CD6ED34A56EB407B53C9B539D497BCA309DDD972A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694868390, "uuid": "71a1e097-a9ec-4647-bfca-db7acbbdff69", "value": "fc6316c96fc105fcdafe08845aa690ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694868390, "uuid": "d4cd972d-7327-4a87-b238-110da993dcc6", "value": "6144:6tcaGEZt20ZSwbz8+Dxe8kVAONlZcnvdT2iCcVO4GzCh8Ey:6tFzZtT78Trjcn1Ph8Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694868390, "uuid": "38f5b440-383b-49dc-8a7d-88bb001204e1", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694868390, "uuid": "615d2046-37cb-41a7-bc8d-222b8ba86a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694868390, "uuid": "a23c7c0c-c6c1-4ded-8193-4ea57b681606", "value": "SecuriteInfo.com.Win32.PWSX-gen.5037.28527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c82e8d-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694835791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835791, "uuid": "5b902963-8aca-4dba-9b63-d91a4a26dc2d", "comment": "Malware payload (Mirai)", "value": "e64d14ac1af1abcddce9920b4ed40bf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835791, "uuid": "9fdb921c-6844-4fcc-bdd9-31716823e314", "comment": "Malware payload (Mirai)", "value": "4e34c8fc22d5e1de3aefd7a7a10c43df3d263bbae033fec155f9cc463bcb48cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835791, "uuid": "5c7752ac-8bc7-44fb-9928-09d0bee6f94e", "comment": "Malware payload (Mirai)", "value": "626c227073dfcab8a58433c61e69015a46b82d74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835791, "uuid": "0d57cd57-919c-4a88-b0d8-e770fd9d8f2e", "comment": "Malware payload (Mirai)", "value": "6095c7e4c89f9af0325f1dd1a18e9d5774aa2c0ca530fb6c385606ab14cbb9f1767d413e9c2a847bc08a97431611a90a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835791, "uuid": "b0d0f12f-a7a5-431b-858b-f013de335333", "value": "T1DD931B9AB8019D7EFC0FDABA54120E1AB920579152834F372797FDE36D731A4AD03E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835791, "uuid": "ee7c992d-bc45-454e-acfc-dd73a000d0e9", "value": "1536:AU4D9umXLL2Qv3CMa17Jcts8YpAUwuMpusD8cDj3mNQwRznk:AUGuiaU2VctfTu88qgRLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835791, "uuid": "362d9361-ea0f-441d-9477-d7332245af5c", "value": 89704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835791, "uuid": "5b7f028d-2299-40e9-af95-8cda335e8bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835791, "uuid": "5a408b84-deda-49d2-8fe7-8ef5e35b5477", "value": "e64d14ac1af1abcddce9920b4ed40bf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53ae0af-548b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694866978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866978, "uuid": "742661b9-0cba-467c-b729-bd6caa39df81", "comment": "Malware payload", "value": "61eea96bae6e53b6806d974cf35877df", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866978, "uuid": "78609cc0-f38f-4d84-9f96-002b97765fb6", "comment": "Malware payload", "value": "4ffe91b2a78b1593857624143a33d0270cfc23c745f8290405aeeaff12521127", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866978, "uuid": "a261d95b-b514-4593-adc5-43fb6ef890bc", "comment": "Malware payload", "value": "74db733e988d90e6a0020e8bd99e13fb82b9e6f6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866978, "uuid": "85382e6e-83d5-4a14-b4dc-4161750f2e0e", "comment": "Malware payload", "value": "c8210524f2df730c3420d82f4de1401b75406384f9090d999fc65f47d022a973baadc546eaa1bf33ea2d03d7160f87b0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866978, "uuid": "cfc8504f-9e1e-4293-82b0-b41cdafc7fe4", "value": "T102C7237BB3886838D0378172CABA02573AD44E90D665C33B6618F23C79F7EE49291DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866978, "uuid": "88be17ba-9a39-488f-a90c-5907c71282b7", "value": "786432:B+FKuIkU5lmpRmqB8Em+O565QAXhZ+hM261clWigr/M2ji+/VQENlwZqPczt9EF:B4qkUMpDBHJOIaAX7+JXMqGuENIqkzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694866978, "uuid": "c3a74ca7-7c1e-42df-9a18-880a189d090d", "value": 53163729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694866978, "uuid": "051754e8-6aaa-4897-9d54-aea8b98119d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866978, "uuid": "f3714fa5-f07c-4c3a-a28c-3657eb6e3bbc", "value": "016be589(2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183089be-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841347, "uuid": "b854984b-7d01-4c6e-91f0-1fce6721043b", "comment": "Malware payload (Mirai)", "value": "f5710419246c4a88ffbaa63f7aa775bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841347, "uuid": "0f3aa8df-0738-4c96-b670-fbc35c5af5df", "comment": "Malware payload (Mirai)", "value": "504290437074a342ecdf0db41164e31e91458367faa6274a0e68c8b226ac72ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841347, "uuid": "0008e755-e92a-49db-8e9d-d6c44f6501ca", "comment": "Malware payload (Mirai)", "value": "963877f5eccfa34a29f21b96a541b13a1302c720", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841347, "uuid": "3737a07e-962d-4227-be4c-8d75c195544d", "comment": "Malware payload (Mirai)", "value": "93112b302f1104228e0f26b50fc1de85e8a5b629116cee7070b4232f36cd00cf901acbe34ed987178b73b3ea23ec2094", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841347, "uuid": "ce578175-e4d5-44d3-bf94-c07c4912f30f", "value": "T1CE33FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841347, "uuid": "cf18cf71-b235-487c-92e7-9714ca73e034", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGf:r/hqaJMcjeqK806MHdMfQXoHuCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841347, "uuid": "f7821b91-0a92-4277-b917-d3b24fce6572", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841347, "uuid": "0da482e0-c6de-4ac2-96e0-866e3f943111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841347, "uuid": "d6e180ea-c0ba-4110-8e7f-a11daaff1bd2", "value": "f5710419246c4a88ffbaa63f7aa775bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece0b0cf-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852441, "uuid": "90ecf783-486f-4e09-8bbd-0fec61863957", "comment": "Malware payload (Mirai)", "value": "6ddc6731c7e57af2bb21e945522ab3a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852441, "uuid": "5bbff482-b06d-4928-91e2-6afef5de3845", "comment": "Malware payload (Mirai)", "value": "55a4d5e830908bd0f8d0b2b78e1e59956ccdc4ed8b3d9fed6abe0665a9adffca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852441, "uuid": "d0780fb8-a882-4519-a0af-e059a8ea447a", "comment": "Malware payload (Mirai)", "value": "aec9de5b65039b0500f8ef3042b88d2779092e1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852441, "uuid": "a2b288f6-31db-4e8b-91a0-5784d130775c", "comment": "Malware payload (Mirai)", "value": "0a9ed2bb27da58484ef8b2d20986c0581c80d14b23b38ac66baac3c73b7ebbe6b03b4637780ce25c51d430881fb5de8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852441, "uuid": "946ea338-8e16-47af-9c26-af58b9bfefcb", "value": "T19CE32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852441, "uuid": "96e2809c-bdf9-43ec-8b29-a07c9b668a3f", "value": "3072:Cv/WwsLgaq353qHiCOvhOpgqkDQHbeskmhxQwoVSUNu:KPLaq351hOpgqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852441, "uuid": "7bd9d814-324e-418d-913a-396656763da8", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852441, "uuid": "f34a3ab6-dd29-4ce2-adfa-2f20730923f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852441, "uuid": "437e0310-5a9e-4a82-8bcb-fd6c35cbc226", "value": "6ddc6731c7e57af2bb21e945522ab3a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7b6295-5486-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694864846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864846, "uuid": "58c17051-468b-4064-a589-6a23e6c6aed6", "comment": "Malware payload", "value": "9f88b9ae0fe7903ba4f24f0ed5de67c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864846, "uuid": "868a61d4-b90e-4e51-a179-44c4c0dbe271", "comment": "Malware payload", "value": "56f15cf68dbe3cb2e751a5b82b206ce127695ce63c31c442773d45cdbd89b496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864846, "uuid": "b8d72c12-18cf-4b8a-87d5-3a25999e1883", "comment": "Malware payload", "value": "ba2c2442644473bfec02e9c05abf9992e011a14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864846, "uuid": "5b04e1a2-5bc6-48fd-ac0e-996222e144a3", "comment": "Malware payload", "value": "162680ab318646e013faab80ed983010a36ced1fb8d9363dbc7628aa10eca042d9647dab5d5a663269022281b82bb213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864846, "uuid": "32af5592-190a-41d2-9f88-e00cec0abac7", "value": "T1EDD5233176C28675E46329324BA59636BF7C7C700722CADB23581E5E8FB42C1A9347B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864846, "uuid": "23f6273d-ca85-4f2a-a83a-99ac2c50df74", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864846, "uuid": "e64570e2-5d0d-4e96-9b79-9f1e689723e1", "value": "49152:acbz6gQjfbaqO2L9SH1Vrg5RHkzx5YDuHfhemBaREzjVfsMMd1zD:acbPQCRS9Wg5REOuHf9zBEn13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864846, "uuid": "b1baf5fc-2153-46a6-9b92-8025b044ee91", "value": 2834755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864846, "uuid": "a334652b-fb6c-457e-88a3-b5668767607d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864846, "uuid": "7af50a9a-ac2b-479d-8e73-d186950740da", "value": "9f88b9ae0fe7903ba4f24f0ed5de67c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309baab4-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694835805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835805, "uuid": "f49fef1c-b854-4c3a-8963-9056882741bd", "comment": "Malware payload (Mirai)", "value": "6cc2fb67af248aeb947a4319ab6d1238", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835805, "uuid": "e3df71b7-34da-454b-9ebc-ea79b3650795", "comment": "Malware payload (Mirai)", "value": "57a0455a9bac4c92c98dfd65f35629be2695c4c261e139fdd07dfdd96577b104", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835805, "uuid": "df56e592-5c53-48ef-a5a5-6b4dd0789fc0", "comment": "Malware payload (Mirai)", "value": "530bc9683c1bf295d198acef2fb675ff7513b2d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835805, "uuid": "046b96ac-aa82-471c-a010-4b52794e43cc", "comment": "Malware payload (Mirai)", "value": "721af4af32475708f2f817f00b09f1f521e2669c28ec4088c81bfd215af6ab3b4b88c946996fc095a7307871bcba91ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835805, "uuid": "3ccb249b-78e2-4c4f-8503-00872a0eb4f8", "value": "T1044302848F7EA469C9603AA4A9DC87D13A16D7D8F1D86C8752DB0BBC71798070FE214F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835805, "uuid": "cab1fc7d-67e0-42ff-8993-485ff91016aa", "value": "1536:zcm7hsB563TK2ERHiGS/odGDJEG7dLVZDujTBfKi/ZJn:Nh80PE+/h2GJLDcgi/ZJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835805, "uuid": "202b0b4b-b381-43eb-968a-7b2218ce474d", "value": 60372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835805, "uuid": "76c03200-399c-418c-88a7-4d9de6b32618", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835805, "uuid": "5b4033c5-4442-4bd2-883b-b25431d17068", "value": "6cc2fb67af248aeb947a4319ab6d1238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6beff1-54c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694892845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694892845, "uuid": "5b79538d-3755-47a7-9847-36dd2d7de64d", "comment": "Malware payload", "value": "482156018c965752a5b0bf454032a4de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694892845, "uuid": "831c1a14-8342-499b-bb49-041d05ea2927", "comment": "Malware payload", "value": "59c437242579fb42f6753b7daa5f22e5785667637f18ccd543f853191159d3a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694892845, "uuid": "749295a7-f324-4193-a4f7-f8d0ed342862", "comment": "Malware payload", "value": "6dc26ff8b7ba82d01845d49e7ab34902103c6fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694892845, "uuid": "cf85499c-9989-4de0-a814-4212242f14a5", "comment": "Malware payload", "value": "9e9ab069a4c310380dcf561437234456d0b90dff8b73d6f51e70fc943ba0f27c8cf14702fcd1927f7a13c3da80461248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694892845, "uuid": "675134be-21e0-4934-9c5d-5b4ff0cf9530", "value": "T1E5E5230174C58A71E8B2287A0E254B20F67D7D718BB2DCE7C364A11DEA736C19A36773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694892845, "uuid": "135ea350-18e1-44b6-a721-44d5bc1ff6ea", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694892845, "uuid": "f9e43dd2-f884-4940-9779-a44ee79c4aaa", "value": "49152:nILD0KvPI6v2Th96GA643YZtLzuxS9ZukJUOssIeOUrTpaNJjmgAsNUx3YI3uU:nbKnI6eTOGY2hzSzOssPFRaNtAsqx3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694892845, "uuid": "ab62e648-f043-4ce6-abe1-ae6d83269835", "value": 3075366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694892845, "uuid": "e4cb0592-c9fa-49ca-b667-0e7e0208c028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694892845, "uuid": "5153ad0e-840a-49d4-a54d-b7fca48a8687", "value": "SecuriteInfo.com.Trojan.Uztuby.4.1535.14574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a632cb-5485-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1694864341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864341, "uuid": "7e8028ff-a242-4711-95b4-e9c36d6e9260", "comment": "Malware payload (XWorm)", "value": "a61b338118ae9dde86084d0b03235f68", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864341, "uuid": "f0aba80f-744f-49a0-b7ff-dbc1f5cad5e2", "comment": "Malware payload (XWorm)", "value": "5b3f77972c7cd3ebae7ab0b381e401e2851a00ec84a88cc847a65e823cdf72d8", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864341, "uuid": "f047c635-31ff-47d3-8f35-76d1a4e609ff", "comment": "Malware payload (XWorm)", "value": "9b5046737e08941f5ba21a55a7f2190a39d0380b", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864341, "uuid": "fd225383-44c8-40dc-86b7-76c070f320f4", "comment": "Malware payload (XWorm)", "value": "9bb94bccd3fc67126e9399d3ac29ed97aad21221364829e03be51478e47d68a0851e47624c2011b49bff5c2b7793a707", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864341, "uuid": "6dde09d6-21a2-4afb-bc22-54a432ec510e", "value": "T139B4125DE8E8E350EED8B4B44D5211304BE19EA427218BDC72F257BA2D3B43ED7845AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864341, "uuid": "39de0de4-17ab-4f10-8a4b-21fc681ee288", "value": "6144:QytHQnzpkqD3gyitnoFPrqBvAtcdL/L+20f5BnmKt8ZY2:QnzmqDQHGFPrPtclg5JmLZY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864341, "uuid": "fd8beb1c-7b15-45b1-a43d-cc82231a705c", "value": 532064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864341, "uuid": "f597c1e5-999b-4fea-82df-7b499c0814cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864341, "uuid": "81485003-3040-4777-99c4-3b713e6d8a8e", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06888b6e-5453-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694842606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694842606, "uuid": "ee948efc-78dd-42a6-a0de-9daf8ab91b11", "comment": "Malware payload (MysticStealer)", "value": "f79568858a39479ab5120f8e36fb80c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694842606, "uuid": "4425830e-41db-4a94-90ce-6924e5b3822f", "comment": "Malware payload (MysticStealer)", "value": "5b78e9cdaa400eae197b59f5f93c5b18470f48b2a6d0b86c21f9fc1f5671b9e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694842606, "uuid": "97ee69f1-840b-4cf4-a909-931cb86b2f75", "comment": "Malware payload (MysticStealer)", "value": "45b50166ef76677597cdfb4dfe730c72bf4c6045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694842606, "uuid": "08e005b7-8aa7-4afc-b5cc-8bb92b5ba7dd", "comment": "Malware payload (MysticStealer)", "value": "95298c6332dfa57a2b960d142523c462e3ed413158a0a456dd449f498bb6286cb1f63c343515086a78f53b595e9ee3f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694842606, "uuid": "06fa2ba5-b022-45e3-8be2-d33f73e7f4f2", "value": "T13D74BF64B5D18032EAB3183589EDEBB856FE785007945CFB57A80E6D4F343F0AA3116E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694842606, "uuid": "f756dd58-9f0f-4c96-973f-fd2cae3982d6", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694842606, "uuid": "aeb092fc-5bfe-4c21-b968-3eee1d48c9b4", "value": "6144:J/SXR/bOEHHkwxOSeyCKrJz4AOSumwAu4R8pt/0gAj1XnYg8fi:NSX1aEHEw94IhuYKOgq3l8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694842606, "uuid": "abd7dd11-0b5a-4269-9bbf-919803582a7e", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694842606, "uuid": "a61d9d03-9f74-49bc-b040-a9b2caf5bf03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694842606, "uuid": "b82ff6bc-f195-402a-9061-14ef3d575689", "value": "SecuriteInfo.com.Trojan.Siggen21.29429.29075.31514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb12c7b-5485-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694864118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864118, "uuid": "3e32a4a1-7cab-4383-98ad-0bf909494ba4", "comment": "Malware payload", "value": "697ed36d81d03f4f78cc7b9358f7c04d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864118, "uuid": "917e11d2-b3da-41f0-8918-1cfe7101b106", "comment": "Malware payload", "value": "5e11440cddcbb891c99c3f6b399e095838b8853cad172141dbbd33a742a45ceb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864118, "uuid": "7bdc0e3f-553d-48dd-9817-ef07f0bf7f14", "comment": "Malware payload", "value": "881f699ab8c431c3b19a4f016b56c8054192d71f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864118, "uuid": "7496b31d-8570-433b-97b1-438b35461983", "comment": "Malware payload", "value": "28700a7336050e3105fbb47497c7ce4af6c2750c4abe32312795258725132ad0df371cccd8a3ddbc602ade31e9b70ed5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864118, "uuid": "a32eca55-f80c-4560-ac0a-8dde63473bc7", "value": "T1F6F2F1779BE315534319487F93897EE4E01358F09E56EAEB67486C468E91130FC3EE28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864118, "uuid": "987ec7a9-ba9d-4269-b8d7-9d6e3444280c", "value": "768:1T8ejopTCDxRpdGyOhkQk7naU05afGkNK1grj88lukF:l8HpTCVbdkhkQkLX+kdrjtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864118, "uuid": "2bcfeb5a-b55a-405c-9ae4-d7e31583b60e", "value": 35850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864118, "uuid": "f21e95f6-4b0c-420e-8da8-c9d680fcfeca", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864118, "uuid": "33bd3afd-05cc-4f32-a565-5cea26942447", "value": "Invoice4323.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c0e398-5486-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694864623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864623, "uuid": "354441c2-59a4-47ee-ab7f-b3aa317cd03e", "comment": "Malware payload", "value": "924b3696dcb7b633ed36074e3b448391", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864623, "uuid": "1e6e33a1-f9a0-4e9b-bb42-342fe8de3c93", "comment": "Malware payload", "value": "5e2aac087ac2e87048babb984f6eea6e455be582079f4676efcf973399d7d3a3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864623, "uuid": "1fdbb6cb-c701-4503-a984-04e93fcf18a6", "comment": "Malware payload", "value": "4f87bf3bf37c48493c300f30810f80f78376950f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864623, "uuid": "c47f185c-ae7a-466f-9300-aa889713ebf6", "comment": "Malware payload", "value": "a13db182d6bda241175ce32359848cb53c9aa28dc09f3c5ff92bee599e4434b7fe03dbee7863eaea80943c20328d8218", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864623, "uuid": "972af87d-a33d-445f-b994-13a8779c8c06", "value": "T1B141FE03925C8323F3210A7150EA94A1AA362593FD82F30ED096526D14B2D09ED7AFDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864623, "uuid": "783dbec3-9cb9-4c1c-97e1-d068320d9df2", "value": "24:8iypvHeSHqUR51llUmWnzE58KOCj+7SyFaQvMndl3H:8ikv+S5R5tUfz0O7NFa773", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864623, "uuid": "facb7c17-4d37-47f3-97f2-ddbcba9df3eb", "value": 2048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864623, "uuid": "6fde5a25-b914-4b14-be6c-e73bf296e252", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864623, "uuid": "4bc23714-3e69-448c-9c3f-443126cd86f6", "value": "Invoice_33234.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d2a048-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841388, "uuid": "4d2208f9-1580-49a5-ba2d-a143607732c9", "comment": "Malware payload (Mirai)", "value": "b5c6460c0ace0ee4ec78e8cdfe30ad52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841388, "uuid": "ed104fd3-1f21-49ef-af97-d0c1e36c5aae", "comment": "Malware payload (Mirai)", "value": "5eec90a9598616fd803fc9f1943256129f06314d25ed3d959271c523296242ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841388, "uuid": "f1053bce-26da-47a6-9f85-81e03a8822fe", "comment": "Malware payload (Mirai)", "value": "84d89931992be6d8e36aebf380a0cc6a645295a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841388, "uuid": "d39ea434-0744-40e6-996a-0a5b3b82e5b5", "comment": "Malware payload (Mirai)", "value": "c23dd4f250f5872688044bb8aaf917da4d2904209460c99fb62a9fcb7b1378b0a97d5b1ed0a83587c2ce500896b047ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841388, "uuid": "a4ed048e-ea62-4029-a35b-57d984a53ece", "value": "T1B7B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841388, "uuid": "a300ee44-7451-4380-a0b2-07444e7f4e2d", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1u/LWy:c9sSyzz36YaWWgg1uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841388, "uuid": "e8fcca80-8aaf-49a4-b8ed-721e49cdc356", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841388, "uuid": "f2dd00e3-d2ed-4812-82f4-c25ef0803180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841388, "uuid": "2f4c821f-6d2f-4816-a41d-8d643542af9b", "value": "b5c6460c0ace0ee4ec78e8cdfe30ad52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582ebaf0-546d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1694853910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853910, "uuid": "28ccd7b3-3948-4932-9876-d847227d5af8", "comment": "Malware payload (NetSupport)", "value": "8ca771efc4670ff1928df792a98926bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853910, "uuid": "16517305-f4dc-4e39-8416-8d136ad4d47a", "comment": "Malware payload (NetSupport)", "value": "5fec37fc4c9527a6906d63a8c1231b90fa67eef3201e9ce2d0287eb3fa2319b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853910, "uuid": "be9789df-3960-4a80-85ba-450a245312d2", "comment": "Malware payload (NetSupport)", "value": "1fffc9ec5cd6787ab3e9006e2adeee52fd6453ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853910, "uuid": "ba7ead4d-1475-40db-8205-72691a5e2a9e", "comment": "Malware payload (NetSupport)", "value": "67f6332a76ca6378ae4315a017c15f956d0ef2e5eb06a5af35206e15ac8c972a055a10923423d889170d9e0c1abbd569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853910, "uuid": "18bfb05e-9e94-476a-b651-6efd0e188670", "value": "T177749E1292A17850E7294F758E2EC2F4661FB8514F287BBB631ABF2F00B1DF2D162754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853910, "uuid": "ea52a9a2-3fc1-4010-9e11-025f2d3cced4", "value": "d189d43af23bbb5425431a74f9f591c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853910, "uuid": "7e55872a-a6de-40f2-b436-1c019fbc592f", "value": "6144:tsPprUl6kbZdMmn3hxFg6B8QEatluad3yBrqcuEr:tY1Ul6O3hxuolEOMBrqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694853910, "uuid": "5daf9449-5719-449e-b8ff-70bee9a81b72", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694853910, "uuid": "5af3ef40-a839-439c-adc3-ddc290289bd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853910, "uuid": "75c6b8fb-6680-4089-8ea5-98c8879b607b", "value": "8ca771efc4670ff1928df792a98926bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae28ac91-54bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694887555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887555, "uuid": "f20b3a2d-41bb-43c2-bcee-9070fab42940", "comment": "Malware payload", "value": "7c055e203155b749a047987736400bfc", "object_relation": "md5", "Tag": [ { "name": "Elbie", "colour": "#403DDD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887555, "uuid": "0ef8e821-872d-4ec1-bc23-16634331c501", "comment": "Malware payload", "value": "60c24a4c6b54b1f4baeaee585e5e2486bbd3ab4733de36bb28da1fdb20596e21", "object_relation": "sha256", "Tag": [ { "name": "Elbie", "colour": "#403DDD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887555, "uuid": "a195262d-627d-4fff-b7db-67ed11ba8183", "comment": "Malware payload", "value": "17f48b45920e1f3e6581e60b0ed346b5770e8363", "object_relation": "sha1", "Tag": [ { "name": "Elbie", "colour": "#403DDD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887555, "uuid": "d0f18a75-fe5b-4978-b5e8-ef1b6d2a3f93", "comment": "Malware payload", "value": "487368b334fc4b13bb98a03ede5e0ac4ab5e5a4194288868d0826e8e2a65f531ce7aff5da836ac86bb52f10e2e7b7891", "object_relation": "sha3-384", "Tag": [ { "name": "Elbie", "colour": "#403DDD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887555, "uuid": "ca31f7bb-a38a-428c-a631-dcbb993becaf", "value": "T14BD39D45B6C0A072E7BA093115A0DAF1993EFC301B50EEDB6F4419769FA1AC28531F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887555, "uuid": "bf24fb64-715b-4d06-9785-5f43ea9f77cd", "value": "ca33a8184e94a42bd80f3c63b367c41f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887555, "uuid": "ad67750b-dc72-42b7-81c3-b92aa996302e", "value": "3072:UPgv1uTga8za7/aApO6fCR6kMgNjTX8jI8VD/dJJO04aN5uvvmRE7xIxT62Br09Q:oKZTMPVDdzR1N5sAxBN9dRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694887555, "uuid": "b84c17a1-17ab-4038-89ed-d3d6f0679bcc", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694887555, "uuid": "fa615420-33ac-4928-925d-f7c3626878fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887555, "uuid": "f4567f78-b75e-4e63-b1de-4a8cb13452e7", "value": "55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7b8c6b-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694835772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835772, "uuid": "90cd95dd-81cb-4ac2-85ca-f0caddf57945", "comment": "Malware payload (Mirai)", "value": "20ac27df60d78270c35f7cdbc94bdf9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835772, "uuid": "dec68534-0401-44a5-86d1-f503e03d80ed", "comment": "Malware payload (Mirai)", "value": "61493ad89b90bb86d96bb47e2937a26be083b75787a5bbab7c5d227a3939daf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835772, "uuid": "7c8388f3-90c1-4fd9-9101-3fb13b00880e", "comment": "Malware payload (Mirai)", "value": "48ce576b30e945bde5aee7516925e7634410221a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835772, "uuid": "11164c7f-f0f0-4a02-bb4e-e490f2c710d9", "comment": "Malware payload (Mirai)", "value": "2d67bf179c3d84a0d67ce5cb32ec20676e40dcf3ab3e25ca10c75bd890b3a29ae9dd6dba7282a254943c2f238ed2c9e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835772, "uuid": "b5bf21c4-c8aa-4d47-914d-7890f8632288", "value": "T1A7E2F121912B6D73C3B11431E8102FC5E276557977BE2076222EAD39E5C378766732F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835772, "uuid": "83426829-390f-46ba-ad9f-b8d3595c8f81", "value": "768:Kgx52h5CDRi1QYST9kV4fT96ftl9qtBvZYb9PGs3Uozi:R05CDRi+bT9kifT92OvG9jzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835772, "uuid": "1d34e1bc-1be3-4b41-848c-c63b3e8040c5", "value": 34208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835772, "uuid": "bcd28484-c024-4c31-a9c2-7349bd8b26cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835772, "uuid": "f90b729b-3a45-469b-9dc3-6f93ba82a6f2", "value": "20ac27df60d78270c35f7cdbc94bdf9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0bc9a2-545f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694847902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847902, "uuid": "73d1db97-9506-4187-85c0-5f55a3d46a0b", "comment": "Malware payload (Smoke Loader)", "value": "20b8b9466e5792188d0f309824fb13b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847902, "uuid": "b35ba491-e3b8-4f01-b887-24cc15623430", "comment": "Malware payload (Smoke Loader)", "value": "617bbc2f92c2f99cb9958a079822510e0a4269616924d3b966741b40f16cad84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847902, "uuid": "f4e62673-65d0-4ab0-8283-5a56e3a25f1b", "comment": "Malware payload (Smoke Loader)", "value": "7849b0bd1eadfc32b8a6128985b7ac50702fd958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847902, "uuid": "37dbf3e7-b623-4759-8abb-eabf5c4df82a", "comment": "Malware payload (Smoke Loader)", "value": "38f56b44aa9eaa9059867f9c70ce5737cab43e250e697e799d65fa86149d5cb6a349515211b930d98b6b1d0bbef3d0bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847902, "uuid": "e46bdff5-f419-4455-8e90-98292e5f729a", "value": "T1C5546D13B2D0B861D6664B329D2EC9F4362EF8214E6B775BE3185B2F09B21E1C5F2711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847902, "uuid": "42db8f2c-3323-480f-bf48-c4c87fbf19dd", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847902, "uuid": "4c1cc879-eb6b-4df4-8b7a-efe6e5650b8d", "value": "3072:L828Zg0gv68cKavf0L4japEVh62h2g9gwqqZbORwVrTJe4pxNZ:o286v68cKavf0cjapL2h2bYORWpe4pF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694847902, "uuid": "90f63749-b325-4569-a3fe-e19c973eb24c", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694847902, "uuid": "a9a482e5-054d-4841-8044-c42be0e44ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847902, "uuid": "e3bcd9f9-29f9-4549-ac99-3e9919a47966", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3298dd03-5465-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694850411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850411, "uuid": "3e553af7-eaad-41dd-8a36-04cf592e66c7", "comment": "Malware payload (AgentTesla)", "value": "c32b725e343ab11b63257fdb84acafb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850411, "uuid": "c62b2ccf-2586-4b44-bcf3-c5ef37f5f612", "comment": "Malware payload (AgentTesla)", "value": "62205b3a110eaa81f9e5e175e6708b7607dac880cbceffbb71024b7e3c6d3e70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850411, "uuid": "5170f6e4-193c-4cfb-a888-4dae7ea9c4a1", "comment": "Malware payload (AgentTesla)", "value": "91e919a3427b52062e6dbda0c4254ca38554ecae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850411, "uuid": "28f6cb15-ff4b-4811-a1a9-4b89a4d7cf69", "comment": "Malware payload (AgentTesla)", "value": "a77f6e2fdbcb3f8467aa6dbec00edc71b799293b16fc074d3ab2e9c9056d13dcf52218a047e599af6becaa5a10fb8b85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850411, "uuid": "68d1cb14-c146-4398-bf8c-da61956d76ca", "value": "T10AE423A373A7721FE1E918B0C46B2BE35358AE54A5B5843340ED572E6F42D4C6F0E0B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850411, "uuid": "5aab44f7-77fb-467c-86e6-b271bca491ba", "value": "12288:hTCjsLVAvgZZABBjGECHAM8qin8GShQZkkAyw6Q4NhQvUt8HkEwA:hOjuKvgU2ZHAMi8GjWyw6QqK8ukEwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694850411, "uuid": "78a1dde1-b34c-406f-8ced-9581d8bbe91f", "value": 694567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694850411, "uuid": "79c7b727-a9ba-428d-b30d-7346acd9802e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850411, "uuid": "e4c5c15a-177f-4296-b5b7-93318c731186", "value": "NUEVO PEDIDO - CF0002.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3de3d2b-5431-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694828401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828401, "uuid": "d42994bd-6830-4087-ad52-563b33847d6e", "comment": "Malware payload (AgentTesla)", "value": "81b4fcc5879171e8472c63fdfdc23f00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828401, "uuid": "5870b8bf-f6a6-4aeb-b0f0-82c4f27dd307", "comment": "Malware payload (AgentTesla)", "value": "647720247627b1a36405720d307ce33dc9487050c78fe58fbb76d5931a48dc79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828401, "uuid": "2debca9e-2ec5-4f74-89cb-3b26c1818c3f", "comment": "Malware payload (AgentTesla)", "value": "239a514af090103a5e5bc366f3e7aaf5a0975843", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828401, "uuid": "2eb93a69-88b7-451a-80d2-29945d0113e0", "comment": "Malware payload (AgentTesla)", "value": "2121d4c6626c9530a4e68a36a97476756a02a6d0f044a3d4bc103b76facb90896623f13281404ea6714b29b07907df77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828401, "uuid": "0be12603-8bd0-454c-9236-f99ff0c1e2c2", "value": "T17994F12567888F19D6BA4BF5E524062483FE742BB411F34D8EC5E0DD29B2F024572FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828401, "uuid": "9f3fc306-6542-498f-837a-53ccf0650c77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828401, "uuid": "4f19f97d-cefb-4c59-aa10-bdb53d0816ee", "value": "6144:fulQtAisFlI/l+VDvW3YV/TgUTQKA69a9rKWWsGCQiKO7sk8XD:XAisrRSYVbgiXaRKW7QiKCGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694828401, "uuid": "4698cf14-d1df-4574-97ad-e070f8df6ce1", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694828401, "uuid": "e5ba9515-3b59-4c9a-aba2-fa4f08e4deaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828401, "uuid": "c1eee8c0-7aed-457a-baf4-8232e6ce89c9", "value": "SecuriteInfo.com.Trojan-Spy.MSIL.Agent.15631.1681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc6a2c5-543f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694834300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834300, "uuid": "0c80e265-ce3c-46bb-9cb1-f18220219d34", "comment": "Malware payload (RedLineStealer)", "value": "1198c170d3a34388846e08af604f53e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834300, "uuid": "0d6ab127-6d69-45a2-b961-18d848cb9ddf", "comment": "Malware payload (RedLineStealer)", "value": "648aa939a0bb4177d337fe526bbf2b7c70a797fe359c75c7c7658839604a4999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834300, "uuid": "b4d5e46c-60f7-430e-9ca7-2e490f99d603", "comment": "Malware payload (RedLineStealer)", "value": "81f38a7ed72518b92ee0b475240e31714ea45114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694834300, "uuid": "7dcf0691-f9c8-4624-a3d6-4e79fdc0bcfc", "comment": "Malware payload (RedLineStealer)", "value": "b68dbc279e72bee72ff15bb8badd49254aa562cd8129549add8fb84e520af17a59bd9e582fb76cee4cfe749529ef8bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834300, "uuid": "fef74b08-0f0b-4cd2-8baa-e2fa077c5154", "value": "T1C5658E313B8FB231EDDFE07E0ADCB521C65DA4700B1245EB56D496FA86202D36AF3586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834300, "uuid": "8d2afdec-cb92-4d52-8929-d9e99745320c", "value": "7429a55998cdcbbefa3f6b7825280de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834300, "uuid": "b7254677-d0f8-4534-8fcb-7a8ffef81e57", "value": "24576:aGYVLASNMc42yUgvyecDW00tFgWwpOMe6:a7Mc42y/4N0ngWkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694834300, "uuid": "d1525f66-5f0e-4299-80cf-d1b08fcd9743", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694834300, "uuid": "3e0ab00d-2b6b-4689-b1fa-90d1d3191293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694834300, "uuid": "3665106c-0ee0-4669-8bfb-72400bdf1312", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad6b955-545b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694846103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694846103, "uuid": "f69d6cd6-8d38-452a-935b-9ba31ef479fb", "comment": "Malware payload (MysticStealer)", "value": "d7d792167c66e484b13329d256411f1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694846103, "uuid": "58284b4c-4faf-4bfc-8ed9-ca76edf11f5b", "comment": "Malware payload (MysticStealer)", "value": "658bdee8061c5f57428ff71109a1c54a4a65d959c65e9cfe6ec7bcefaa0d71ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694846103, "uuid": "55ca021b-df71-42fb-9574-5388541dd0bc", "comment": "Malware payload (MysticStealer)", "value": "394edb1d544ff3df3c05b6d1c1b1d913e17012e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694846103, "uuid": "d3736e2c-0dee-47db-8558-3817b6d21cc3", "comment": "Malware payload (MysticStealer)", "value": "6a5715ba68341341714fd226967d23b95c4c2ffbb43fb44898ca6ee9318899cc0b827022820fde2e94b4e3f632dfcf2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694846103, "uuid": "8c3539ea-fa7f-469d-b936-27398d246f6c", "value": "T1B2749E103893C4B2E6B71139CAE4A6799DBDB521076277FB93E80E7E8F115E09B30653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694846103, "uuid": "64b3cde9-254d-446a-8221-1d2b47ec417c", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694846103, "uuid": "6a007453-8a6d-485d-859d-c6f52080a493", "value": "6144:Q4jra0nHNkkhzSSWyIBHb4AOxsd/g7Eu6A7L7hqiLeguFB8fi:Q4vfnHy++l4zsd/gQSJSgur8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694846103, "uuid": "555e8ce8-c2d6-4619-b52f-d234de412ad8", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694846103, "uuid": "905c2843-8d5a-4581-b319-12a301378784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694846103, "uuid": "8b4eba4a-979e-44c9-84f1-1897c68a41d3", "value": "SecuriteInfo.com.Trojan.KillProc2.21458.18745.414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f41a1d-5491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694869232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869232, "uuid": "cc8255cc-b1d3-458a-9483-c523d7fe7bc4", "comment": "Malware payload (Smoke Loader)", "value": "ab1dc5be4c61abb58a961386bd61d419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869232, "uuid": "fcf337d9-5639-459d-9b52-5eaa9f886229", "comment": "Malware payload (Smoke Loader)", "value": "66be9c888095cf0e79854879085490772ff443b7f13f654de2cea26b293dbd27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869232, "uuid": "60292130-3e98-4e1b-84e4-54669c5bc9d0", "comment": "Malware payload (Smoke Loader)", "value": "04f52fc3cb5b008f9a80186a6500e5809291e465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869232, "uuid": "f01248b7-939f-41aa-b9fd-4e4a628d1f89", "comment": "Malware payload (Smoke Loader)", "value": "7607f7ea95f5573ede44745b658f0979525a977789f292dbeadb2a53bfff441f0a89b9d0cac16e18292519312cecc3d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869232, "uuid": "25edc6ec-a6e8-411f-8e8a-934ecfbe1537", "value": "T1A8445B0392A17C10F72A4F768E2EC5E8261FF9514F29A7BA521A7F1F04B1DB2C163758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869232, "uuid": "1f7b79fa-4399-46f6-b049-6043426d208c", "value": "d8c39d5ff6edc55fa56f3300f617117e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869232, "uuid": "b83df1c4-1def-4289-bd57-ed3002b2d09b", "value": "3072:/T1ZfLDUg54VEkHoE4GNF82yZTT+s4eUt:vfLDUgRkhRq2ydK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694869232, "uuid": "09b4a626-22d0-440c-8cc2-8bb337ca5051", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694869232, "uuid": "56794ba5-d6dc-4cc4-95e6-b2176ae56a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869232, "uuid": "840213bd-f193-4311-b8e4-da0ade59d54d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d514e87-546a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852496, "uuid": "4e276d39-3f86-447d-8915-fd60205b7841", "comment": "Malware payload (Mirai)", "value": "36555ac6a89890b5fc6d1dfc654b1111", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852496, "uuid": "d09cf81b-a25f-420c-9532-327bce1cb6f1", "comment": "Malware payload (Mirai)", "value": "68e2b5037fc0028c977a8d65cd42627fa7d52353371870239eec76f9a88b30dd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852496, "uuid": "62c74d08-ef5d-4421-9867-b5ece64810c8", "comment": "Malware payload (Mirai)", "value": "b46f7130ba49ca18cf98432faf90a4e45e7ec89c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852496, "uuid": "09d822d5-7e48-4361-9b6d-985ab8b1c899", "comment": "Malware payload (Mirai)", "value": "c877c846934c892c631fe0250936990bba7c65463c8b637107500356c5d473caa1a479bc0dcbc5c2612d4104baf97471", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852496, "uuid": "bd8132f9-6e82-4989-bfc6-38ab294f05b6", "value": "T17BB33B376251C97AC08356F426EBC5729D13BCBB0B32319A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852496, "uuid": "fd32c2bb-4dd8-4b42-87a3-c73d4d11cded", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeA6+TRCm7FnVqfJXFWbNb:T9a2aLqkrM1sm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852496, "uuid": "8ab7ebb3-cb50-4be6-802b-2fe35cee5fcf", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852496, "uuid": "473e485a-8bfd-4cb8-90bf-351b270a8a4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852496, "uuid": "0849acd7-52d5-4242-8498-f552f1ab9f48", "value": "36555ac6a89890b5fc6d1dfc654b1111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019cec10-546a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852476, "uuid": "31cb77bf-f85e-436c-be91-7373ca03916e", "comment": "Malware payload (Mirai)", "value": "b2c9169bca506e00f61b88119ec1b2f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852476, "uuid": "cc8569eb-6315-4e51-8840-049fb8664bbb", "comment": "Malware payload (Mirai)", "value": "69997ad18d853750a5abdc6a8dc8fb1c1eb941ce18b5d813b43c3e748a398f65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852476, "uuid": "b416de25-9dd8-460b-911c-f241d00a11dd", "comment": "Malware payload (Mirai)", "value": "56069ee846b31c6b362ad6fa97e1a41cf6792418", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852476, "uuid": "f28dcc23-644f-4676-b4b5-8d673ce0ec5f", "comment": "Malware payload (Mirai)", "value": "1f46ee6cededcd9b563d465fb2b41b601e66cd64d7369ced9c3c52f07ff7369aa8dd4361bda3adebd19be79e191a4b5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852476, "uuid": "463d7b34-2311-40f5-9d09-aa1b19bf5cf9", "value": "T1CEB32A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852476, "uuid": "1ca22027-0b08-4961-8e73-9fe3dbf7e6bb", "value": "3072:pC/4rdZHsXsZwwR9cNk5mm/QcuLmHniPNb:pCwrvHwsZwY9cOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852476, "uuid": "8a904108-f878-401c-ad1e-81b9952a8de7", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852476, "uuid": "c7a2c85e-e9a7-4759-9063-8eb32ef8e720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852476, "uuid": "852a256b-caea-4e4c-bdcf-0ef2f7cb10e0", "value": "b2c9169bca506e00f61b88119ec1b2f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4d8453-5489-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694866078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866078, "uuid": "f1d1dbea-dc0a-4bce-80d3-ff8e6030c83e", "comment": "Malware payload", "value": "07a343016c6cdf5b231117a563376eb3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866078, "uuid": "7c6ee1e6-7bed-465d-9e00-732d7417d1a5", "comment": "Malware payload", "value": "6a152464acad56318b604e959be4160d9ac3dec2d4c1475254f12d7b113d5e16", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866078, "uuid": "ab518317-a02b-473a-923a-49910fdfca3f", "comment": "Malware payload", "value": "11a1b438bdfef4cfd086e6cf8f2d1d0ac0e0209c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866078, "uuid": "d0fde1e8-7370-48f2-abf4-eca6d71d7795", "comment": "Malware payload", "value": "d21a7728afc495ea1b5869a11f828dc2ea9563c5ca6d2bfb7a65f47e18caa3e8ca01509783882c1906d42eed335d1f7d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866078, "uuid": "cf2b5367-357d-4d0b-ae3f-5251cb85c5bb", "value": "T1F8F6E0BD800A4DCCB0C6F2C4AB8A3A1D4C5C665E939453EB2F60B5691B46337CF36976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866078, "uuid": "04de3b8f-6868-4a77-a21a-73c6ef74f631", "value": "49152:ZpmTzlN6wLD/KG+fhH9eJdchSRbHcTtnRF2+SdckbM69zHuiu/Pyy8GsxJuDCL/Y:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694866078, "uuid": "2d002bf1-69c1-4b41-bc5f-51bafc265d35", "value": 15298149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694866078, "uuid": "3189413b-dcba-48fa-b8a0-1fcf1715024a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866078, "uuid": "38c1dd66-c215-4204-bea3-18b7d5887702", "value": "Payment_ref_#8394349.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480b58f4-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694852165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852165, "uuid": "c8351eef-9996-41cb-98e6-6b3abfd6eeb7", "comment": "Malware payload (AgentTesla)", "value": "651aa18626621263a50fbefa967c45c0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852165, "uuid": "038ead12-3f12-4139-99af-fa8cda462dda", "comment": "Malware payload (AgentTesla)", "value": "6ade3ea711779169464e7994f3d27f62682f0bd8219365322dae4e9789d99054", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852165, "uuid": "a71fe638-189e-43a9-acee-0f1204b5b456", "comment": "Malware payload (AgentTesla)", "value": "a217ba2caf30919f8811e870c556ef4f2074bf06", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852165, "uuid": "cd8ff370-581e-45e4-ade5-3e4ee950a6a6", "comment": "Malware payload (AgentTesla)", "value": "07e1d0635f85d06fdd2a95338e354be05627d73327559f709281940a388babc8152e7ae6b4108b92c90371d0b359ebaa", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852165, "uuid": "7eb86b01-24d9-4190-9b07-96982f50cc2c", "value": "T188D43336F6F0E149928D246AE0870034BEDB1DA17DA86DD53EFEC279C7496D06E13B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852165, "uuid": "7344e2ca-e0cb-4362-b0d2-39a2a37d5b33", "value": "12288:wRwcfmlQPrEAuykMBFVXj0kbPVu5mumqITzV3cZ9C/2FS4j5J/HdVUh4gnFuqk:wRHmguykmFVl5u5mu1G53cZ2QljPj7gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852165, "uuid": "b9aee049-3f85-4491-9edf-5ea4035842d7", "value": 597652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852165, "uuid": "efdca937-5fc6-46ae-abee-2c8885c73e4c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852165, "uuid": "36b5927c-c997-4985-bcbe-c6cb5012db0f", "value": "FRAIR00113735.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282eda00-5499-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694872727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872727, "uuid": "76aa0a4e-0987-40bd-9562-3ca4d813d9e6", "comment": "Malware payload (AgentTesla)", "value": "ee74b61557293a10e7720b8456b5f870", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872727, "uuid": "f7d2a903-47ea-4295-b884-9ebfb35bb14e", "comment": "Malware payload (AgentTesla)", "value": "6b71b407e9958593a35d11bee56dc98b7fe899e3cba2f65e4f4c9a5ccd040b67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872727, "uuid": "77d0e2e8-da61-4ecf-8889-36bb7257afec", "comment": "Malware payload (AgentTesla)", "value": "076179b12b5ac08774a8b82b45c10c794501c4ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872727, "uuid": "71c29cb7-cef1-4202-aeab-ee9ef52010ca", "comment": "Malware payload (AgentTesla)", "value": "3ddf732d9baf2c35762d0ac05d50f91b54afff6302fdda8be140b8f9feff6b36b09aa628f27c13f35f463894a112a87a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872727, "uuid": "fb578411-77b2-487f-8614-53c0123dd516", "value": "T1E3E423A1D9F2FDC95824DAB07C43796A01D43CA582C73595B94FBCEA486A3420F677F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872727, "uuid": "dbc787de-0410-4518-a7d2-4f2d8b233d2f", "value": "12288:Qw1v+9wxtxUXcIB/ULxOSIJ5n8I1c/kQSiFlQNnsju4LG5rWQN2x:tvyG6sAU+J5nBiFlQ5sLGwma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694872727, "uuid": "ac4f8784-e2f4-4092-8253-20fa18985928", "value": 668213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694872727, "uuid": "f2f71f4f-762f-415d-879e-5443848785a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872727, "uuid": "37154cfc-85d4-4388-ab29-306fd9a18526", "value": "KE_20200320_PI Confirmation.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34577708-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694835811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835811, "uuid": "c3aaa09a-6cba-488a-be78-877f1f523ee2", "comment": "Malware payload (Mirai)", "value": "69d4db8614c55600c5bf59246d119b7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835811, "uuid": "da4a2202-9318-4d2d-a403-a37a5f931d4d", "comment": "Malware payload (Mirai)", "value": "6c4dca331075abb455b5aa1bce796c7c58b74b2e06735aff137daef755516110", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835811, "uuid": "c9723eb0-eba9-41a6-ab60-673afd35204a", "comment": "Malware payload (Mirai)", "value": "b805fe3839bb6e945b3729fb5cdf93ca873502e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835811, "uuid": "d8c18bdc-80ea-4691-9c25-c4a6862d1c5e", "comment": "Malware payload (Mirai)", "value": "6008d686293839d8ef9cd51ab496e8bae6844a169d4178290637a471dacb2a464cc2383ca68ff8cf7ece17f2a163104b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835811, "uuid": "e14d47d1-8a42-46ff-a977-4ebbf6175c7c", "value": "T183E2E030C1526B82EBEFBF609D95C8C02BD10B8CB0A5CDC1A1E9B7029996B331159DF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835811, "uuid": "8283bc12-2de1-438c-a9a2-dbdba62de4c7", "value": "768:tGobbTrfyj9J04txoJeloD4hoIBNBn4uVcqgw09L:t/bnfy5SFJAoDchBN14u+qgw09L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835811, "uuid": "a753b7b0-c7f6-4c92-86bf-c6cc84290584", "value": 33304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835811, "uuid": "c7516e6f-93d3-4daa-8559-f03be37db1c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835811, "uuid": "421e071d-20f6-47ee-b80a-beef65af36e2", "value": "69d4db8614c55600c5bf59246d119b7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df71013a-547c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694860579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860579, "uuid": "93e79a15-0c79-415a-ab9d-7523111ee011", "comment": "Malware payload (Stealc)", "value": "8f123a5925414e411b6ebef2f650d765", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860579, "uuid": "7a814c31-64b6-4016-8483-1197596fbffa", "comment": "Malware payload (Stealc)", "value": "6d94bbb53f9465a50c0b26f66a65719a9b643e6946f1543c47e278551e21ee2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860579, "uuid": "af198a58-4ea9-4976-bfa6-f275640c4f8c", "comment": "Malware payload (Stealc)", "value": "8cca543ee9f56e27922055158f2480d8da1459dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860579, "uuid": "0dbf7ea6-338d-4509-9dc7-f26d59ecd42a", "comment": "Malware payload (Stealc)", "value": "3819a53d9a98887bdda515e0c71bab04d0209c87dc42e04cfda9f7e25b6a665ecdf527a2aded8e1cfb651924a4d831a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860579, "uuid": "879c667b-c658-4639-aa30-e45ef355640a", "value": "T192545C0292A17D20E6264F729E2ECAF4362FF9614E6B775BE2145B1F05B31B1D1E3720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860579, "uuid": "76f2a33e-d150-44db-95b9-e112abdfc4ab", "value": "d189d43af23bbb5425431a74f9f591c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860579, "uuid": "e5926947-8ce4-4b48-8ac4-92016f05c56f", "value": "3072:i63Z3kPVWJLdXCy7riHtAMJKZXK2Fqu8OaYXJaFBG2HuveN50W:ppUPVWBPGNA8vTtM2Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694860579, "uuid": "594aac85-f1dd-4e8c-b320-a77bb616d2cd", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694860579, "uuid": "ef252de5-4849-4204-bd60-e3a5c30a6e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860579, "uuid": "9e925826-c2ec-4a74-aabe-149b0acb6a91", "value": "SecuriteInfo.com.Variant.Zusy.489697.26013.4971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3985ba71-5442-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694835390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835390, "uuid": "252035f4-ba34-4f9c-88e8-0c424d38c2ba", "comment": "Malware payload (Smoke Loader)", "value": "116ddc22e7db24aa1280fec03b1214a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835390, "uuid": "d432f29f-fe1d-4a9a-8813-e84a9714ce61", "comment": "Malware payload (Smoke Loader)", "value": "6f2ff4beca2ddfb19a229f614f81576648daa2db28d7b52bd408b177467513ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835390, "uuid": "0dfcb1ca-4405-4ed8-98a6-3f3f4663ce8f", "comment": "Malware payload (Smoke Loader)", "value": "d04ac5d42fa20ce72421521d990a55b1421f45ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835390, "uuid": "acdaa59f-cb94-48b3-abef-1813f11e1972", "comment": "Malware payload (Smoke Loader)", "value": "b9be326059b71f29d50d4f8404bcf398af17b639d8b9d296df3f00bf48415b2e940b0d9b3e3d8c05fdc76076f15a8818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835390, "uuid": "8fb802b3-6de6-4e3c-9d98-051d8a103aca", "value": "T136547E12B2D0B961E5264B329D2ECAE4662FB8214E5B775BE3185F2F09B31F1C5F2710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835390, "uuid": "84c1189d-daa3-490e-af35-358842765820", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835390, "uuid": "54538267-aaaf-4367-8437-93fc986a7f85", "value": "6144:ePAvvzhN8fXslaHy9Awn9f6lkOyvHjYE:e4LhSby9fB3fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835390, "uuid": "67f5b101-914a-4fb2-825a-21ee33670599", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835390, "uuid": "e6919eb8-8a5b-4379-8c06-376657e95c61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835390, "uuid": "fc5ab533-c668-4e7e-9f9e-cc20fb5302d6", "value": "SecuriteInfo.com.Win32.BotX-gen.13787.9279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb297b13-5489-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694866182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866182, "uuid": "95fc49e9-2dc3-4b0d-9056-14061add533f", "comment": "Malware payload", "value": "79305e82608b6b6f75969ff94ba0bc16", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866182, "uuid": "4406844f-8e94-479e-a716-11559e12350b", "comment": "Malware payload", "value": "6f56ed0412b3a6b72e0e62def3fad513f7f4336e1a08e4a3e75c215bb3afaa7a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866182, "uuid": "86e92686-3f64-46a7-9851-473b70e87a1d", "comment": "Malware payload", "value": "911a768621f410c658c8f2cf219a5dffe53e9c33", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866182, "uuid": "e84b8050-d028-4bf6-842f-e79d3c7ac1ca", "comment": "Malware payload", "value": "cb42683f70717bcc29ba63bd5038d5c05cae67fa4918f8e96d9ead3864199105f42fb49fa6b6eee9c1f176fbf8693520", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866182, "uuid": "0a8060f4-68af-42f5-a710-dba62aa9cd50", "value": "T17441E367A0CFA2310C76DA0879097C57F20B9077252B1959339C50A4BF2E1DED5AD1AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866182, "uuid": "5b4fd56d-4e92-49e4-947f-83aa60d470ce", "value": "48:PkEdoywESPhbEoV2cHfcB7xeMJE3wKFf6dqFK:c0olP9bHfcB7xeMJE3NFSdqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694866182, "uuid": "88d0f3ea-83b8-424e-8f5a-74eb0766c5ac", "value": 1947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694866182, "uuid": "e06d6a74-4a80-4a26-adfc-8a5d34cb4ba2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866182, "uuid": "26cebe13-a061-4303-8c0e-6389cb684ce5", "value": "bat.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c20a8f3-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841354, "uuid": "aaf8d806-9e03-4a54-a343-e824c73193a7", "comment": "Malware payload (Mirai)", "value": "2e674aaa836b10a7019784118dcecb89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841354, "uuid": "240aee2c-3914-42f3-a533-e8457a240316", "comment": "Malware payload (Mirai)", "value": "6f7c3af98e7fcb8760aafff13b61319b30ddc65c4a22352a96700686b04835d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841354, "uuid": "64147d7d-f8ff-49ff-8c0f-b6be373841c4", "comment": "Malware payload (Mirai)", "value": "9426158d7e2fb2cc47ba12765268c3a9d170f7d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841354, "uuid": "6fc28b75-584f-46da-8775-0b48f798738c", "comment": "Malware payload (Mirai)", "value": "24a82e75d2b54c11fda62ca2fcb4c1eaf0b238fac20b0c92073f2492a98030d2a5458e6c15366a8bc430ac8fedd99f17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841354, "uuid": "ad7d1c5c-2b98-45b8-b42a-e2b0933c554e", "value": "T1B7A2D019E345AFF4DBAF9C9463C1C2C276F987C6678AC8E240EEAF017506046B789C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841354, "uuid": "0e044411-9fa1-4e1f-8abc-2f5d063ac6bc", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5tQnM4uVcqgw05VxJJ:mRxsSVsMD6xiJJE5zRWNrQM4uVcqgw0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841354, "uuid": "915aa019-3969-474d-b3dc-afefb7fdb484", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841354, "uuid": "f6433365-bf60-4194-adba-38f702a0f1b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841354, "uuid": "e4a4ed27-a944-4d75-ab09-b2f4e10337a9", "value": "2e674aaa836b10a7019784118dcecb89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887d4415-5498-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694872459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872459, "uuid": "6e0ccf45-7054-40fd-9c30-5069ce5007ac", "comment": "Malware payload (AgentTesla)", "value": "0b9fae2f82a043cbaa36b64348ab7068", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872459, "uuid": "68c6e952-0cdb-4989-b774-c794b06d8d2e", "comment": "Malware payload (AgentTesla)", "value": "6fd981b16fdb9ed852b1b9ebb666ae408e7538cfc6f007f1af807af1ac6ddb1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872459, "uuid": "7902a090-8155-487c-844a-db87f9c6695d", "comment": "Malware payload (AgentTesla)", "value": "e2d62c10563ce1b779daeb7ae952f4ffe08923aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872459, "uuid": "70d04797-e4e0-4925-a494-cefd8da14570", "comment": "Malware payload (AgentTesla)", "value": "7d55b0d9fb39c0c70628a3f5862b728ea4f195a427ddd3156e2cb15c23bd5be219b6639fef71a4a275524c77c9222449", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872459, "uuid": "9346bf08-7800-4989-ad93-7cfb3ff8995c", "value": "T1CCB423951C0132CBFEB4DAE5597A94903572200B79B3A6C02DC09FFA4E93ED4385DA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872459, "uuid": "455caae8-23d1-465c-9062-4ef198159200", "value": "12288:ocG/4A4A9jYv4QldbyYWB0v/z9ezhz2bcOxjjFtGw:73XA9jIyT6z9ezhAxqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694872459, "uuid": "61370c39-3859-4a68-b3a8-ae4363ac369d", "value": 513153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694872459, "uuid": "c8824ec7-5945-4ca2-89c2-2c421b1f157c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872459, "uuid": "75c45480-41fa-4bd0-9be1-0b2141bb2da6", "value": "SWIFT COPY.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6bde15-547b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694860150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860150, "uuid": "0b437313-7d73-400a-a348-6c94f8ee238d", "comment": "Malware payload (AgentTesla)", "value": "76aff072b98cace8cdbf003952f25daf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860150, "uuid": "fcb66257-502f-41f9-86a0-d2a78a6645c3", "comment": "Malware payload (AgentTesla)", "value": "7127d8b4003601f85a7e9d4db6eb8fae16f60734ed7697257d8a68ca476a52f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860150, "uuid": "863a84fe-9524-4c7f-b0b0-2451e947f862", "comment": "Malware payload (AgentTesla)", "value": "cdebc9b1e82eb190d1dfa6e66b2966ccd8c783cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860150, "uuid": "0de69577-9aa5-4f21-9dbe-6a52b72b9bb4", "comment": "Malware payload (AgentTesla)", "value": "9beec4c2bc65f66528f57010e59d0219882969d99532ca71f242a38f1912ceee9dc68738a20decc50de03d9f515c81b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860150, "uuid": "a8d3eea9-1564-4961-b659-4870ecd7d0a1", "value": "T15C340E137E48EB11D6593D3B83EF2C1453F1A0D70673A60FAF58AEA52A412436D6E36C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860150, "uuid": "9383d87d-b055-4b62-811f-b68e00d16c86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860150, "uuid": "6496803a-2fbb-496c-8b6c-7e53d9221a2c", "value": "3072:ycrQ5cJPtXZy3HlnQ3CfVH/WycBrdV7GEYWz:yc8cjJUHlnQ3WVfh8rdVJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694860150, "uuid": "99a04580-9fd2-40a9-95ad-219d43d02bde", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694860150, "uuid": "9bb70148-0e8a-4968-aa67-fe276edc3eaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860150, "uuid": "b1ec1c50-98b2-4389-8c4e-7d156ce4dada", "value": "400000.c5b6985cc8e63c04d1ee674684e6362353c00002fdfaff33e15affae9c005b00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4ca0e7-5477-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694858212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858212, "uuid": "a19eec48-e107-45bc-b32a-7896e9c64643", "comment": "Malware payload (RedLineStealer)", "value": "3082e7832f7a31397990d4d3ae4c75c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858212, "uuid": "3b60d58c-21a0-4a9d-b18d-84478827bb36", "comment": "Malware payload (RedLineStealer)", "value": "716f6379cc32afb03ef2639b14e32b4df5538b99b84dafe355b39f8934e7c740", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858212, "uuid": "5271a09a-c4e4-4568-972b-9721ae63d3e9", "comment": "Malware payload (RedLineStealer)", "value": "769b150e219c7e8d7221f7a0f0ba6ef617fd036d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858212, "uuid": "095a1232-72ea-4ad7-bba7-600addfd72ba", "comment": "Malware payload (RedLineStealer)", "value": "fce7b3adebb0edf748bfc52528cd735926f421d776a9497a956a2bd24908db9172dd5c5071a0d55af6f06db94e57c272", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858212, "uuid": "a87587d1-fc42-4312-aaed-e3a27a6f79c3", "value": "T127B4CF9837A25696D4BF1F740572E2948779FCD39A2183CA218331DE0EB2640FB54F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858212, "uuid": "f270c50f-00f8-47b8-bf91-d62864c536a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858212, "uuid": "c32e3ebd-38c2-4cf1-ad78-8219e6f5ed38", "value": "6144:Y52GLrQ8WKhR14o4XQQDTpXIvh+TodRV64apJN9wLOM21H:2DLrPWKhR1Ul45+TsX64a2iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694858212, "uuid": "ee9395c3-d975-46b5-b2d9-0fd61f3e6429", "value": 518016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694858212, "uuid": "81246bec-28bb-4def-aae9-ab37cafa362b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858212, "uuid": "b3ba2b97-3461-4cd7-b867-16017d9c6fa9", "value": "3082e7832f7a31397990d4d3ae4c75c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c61f6e-546a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852483, "uuid": "38ce67c9-1648-42ba-be13-4118db02cc51", "comment": "Malware payload (Mirai)", "value": "3743ae601fb2ff8eb1d6915dd13206d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852483, "uuid": "92622412-d175-42fb-9231-32c5a91c321f", "comment": "Malware payload (Mirai)", "value": "718b50d978873fc841ca1ac3b19c60e42bb611e3409a799f31c0a6a43523caa2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852483, "uuid": "8c1d7dc9-f309-4f55-b961-a9857ff65251", "comment": "Malware payload (Mirai)", "value": "e8d7d5abc0c254e4bf045820eb0e699ecfd831f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852483, "uuid": "70a953ef-139c-4135-9514-72775e2bfb65", "comment": "Malware payload (Mirai)", "value": "f837f5346ae82b96cb0753a80858156bb99fabddd3b8be337541d2bebd2fbcc1a13f5ad3a66a3652df3bca297aa11ba4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852483, "uuid": "a1c8587d-a9af-459b-9f81-4ebbc1686e14", "value": "T189E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852483, "uuid": "44b03b6d-832b-447b-a096-22b7f5c39bfd", "value": "3072:dgZc9h1jlnLA2PiXYeyCcaVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZaVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852483, "uuid": "eaab53ec-0b1f-4bff-81fc-ccfae00f8964", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852483, "uuid": "d97d43d9-f1f8-4377-a01d-373ba9b2bd52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852483, "uuid": "6aca0d3e-df1c-451c-a790-f5b006e597f6", "value": "3743ae601fb2ff8eb1d6915dd13206d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59376052-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1694835873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835873, "uuid": "37b465ec-95f3-46bf-a2fd-0205e7e218ef", "comment": "Malware payload (RiseProStealer)", "value": "8e9cd846850a58d4f59bbf0192f2ba13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835873, "uuid": "573d884b-e137-48e9-9dfe-c9d0b5d29945", "comment": "Malware payload (RiseProStealer)", "value": "71962e346aff1abde8b22e80fc99df7d7704b03dc5cad2c9404ee8df80619b5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835873, "uuid": "58949bef-bbb5-4088-bb4a-e1bb3264d7dd", "comment": "Malware payload (RiseProStealer)", "value": "0db3f07832676d381abf89710896b11b467b42fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835873, "uuid": "03561a20-4f3e-44f0-993c-c9f79c2b872f", "comment": "Malware payload (RiseProStealer)", "value": "b142705ac82ad39c51b060c99c50d5bd1293069d2421d357752fd9ca64c1ef741b523989fc63c89ab1b2c2dea4699aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835873, "uuid": "ce77ff6b-0b58-4700-9cd1-e043dedb46bf", "value": "T11C150243E2907D60E6355B72CE6FCAE8761EF9618E187B5B12185B1F08732B2C273716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835873, "uuid": "890f19f7-8a28-42ab-a8cc-bff265e83ccb", "value": "2c13b01641edb95de78761affa09fc50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835873, "uuid": "0dcfcc54-701d-4be9-b3b2-adb7ba838bb1", "value": "24576:0PbtXRCYzf8Y4T+OMyZiufcLdd5hZtmpKvY:0PB5oT+OMuiufcjLZWKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835873, "uuid": "f90929d8-3cca-4b83-a691-967dfc05e667", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835873, "uuid": "e30a4c5e-22e1-457e-b582-3707c423a468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835873, "uuid": "099b81ee-d0b0-4468-ae88-acb66ead2b2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e6ed57-54bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694889098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889098, "uuid": "32efbb65-db86-49c5-ab71-f73a75a4b790", "comment": "Malware payload (RedLineStealer)", "value": "e25218baa11f2ee252ae19738fdb36fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889098, "uuid": "1631f2c4-9ae5-4c82-9c57-8e359d40cb8b", "comment": "Malware payload (RedLineStealer)", "value": "72082fa76ff8b4605dfbf89b6034d279806bed30675ceeb0c5e3bb27575b559c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889098, "uuid": "f5a7ce7b-43cf-45ce-b2b2-a56a6be7c048", "comment": "Malware payload (RedLineStealer)", "value": "91503a2e2d4a8fe50942f6e4d85fdd1ee52214ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889098, "uuid": "d156fe91-99e2-4882-8b39-b653c4a60b06", "comment": "Malware payload (RedLineStealer)", "value": "cb5d80ffa4b33b3169c37aabe8fe2cdaf07c6d74920627c6520a6bbc5d34175c81d32d1a78aa49efc149ba27822542e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889098, "uuid": "f0f863d5-7186-4030-8471-21fb0828e693", "value": "T15B94F103E2B0A830E77D463A8E2EC2E8672EF9215D75A73B2257775F08B1D70D552329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889098, "uuid": "ab1e27eb-ed37-4be6-8dc0-8dbfbe8eb43f", "value": "bb9eb0cb309094dee794967585ee1533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889098, "uuid": "d0a82f10-5b0a-45ae-ad1d-69cfbccb911b", "value": "6144:a+4X2f24kkC1RrzQzU1cJUDxaZ3BhyZDS86l5Y5m32u4wLp8:vm2f24kfPfXcJeE3BgIXrYzuLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694889098, "uuid": "920977b4-d882-4d42-94ec-00ce69c1a833", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694889098, "uuid": "d7de9b94-133a-4b9e-9c28-3ad5ca034304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889098, "uuid": "21fd0d58-c6ab-4343-aee1-2cc6bc762004", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a47586-5485-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694864321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864321, "uuid": "a512f7cd-1b8b-4827-bdc9-ee5964022c59", "comment": "Malware payload (Smoke Loader)", "value": "5bfa29282fabb73dff1e459775ca7c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864321, "uuid": "aa5ddb3b-cbb5-46d5-bcab-9d44c5ba8855", "comment": "Malware payload (Smoke Loader)", "value": "7259a84f7267377ff79bf5454a63261e3968f585f32f1dc7efdcebe3485eba73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864321, "uuid": "54920008-d610-4a8a-921b-1078d2e3e239", "comment": "Malware payload (Smoke Loader)", "value": "3435e68516c3445dd9fcc0e062177594b5bf8308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864321, "uuid": "54502b48-1465-41d5-9be1-4bda0595e2db", "comment": "Malware payload (Smoke Loader)", "value": "a50ff9d2246e18d8358f62fe4b62121a4531e5e2c2c2e580940ee33535737c4487e94a7951e404b690db5280baaa75a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864321, "uuid": "b16b911a-96ac-477c-a848-dca02e8ac52d", "value": "T175544B0292A17C10E7294F769E2EC5E4261FB8218F59B7BB621ABB1F04B2DF1C173715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864321, "uuid": "b9b875b5-8c04-4bde-82d2-c0422cca9f05", "value": "d189d43af23bbb5425431a74f9f591c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864321, "uuid": "003f3b84-8633-4caa-883b-332ede348c37", "value": "3072:u6g0kPlK76IgZFKxfx2nF2wkFyVTaohKvKt:1UPlKeHmcF2wkY9azK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864321, "uuid": "2c305ff5-6522-4d36-bc7f-85e318bf2da2", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864321, "uuid": "399c2778-a3b8-4404-b7cc-111707477ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864321, "uuid": "be718dd6-d22a-47ce-8bf3-6906df40953f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0674071-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852420, "uuid": "f9a4ce79-5979-4736-9831-61ed710904da", "comment": "Malware payload (Mirai)", "value": "03c4028fa33fd760c7cee47b9000251a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852420, "uuid": "b0a30ca1-9173-4051-bb41-a862168647a2", "comment": "Malware payload (Mirai)", "value": "740d2857756094c0f5ebd40ba7dce2a1f19ef56ce2af0253656cc85a60c912e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852420, "uuid": "2380f5ff-85bc-49d9-9469-e43f41b2079b", "comment": "Malware payload (Mirai)", "value": "9f0351dd036f66b08b27557bb24ced18a04867d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852420, "uuid": "340e108c-50c7-4f40-84c9-80aae1705a2a", "comment": "Malware payload (Mirai)", "value": "144acd068ad62b6e27f079dd2003fdd01012956b661cad34c45581a1503acfeea4e39835e3cc582a70d7431e0cce67fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852420, "uuid": "baf5a55e-8187-47dd-950e-a0b793909c6b", "value": "T101E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852420, "uuid": "10f0ded1-4476-4eed-943d-a212b14dee2c", "value": "3072:JW6dm9tS1aRGQdK76t/zCzI5mrThPaLEnvPrNb:c6IG+LCUmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852420, "uuid": "7d28b752-a30b-4a50-805d-a8b94a7fe405", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852420, "uuid": "a0f6a1e4-4b73-405b-82e9-4c60c9d0c04a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852420, "uuid": "43b2ab03-beb9-4eb8-a06f-10c5b2a98571", "value": "03c4028fa33fd760c7cee47b9000251a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5690f36e-5466-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694850901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850901, "uuid": "01866b8e-9a79-4940-b821-fd64a8f7e3c7", "comment": "Malware payload", "value": "83bc4bb1ded1ab639f85e39adff10eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850901, "uuid": "5ab857e4-3513-4360-bdad-71088c3ad2ed", "comment": "Malware payload", "value": "7497efedc89c41bfd7aa272e14c938ca749fd78a57b4d3c06806b96319e387e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850901, "uuid": "33eb91fe-cc98-4622-9740-49a44d00a3e0", "comment": "Malware payload", "value": "9d051ba98cd2072ecae5ef31d505f079e9bd039b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850901, "uuid": "47594e3d-5edc-4c9e-975a-3f1dc6d6e08d", "comment": "Malware payload", "value": "77eddbfd531cd7752c5eb7fb9909cf77535297581987ab8d98b3088e4123e5f3e6c1763a0161e72b76cf6f3c3cf9be6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850901, "uuid": "8af33b36-9fe8-4679-85e6-90e4e262a21e", "value": "T16CE7BE15E3E84716E56FC2BDC6A38513D6F1F4971322C2CF0454EA992F63BD2A736222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850901, "uuid": "d0936ba0-a72a-4c4c-b67b-edb3f156b4bd", "value": "6cec7edefbae8ff608d630f3b5df02de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850901, "uuid": "4544409b-43e7-40ac-a4ea-2233464dc682", "value": "393216:YxWeWmh5OhVioIEXyO1oj72AAz7ABhSDELtjdsohGCvF4agsPwMCJf/+4DtI9n1Z:k5N7eHUmdCvF4N3RtI9n1gqBf8IC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694850901, "uuid": "8e783a78-96ea-4424-8cec-7f27b3b0f5f3", "value": 64015202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694850901, "uuid": "67e0bdd5-75e7-4e62-bc2f-ab310a6def00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850901, "uuid": "f4b10377-c1fc-4585-9f81-2932b5da1757", "value": "runs0mewhere.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb28117e-5489-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694866209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866209, "uuid": "9e58dc48-8619-4421-b29f-6c57ea74d3b7", "comment": "Malware payload", "value": "7038e7516d3358e6f08bddaa88bc9459", "object_relation": "md5", "Tag": [ { "name": "dropeer", "colour": "#968B66", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866209, "uuid": "6a243519-8113-41f0-a815-d8ecd09d662d", "comment": "Malware payload", "value": "77a5237bdff95dc4c501c96fe2468a8c610281bb1341705aca409e4a3176b46c", "object_relation": "sha256", "Tag": [ { "name": "dropeer", "colour": "#968B66", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866209, "uuid": "e0735ca8-191b-436f-9660-2922e42a8c00", "comment": "Malware payload", "value": "640113859df0c11baaa40ae31596b8c7c8f1969e", "object_relation": "sha1", "Tag": [ { "name": "dropeer", "colour": "#968B66", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866209, "uuid": "78682868-d6bc-41e1-ae76-5e37a958d198", "comment": "Malware payload", "value": "fdf69d8a5af72d173a50dc3d9ac90baca7f05bd2b3c07b169bb553e202f77e3a2f337a74a2f61d50600dec2156061ed1", "object_relation": "sha3-384", "Tag": [ { "name": "dropeer", "colour": "#968B66", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866209, "uuid": "0db251c7-656f-4c80-81c1-fc935eda039d", "value": "T13D014463E6EB514AF319EEB70530807905BD10B9991CC145681D8A7F38C04B53DB33CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866209, "uuid": "4d6f686b-9b7f-4d8e-a18d-aa832b887940", "value": "12:5jeO4kfkffsA6BqnTT559ohOWrmUdiPqAL7hnmFMVAuk5JtZyMrTKSOj3JaGXn:9exk276Qnx56hOWHMqutmJv1CSu3LX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694866209, "uuid": "404595da-751b-49bc-87b9-f0a6062a47c3", "value": 714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694866209, "uuid": "92d45dcb-8bc7-414a-a9c5-98728a242096", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866209, "uuid": "bb74e904-f664-4ce9-a397-a1f175b28843", "value": "PackageOrder.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d075b9-54a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694878520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878520, "uuid": "f7f8773b-af44-4845-8e72-c62fc3bfa8f9", "comment": "Malware payload", "value": "c6b88ed4d6660ddc052fd29605e2c041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878520, "uuid": "b6588563-a04c-461f-a2ed-d995183e7624", "comment": "Malware payload", "value": "7ba6a82afff9a6b0025f0aaa0ed5719b43fc9e7dc9144ed56a39c9771a643427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878520, "uuid": "243ee208-98f2-4800-9d0f-a31304dc125c", "comment": "Malware payload", "value": "8004293087a75d5a6db5566b8478c73fac04b8e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878520, "uuid": "926cbd46-6415-42aa-bee7-221c80361e84", "comment": "Malware payload", "value": "26b1a96a953f5aa078c57d081f171c63638090773ec6551f13c7dd760fc4f040c05101a9e0582d0056a89ac73cd1184e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878520, "uuid": "a2b4260f-83b9-4690-a03b-3dfeb5723afa", "value": "T19D43E907BA3E8AB1D2D8473BD59B84040364D791F65BD75E798E236628033EA8CC568F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878520, "uuid": "ee503d63-0fb4-4faf-aeaf-7b53c578c938", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878520, "uuid": "cea7dd5d-c7ef-45f3-ae8d-1813229d7cc4", "value": "768:+ipkrdBVUfxKfNl8SwMnOBfxpjp7dITuOyrMe302PPDsk:pwUgfX7KfddITByrn02P7sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694878520, "uuid": "a7edd065-8f7a-4c3d-b1c5-a2e54ba77455", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694878520, "uuid": "202b4096-8154-4565-b6a9-893f6fca9942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878520, "uuid": "541192a7-ebe9-4c50-a30e-2247bf31c5de", "value": "SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.22327.29648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8653b2f-5481-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694862715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862715, "uuid": "19ef9bd6-4774-43a1-8ed9-010c09ae43c8", "comment": "Malware payload", "value": "35199388c0229811a3d6e21a5cbd3a2f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862715, "uuid": "461788c5-fdfb-484e-82a7-a70e701673d5", "comment": "Malware payload", "value": "7cb328d9b24d5dab7affadb4d6a9c6744a678eada8a30d0db0af1bb282a62629", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862715, "uuid": "6d5ea536-546e-444d-894c-275c36d6ca2b", "comment": "Malware payload", "value": "1e6a27281b3908ee9fe866a14e6d993b78b1da52", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862715, "uuid": "366a7249-f05b-4b52-964f-7210e8713fb8", "comment": "Malware payload", "value": "18802d298ea23bb23bd25e2f2d9863798b0782df38ceec5ae386fd61f50970b456d78cad97d9eba159bf91ec02b3d800", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862715, "uuid": "7ac044dc-3f03-4632-8ca4-e22b0734f156", "value": "T14E41CE024254876BF3714EB051FA84A6AB336593FD82A719E042426E04F2D18EDB9EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862715, "uuid": "302c36e2-b2b6-45ec-9d9a-cee040e7b949", "value": "24:8alkW0SHeSH9u1HRLn3E58BOCj+7SSbrQvMldsUR583TkUmp:8TS+Sdap3rO73brBdTR5DUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694862715, "uuid": "7a097013-5992-4b40-bb74-25c01dcacccb", "value": 2056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694862715, "uuid": "3fda9a96-8e2d-4fa2-a86b-dee146d6e885", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862715, "uuid": "50864e61-cdee-466d-a8d3-d851be42c3c7", "value": "Invoice_002149.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca434ed-5489-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694865916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865916, "uuid": "f5690410-0f8f-4c83-b164-3e60e232ce9c", "comment": "Malware payload (RedLineStealer)", "value": "30ca65dba3364201a4a0b202b9bbd6c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865916, "uuid": "af40a4bd-b7f2-41d4-9cda-0f60bf34695c", "comment": "Malware payload (RedLineStealer)", "value": "84bc2b606a3b78469f03cc35a62f5ab84e56a3637ae18d0dcc7165c9d2e4cef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865916, "uuid": "a6ed015d-6ee5-4c8d-8433-363d26618d7e", "comment": "Malware payload (RedLineStealer)", "value": "340431911479d38750e7273f2221fa826fec85c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865916, "uuid": "b11538f4-3efa-4aed-b26b-ba05a8eaedc0", "comment": "Malware payload (RedLineStealer)", "value": "638653af3905af77d63d04fc412d4d17d1a51d6f5c04458e77a9ae398497218f2419748c55493a9738c6b09b46cd24cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865916, "uuid": "617e6963-dc25-4f69-9928-026393397229", "value": "T1F4F40131FAC180B0D9B218345EF9E3705A3DBD701F609B9FABD40A6D1E705816635BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865916, "uuid": "42e91053-15be-4fb9-a42d-86181969568e", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865916, "uuid": "ac05b72a-8c40-48c0-be35-f1f8eb302fbb", "value": "12288:YoQ7Xar2BHs/EIzm/ObU/sHWihc0EevDVmcOIMTRIqfjL22z79tm+zL7N2ychrsR:YZ7Xar2VsBq/O4uW0EevhmHrSgvb5o+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694865916, "uuid": "a4fd6cea-0c4c-41fb-b9d0-4a4c6aa85e2b", "value": 776112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694865916, "uuid": "9a5fa784-e72e-417f-887a-3837ffc06789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865916, "uuid": "765b7b97-e96c-47de-b7a9-107b785b40f2", "value": "30CA65DBA3364201A4A0B202B9BBD6C2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4049f2d1-5486-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1694864607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864607, "uuid": "c47e716c-6510-4c25-ba5e-7a30b893fe1b", "comment": "Malware payload (RustyStealer)", "value": "15907f8b3e3af17b68e1d45a95eef02e", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864607, "uuid": "beca96bf-4d37-4c26-8512-5601bd6f04f9", "comment": "Malware payload (RustyStealer)", "value": "877ac09710b55a673a858dad4b2a05b13c59da248a3650122d425c9c86658f29", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864607, "uuid": "9c491fa5-5141-4f74-b51f-cd23188f24c3", "comment": "Malware payload (RustyStealer)", "value": "9307b3c42358f280f4dbbd170014d5890266e824", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864607, "uuid": "90081ff9-1a1a-4645-8861-b1da5354072a", "comment": "Malware payload (RustyStealer)", "value": "730e5b172cbc65e9c72dd791e3742feef770197b2361adfb1ecfef942b68002e76a4b8b467081c1a2244fa903ca5ea62", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864607, "uuid": "98ca58fb-a7f4-4221-a4c8-79733a125b65", "value": "T103241268AD49E105EDEAD8FC22DDBD72A09CEF0C1901D01D3DA9A5159BDB338C9E2A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864607, "uuid": "1994daf2-3587-4b0a-bb01-649e171ee3be", "value": "6144:Ezqq7OxuZOgXzBO83GnzPH4KQuy28KEfUW2l:W7O2TGnzPHbFrXEfKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864607, "uuid": "f38a328e-4734-46d1-bced-9e65fd2734b6", "value": 230233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864607, "uuid": "68e6e104-a1fc-4213-8f54-dd4e688fb6f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864607, "uuid": "0776b7b6-41f6-4efb-b0f4-492d96b785b2", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ea9da4-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852435, "uuid": "6e6cba8a-2e68-4c5a-b762-f4b653533e82", "comment": "Malware payload (Mirai)", "value": "9f289b1fdbfe2bcd5c4cb1d19fb26e2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852435, "uuid": "38b7de50-1ac9-41c1-9d71-fbb5d4c5e27d", "comment": "Malware payload (Mirai)", "value": "895080742d008d383ed9d0c45771599ffec97d6c5392a45b39dbbcaf2971bad7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852435, "uuid": "e45c8248-ba38-4ec1-b6c3-2f22f069178e", "comment": "Malware payload (Mirai)", "value": "d74895ed48e452adce436c92a3fc2005014aa92f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852435, "uuid": "2ec87a69-42f1-41a0-b155-60b3858ebcc9", "comment": "Malware payload (Mirai)", "value": "1f6eb3cce753e1f0883f60d79b72d968e9e759e57f4612c3cc33377efbe336ca1d266de4c75afd3f9d7802126f34ea54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852435, "uuid": "bbd384bf-f832-4ada-a852-c48a5ef68e74", "value": "T13FC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852435, "uuid": "0f9c18e1-c157-4fa4-bcb1-6c079b3a6d84", "value": "3072:4jDy/+mh1vtbPIKaSbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaSbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852435, "uuid": "860bd774-032a-45f6-9ef4-8ab39558525c", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852435, "uuid": "f6f0bda0-9bfe-4fdc-b033-e32f2ba7c110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852435, "uuid": "3f1c3770-9e6a-48f5-8b51-a2e7262fb4ec", "value": "9f289b1fdbfe2bcd5c4cb1d19fb26e2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e8bc01-5442-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694835563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835563, "uuid": "5b66a0b9-4433-4e06-a391-507b6c7f396c", "comment": "Malware payload (RedLineStealer)", "value": "4acf2eb9dc02bd0e62cabfb59ab3a006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835563, "uuid": "ba092283-c317-4440-ba4b-5066d6d163ff", "comment": "Malware payload (RedLineStealer)", "value": "8a3604b987de66e8a95a64aa7d0f6512b6f8e84d33bba9d5ae712f35212a6cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835563, "uuid": "d456d42d-52c0-4417-95de-3aceafe397f5", "comment": "Malware payload (RedLineStealer)", "value": "5b1e767f6eb163971afa83d4de5fb2c82c9a807e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835563, "uuid": "f1cb3d6f-6d98-442c-aa04-ad52b246ee36", "comment": "Malware payload (RedLineStealer)", "value": "1d3c8ecb1b57b7848b864d49e7b936ec8ec5854c3122b64bf3b3fedb93097bb2eff3259650586fd88621dad83b252dd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835563, "uuid": "c820a1fe-2bda-42d4-b60c-5bba6cd1cac9", "value": "T142847B013D95A43BD4B3527F45A0F67E292EB82C032474DBF394AD6EBE20193D67C6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835563, "uuid": "143dcad9-0559-43ae-b79a-c495a664861b", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835563, "uuid": "9c46fb53-470c-40c3-a53e-7c136806ba60", "value": "6144:wercF7qOXciQ3xFF1kCaX4z4AOb2nBPx96/8G3QVju75iYkyUN+nHkdJTJscGGGP:drc1tXcve445CN+nHkd1JeZIyJ8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835563, "uuid": "0b36016a-8ab9-4625-b351-2c091475dcff", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835563, "uuid": "152ed269-db9a-41b4-bcd2-56c0de278081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835563, "uuid": "938befad-1b38-45a7-b2d2-1b3cdfc187e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c934f7ff-5493-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694870420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694870420, "uuid": "3c879e8e-b945-4d2a-8834-b2036840d1d0", "comment": "Malware payload (Formbook)", "value": "67eba99fc8eb8a27dece4580ea87b88b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694870420, "uuid": "c30192b9-5a4a-46c9-8a71-e8c88c937b6b", "comment": "Malware payload (Formbook)", "value": "8b61335080ce37e107d3798d34f7e281c66238a0bf63d08b846a7b81d2969fcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694870420, "uuid": "e7c21dda-4055-4ed8-b081-cbe6357097f3", "comment": "Malware payload (Formbook)", "value": "2cdc8d7f687f1bfd64b456a5bee3fec610b7c0a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694870420, "uuid": "d02a0c07-f678-4143-a6dd-8d29f448371c", "comment": "Malware payload (Formbook)", "value": "9ee78b7d032dc2507289650326f6c92e9639dea01ad394a3435e5ec9bda051280bb0ca8eb686e805cc2b61be59e0cbfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694870420, "uuid": "261aa798-630a-4d16-8fa1-67332cb76b36", "value": "T1FFC423D1F6D80836CB783AB804E79D04637EF2999FE1AE7F17C874371264BA562006D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694870420, "uuid": "02eadc82-874f-4b93-a4fa-1934b7ef344a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694870420, "uuid": "47340249-1d97-4c53-8081-7ee3f3a82d73", "value": "12288:jC7eXbYvswJDaCYbeJDnWoz/u0U3fkaafu:jweXo0eJTPlafkfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694870420, "uuid": "b76d5447-c981-4161-9308-41fe9cb60b40", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694870420, "uuid": "a7dfdb75-f4a7-404a-bb68-a27c5b69d373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694870420, "uuid": "ffa83731-43c2-4500-85fc-d31ea8a1287f", "value": "rINQUIRYFORQUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2d8e5d-5467-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1694851470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851470, "uuid": "73db02b7-8ce5-4774-b011-1d01bd179562", "comment": "Malware payload (DarkGate)", "value": "27a14ed7a94bbbf8dabacd509cb4bf0f", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PFO GROUP LLC", "colour": "#216C9E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851470, "uuid": "342882de-dc7f-4e47-ae1f-9cd502a2b3e1", "comment": "Malware payload (DarkGate)", "value": "8ce6620ef7346fbb807b72293ce965b05b5cd37036a9d3a17c834b79e15910f4", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PFO GROUP LLC", "colour": "#216C9E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851470, "uuid": "5a122716-316d-4ff1-8267-24fa15631108", "comment": "Malware payload (DarkGate)", "value": "097c6021a05ae5dc95a3b6e4dc4deb2583a8b26a", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PFO GROUP LLC", "colour": "#216C9E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851470, "uuid": "21686dc7-707d-40f2-a4cc-7bfd2eea5f9c", "comment": "Malware payload (DarkGate)", "value": "92527e3fc4365bd5f7b8a4281efab6bf6b04bc5da5e09f207b9fea6833a20043f154959383a3152f35893ccf583a2cd5", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PFO GROUP LLC", "colour": "#216C9E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694851470, "uuid": "9aaccbeb-e317-477e-a4d0-a8da33aec66c", "value": "T16AB523613699C136D65A1B7281FA8BB12A357D312F30C0CFB7953D6C6B327C26A34366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694851470, "uuid": "61675e25-3913-467a-ac08-24f3fdbbc8eb", "value": "49152:QpUPhzTtpSD6TmCFMZ9Iv1s6kXhH3jtG1+iH4nDcGdi2gzblP9QNIT5QBtg2:QpgntID67vvLkX5BGVOfcblFQCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694851470, "uuid": "85a292c3-a743-42d1-90de-5ee78ecb7de9", "value": 2347008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694851470, "uuid": "ad3f9d37-e67e-4d4e-b5f1-f583c04c16d1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694851470, "uuid": "301f6bb6-a77b-4aad-8605-554576b0e938", "value": "w_verion_6.1.1_x86.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b753fbdd-5474-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1694857076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857076, "uuid": "d55436b9-6fdc-4a36-8993-5871b937c5ae", "comment": "Malware payload (Rhadamanthys)", "value": "89fe28686a81b90bf1f46b6d46251ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857076, "uuid": "46dd699b-ba93-4fb2-b9ab-cca382091145", "comment": "Malware payload (Rhadamanthys)", "value": "8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857076, "uuid": "4f6c8bd2-10e1-4e56-889b-8412d9c84384", "comment": "Malware payload (Rhadamanthys)", "value": "19f6a799b4777acf208926cee4913c0a889db72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857076, "uuid": "852bd77d-941c-45bd-bb47-7c8fe620f3f7", "comment": "Malware payload (Rhadamanthys)", "value": "1001a7c14e7fdfeb4b85013b8bfab0ee121c91663c0636c245db9d9b019d6fbc56a9c00f63a40173f227db473a8aae8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857076, "uuid": "5a63a5dc-17ba-4b7c-b146-e91c624e3feb", "value": "T1F5B41247BB3BC6B0C284C77AD5EB50C84B55DA8177A3DB29A9CA132517433FA880E54F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857076, "uuid": "f0261844-3250-4dd8-9790-cb1b0079d199", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857076, "uuid": "9a293de2-cf90-46e8-8b7e-5462efb471bf", "value": "12288:pX5JC7oT39ra0hI1iGKsHJwUJ10qx6qhE12:pLC7mtThIcGNSS1VY31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694857076, "uuid": "eecdc79f-b086-4fc3-afc8-1663f12eaf1e", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694857076, "uuid": "64a4a191-4e43-41ab-910d-2270cdcc4525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857076, "uuid": "59fedb10-8bc4-4b29-9dcf-686f869d93b7", "value": "SecuriteInfo.com.Heur.MSIL.Androm.1.11946.26080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7621b6-54bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694887441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887441, "uuid": "5435fea3-b652-4630-907d-99df07c25099", "comment": "Malware payload", "value": "0b019a3dd120586b87cefa78a47f8f14", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887441, "uuid": "fadd9c87-4fbd-41e4-86ac-7a41a7f65ce4", "comment": "Malware payload", "value": "8f1f4a3061f146249be95a90b0a8f28e856d6d92e226b871fc869afd56f0b92f", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887441, "uuid": "6aa55c88-4e5a-4384-a5da-9c775c26d3d0", "comment": "Malware payload", "value": "4774cedab4a3b7e0da779d69f592f09307d6898c", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694887441, "uuid": "b196a97d-8b7c-43ae-92bc-b5458970c626", "comment": "Malware payload", "value": "54ba7c8d7b09e75935f664d241f703d941cb6c8df7599d4e157667d25441dbbfda967f5d40c9ef1a753bffb6ec9b967f", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887441, "uuid": "2d005d0a-9458-4109-99e6-c654969c7c10", "value": "T124E5DDDED4A72CB64E6B8300D5BB81E4D507B177FBB6C2A4C0E267906212725D7B848F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887441, "uuid": "ea93fbd4-d664-473f-8e4d-488cb9e4765a", "value": "24576:kLp2rYn3u4AWztvIX8mFAqyxgvMBpvpNe9eesXrsZc:kLp2rYnTztwhFAuMBpTy2sK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694887441, "uuid": "c8542985-2eef-4a39-a47e-d7e35ea4c286", "value": 3249543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694887441, "uuid": "750b1f05-f12d-4c70-9c83-e9711dae026d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694887441, "uuid": "c2276fe1-6b36-4e41-8c40-2bd48281fd69", "value": "OSU-FourYear-Academic-Calendar-202122-through-202425.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843372cd-54c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694891350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694891350, "uuid": "c4ff8734-a3f0-455f-a275-2a904fc97796", "comment": "Malware payload (RedLineStealer)", "value": "aaa35a5dd28fb6dcd151ccb0b9ed270d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694891350, "uuid": "0204cc4b-7ce9-4965-8f13-323c455fbe16", "comment": "Malware payload (RedLineStealer)", "value": "902b165bc7d6facfcda550144157b58d122d3c38abe5f5cfe630ad5eea8f8557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694891350, "uuid": "72216cbd-f330-47b6-9b16-0fbfcbaf03ca", "comment": "Malware payload (RedLineStealer)", "value": "08a9dbe8c26691836f34eab89f1c500085b6efc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694891350, "uuid": "e030e487-85c5-4e9e-8435-671914903395", "comment": "Malware payload (RedLineStealer)", "value": "f791e9f0b18747d0292317c8d9fbc7a6aa952504f1aa7c7820c001a6050a3d97398eba4c374c16a620d2fff532068050", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694891350, "uuid": "8cc9de2e-eeb2-4f46-9905-d724e828c6f0", "value": "T1F04438B9D1F6B2A5D47C807240B289FA563EB872372755C6873A376C0BE91C107E6CC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694891350, "uuid": "a48a21eb-2c80-461c-9bf8-e9b9b595a8da", "value": "d0d523c12097b517245d838376423429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694891350, "uuid": "689090c6-4a85-4f91-aa0c-04640416ef11", "value": "3072:crIqbylYMs69g3y4wrqh8WxkHtulIz0gcuCADAfog0BnwhO5br3Gi7ouFUWEnhBM:cp69SThxxItNeAUf/0Fr3GXBMixAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694891350, "uuid": "65f96014-db28-4d01-adc2-876582794db5", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694891350, "uuid": "0ae86adf-4e7a-4d31-8fe8-bd9348d77ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694891350, "uuid": "d6d01eef-05bd-4a7f-9166-4989bf12a8ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5282d887-5484-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1694863779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863779, "uuid": "7cc5f397-218f-4dcc-a4d8-0cb39afc421e", "comment": "Malware payload (XWorm)", "value": "9226cdef332b7e61317d0d12e76578c8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863779, "uuid": "1676bc8d-f38b-4a9a-9e65-8699a330c878", "comment": "Malware payload (XWorm)", "value": "916ea8bc5735dae25ea4df4eadba0da4f85fdaeaf99dd6f7210e44ee594425e2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863779, "uuid": "727f3c19-b54a-4683-b50b-c5509619d6b3", "comment": "Malware payload (XWorm)", "value": "d24419c5e1a63ac9f552e59e1ed169e68096386c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863779, "uuid": "05af568d-d5c3-4345-be3c-564a8cfb5262", "comment": "Malware payload (XWorm)", "value": "a54e8bd02b94fe969a26bbacc54dc0ce3122bb37f1d98548e23d478d5e3c31d347ad6620d459a2dffbcedcba0951a495", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863779, "uuid": "b933d216-aef3-4c39-a053-7b4fefd0d0d3", "value": "T17131300227B25366E3B70F7424FAE3329A327502FF82A75E1144635858A0E05ECB1F9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863779, "uuid": "2b2d67e0-7f35-4777-b206-7ba970a11322", "value": "24:8FimDF69tYDvqswCK4IWsOmJBWkp+/CWRHUTHVHeEcR5FpYkUm:8smR69tGy4sjJ4m14R5FplU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694863779, "uuid": "8e5ba3ce-a480-44e5-9ded-30aac00c14f7", "value": 1740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694863779, "uuid": "485dc11e-f696-43c6-8de1-0d6fe0e9f8b8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863779, "uuid": "758f4831-7c68-488d-9759-281c1f5f91f3", "value": "Invoice_88737.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d0b29f-5428-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1694824210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694824210, "uuid": "45f1673c-0f5c-4134-a03d-c464a1e433f6", "comment": "Malware payload (NetSupport)", "value": "4a0bd493c02d5b8985f741deedf02da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694824210, "uuid": "f02b8458-0afd-4a11-b7c5-4f46d7446cb2", "comment": "Malware payload (NetSupport)", "value": "92038361b62ea184798602abbd17963ea36f3e4441a3981a8156cc286bccb027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694824210, "uuid": "2d3bdbf1-eb09-440f-8bcb-214aece0a3f0", "comment": "Malware payload (NetSupport)", "value": "ae3c17b4777a7851cb83e51ffa53be0e5fade709", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694824210, "uuid": "ddbd8a6c-09f7-4eed-ad3e-3bdf81a0e1b7", "comment": "Malware payload (NetSupport)", "value": "c7cd158fcaad4198f202b5f315f356b750c960329b48d0d81ea6278970b26e4953d3590652b2b06a43dcd3c21ec247da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694824210, "uuid": "36193483-fd1a-4eba-acd6-1954a1a50aa8", "value": "T17074AF13A291B871D5224B329E2DC9F4362FF9504E5B77ABE3185B2F09B22E1C5F2711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694824210, "uuid": "07f32581-d371-46b5-bf34-861e5f58f13b", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694824210, "uuid": "b8202337-0357-4640-95ae-9a5692512e0f", "value": "6144:qEdvD14xrxZIWI8GyqYtY4skiT3gU3IZQ:qiixXjNhW4skiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694824210, "uuid": "d2fb8de2-e716-45f2-9dbb-8287c16006fd", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694824210, "uuid": "8906d8b7-039c-480b-9579-3bad521530e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694824210, "uuid": "cedcee25-b466-4869-af0b-891013cff6cf", "value": "4a0bd493c02d5b8985f741deedf02da4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4e4e52-5484-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1694864037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864037, "uuid": "a3baf2d8-9ef1-431f-b066-225d3fc83ecc", "comment": "Malware payload (ModiLoader)", "value": "b045db7fd000286470fcfc5b555be769", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864037, "uuid": "bee5f7ec-6558-474b-ad12-bbcfa5275010", "comment": "Malware payload (ModiLoader)", "value": "920c77fdc169434909d771b4929da0fbf5e749694b05b165529913074b7024d2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864037, "uuid": "98ae9494-c85f-4927-a4ca-6ea4b4f03794", "comment": "Malware payload (ModiLoader)", "value": "2ac147f668d8d46a980272c7758782fb03cc4e14", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864037, "uuid": "2f58701f-801a-49c4-9d56-11365994693a", "comment": "Malware payload (ModiLoader)", "value": "336e80f0db7fea7a48742d3ee4988cbd95b2c935c3ceabe8c2da25a4f5395e3c6877bc8fb49e946b429adcab21d95f19", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864037, "uuid": "1ffbb0e6-172e-4c7b-ba3e-f52851c8ff30", "value": "T1C2252AF0A3B418B5E0B9B678CB0AB3E04DFF6AD5A92418848679794B5977F503F2401F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864037, "uuid": "c92d6a3c-63b0-4952-837a-f035fc8473b3", "value": "3f898278cbf17fb40d20714dfc2fa658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864037, "uuid": "6ae3a00b-0289-4fa7-bd77-ae27d96a9435", "value": "12288:SIOKbGC9aNYfbw+MmiR60Aigv4ixgKbR5hjy3H31RDHW4Qek5Dk+/+:SIRfa+f5bWZKAod5h23H3fGeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864037, "uuid": "33907f38-35a1-4b2e-82f6-c18205d85050", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864037, "uuid": "afaf6cb0-c0d8-4fe2-b7d6-36890c70770e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864037, "uuid": "dbb625ca-f991-48dc-ba84-41e995a16616", "value": "m.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0227ce84-54c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694890702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890702, "uuid": "0a7257fe-96f8-470f-9e6f-bce1d02b9f31", "comment": "Malware payload (RedLineStealer)", "value": "f82fa51032e669fc7d164b06ae6b36c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890702, "uuid": "1ce4f706-f047-49b8-b6ac-664ee5e2f901", "comment": "Malware payload (RedLineStealer)", "value": "92437616e482e2b53e82ac5053e642e75ff16a280afd0bb53a98a909ae0e86e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890702, "uuid": "01434b08-31b4-424d-87bb-dbd564d8f998", "comment": "Malware payload (RedLineStealer)", "value": "a51deaa314498048a7674b6d99aab473f921b500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890702, "uuid": "ff33ccf5-ad22-4dd1-82c3-5ac256075e16", "comment": "Malware payload (RedLineStealer)", "value": "85c8eeaab5a736fa7ad319479fa99ee7bd3c93f43cc5d0846f2b27835370daacb8591b87001914556f8f5d566ded0397", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890702, "uuid": "e9e67dd9-9f3b-4da8-9682-012aaa07c162", "value": "T14145AD25764ACE94C66A613EA6C7041883F87DC32773F606BFE63ACC45227D94D0E4DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890702, "uuid": "cc0dddb4-0eed-41c1-8de8-be568351536a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890702, "uuid": "e902ef8d-dfbf-4453-bae6-1e644398bd50", "value": "24576:AHOnhFsml59slx+L+NpmqOc337wfMXFyCZEX:+ONP+nY/fMzyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694890702, "uuid": "51d2870b-e87e-45d1-ae20-4c258b268772", "value": 1225728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694890702, "uuid": "18ec6092-6aa4-42ab-afe5-f5eb75f497c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890702, "uuid": "12f7a0da-de30-4f2e-84d1-9b6fe3954db9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07ae163-54b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694883317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694883317, "uuid": "7a9decee-3dcd-4f22-a85a-cfa792abcf65", "comment": "Malware payload (Stealc)", "value": "b7da96601373ec4c8dbe3cef31ec05b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694883317, "uuid": "ae9ac850-a186-401f-a9eb-3271c5d3202c", "comment": "Malware payload (Stealc)", "value": "93284d5b4f436b716386268d24c41971dd24c01a1fc1dacab90c19002076ed0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694883317, "uuid": "f32ac186-5073-4be9-b370-3e9cedbf6ec2", "comment": "Malware payload (Stealc)", "value": "c81416c22b6c18c040fc54ef6972a28efcf8bd82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694883317, "uuid": "73ecc320-737b-4dad-ac07-68cb09c6024f", "comment": "Malware payload (Stealc)", "value": "1fbb8fa285575da710a6dc4d01ccf8536f2e8b733bde075f58d26c87a3455bf0841dcc17b611113a5fcc5ecaa26b1c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694883317, "uuid": "a96e3e7c-6c2e-4e61-829b-f907bf2299de", "value": "T1D8A3D500D640582EE0A540FFA9AE5BEBE41C3EB41300D0C3EBB16D7925E52F6A4B55BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694883317, "uuid": "928afb9a-ff65-4333-8d70-ab0a802a691f", "value": "372dad7e771f409df9ab1b912548c291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694883317, "uuid": "53875656-df36-48df-95c6-a0c033ec8d14", "value": "3072:OwZx7tPwbpTK8Q5Uzf4JElJvIT44UTChRq:vZ1xwbJKAzAElJA84pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694883317, "uuid": "7c3cfd4c-6475-46bc-a1e6-9f43fec394b8", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694883317, "uuid": "7aca6af6-f55e-4b00-8783-a8c9dd788e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694883317, "uuid": "43f0a4f9-f278-490b-ab75-873e928974da", "value": "b7da96601373ec4c8dbe3cef31ec05b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239e699b-542f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694827193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827193, "uuid": "f65871f8-4365-4d85-b46f-12a66dcdf5a5", "comment": "Malware payload (Mirai)", "value": "d614ac142a80b5aa35a78e292915ff8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827193, "uuid": "33482299-b52c-4be2-a603-b277d93630c8", "comment": "Malware payload (Mirai)", "value": "94efcd60360652995c5a4f1e390b1d98ed6e7b3463b5748972eaf8d21c2088e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827193, "uuid": "5939d4e6-3e74-4d74-9428-68a41fa7fad0", "comment": "Malware payload (Mirai)", "value": "122e33674a2b4b1842a874eba72f788da597e1d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827193, "uuid": "54b1ed91-0e4a-4e1c-8938-8c474c406fdb", "comment": "Malware payload (Mirai)", "value": "3cd185ea57c8d9d0cbb5449f4cf7593024cb1b8cc1b8c6526c095cceb439e6af8fc6acee82c4e6ff173d09aed6016ad6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827193, "uuid": "b347645f-d73f-4cf7-be96-dd71895c6a5e", "value": "T141A2D01921CDED71D1B0843AE23DC347AEDB47B662FE327A1E18079DA45181AD3BE845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827193, "uuid": "08e1b3f0-4574-4e31-8671-3160dd9033f6", "value": "384:kXmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbsLlhymdGUop5hXL:kWoh/DxCvhdR4IjWVFbSYLls3UozJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694827193, "uuid": "f1377cfd-c0d6-4b99-9f64-1fa8cc4056ea", "value": 22124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694827193, "uuid": "20434f50-0094-4241-a4be-8b63e957491d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827193, "uuid": "1e86f49d-e059-4925-804f-aa100b0f9285", "value": "d614ac142a80b5aa35a78e292915ff8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c5d2c0-5488-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694865388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865388, "uuid": "1b9773e3-6589-4a01-aae7-fa4c765ce7d1", "comment": "Malware payload (Smoke Loader)", "value": "ec7c03fcdddcba3d5c92a7da375bfd00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865388, "uuid": "e032c5e3-b556-4802-874b-70389157361f", "comment": "Malware payload (Smoke Loader)", "value": "9546efb1a30d3f9a9c7597edc70f5f87ddaa1e30ab528627f31c5d2f65fc8e11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865388, "uuid": "571d1c14-c49d-4e0b-a4e0-8fde4ada54b4", "comment": "Malware payload (Smoke Loader)", "value": "bd391b082cb20934d84d28f3dafd3b6bc1104208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865388, "uuid": "f0c0e8ce-9b89-4270-a764-38ed87a91900", "comment": "Malware payload (Smoke Loader)", "value": "306d1fa223495fb020d77895c85e65add37dfd74c632927321695bca1ec2db50f54ca1418f35829da66234c0e8e7cf5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865388, "uuid": "c6f0a782-459c-4a9b-a552-1e17d4bffd01", "value": "T137545C1292A07C11E72A4F3A5E2EC5E4251FB8218F697BBB62067F1F04B1DF2C163759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865388, "uuid": "12efcaea-e684-4e40-b113-099e193a135a", "value": "d189d43af23bbb5425431a74f9f591c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865388, "uuid": "30c5d0ed-af3b-487d-b528-122086f796b0", "value": "3072:ra4EUPpYJTs+DIFU4oqKsLQdXoO8D7Y95g8cZeXGW:WcPpYZlt+zLoH8fY95g8O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694865388, "uuid": "b149ac8c-0129-4a59-9374-a8dd4ef3e0b8", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694865388, "uuid": "1a756ef8-c79f-440f-91d4-f3fe4b9e7139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865388, "uuid": "c02bc754-3cc6-45bb-aaa1-e57bcd352d99", "value": "SecuriteInfo.com.Win32.DropperX-gen.23588.18057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d70e345-5424-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694822431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694822431, "uuid": "7540823d-9422-4a2c-8804-bc1c4e3a4d9d", "comment": "Malware payload (RedLineStealer)", "value": "2d147442b8c6c121cc80c1d4533b2e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694822431, "uuid": "f04108a3-4789-44dc-9984-0437af276be6", "comment": "Malware payload (RedLineStealer)", "value": "95af390c2ac66a71ef8a8b8cfc197a4139e6a51180cce245aa8ea975192dc7a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694822431, "uuid": "c3734a1d-f818-44aa-9e56-9b1a8754741e", "comment": "Malware payload (RedLineStealer)", "value": "56668fa404575ebe4af696a42247f79b912d56d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694822431, "uuid": "2b40f0c5-8b5e-480c-95c4-d751e02a0423", "comment": "Malware payload (RedLineStealer)", "value": "2a023e1e0de6905066875ab8f90392b1c11a918a3847787ca5892f290cae449d6745ab62b216efbbeb61c27636d044c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694822431, "uuid": "5a612d4e-46e3-4d15-974d-204d1c5750b7", "value": "T1A7740AC03B8499EEDC8E49F16521067C9660D482F787FB537C4BA8F63C5A7897A053E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694822431, "uuid": "319d0b70-57c9-4ed1-b59f-a6ad0da0816b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694822431, "uuid": "45af445e-accc-4f89-91ce-27b65f89272a", "value": "6144:F1MsqMvGXTlns80JX04qPqPr9Tow21+ImcY1lY1Y1l1Yg9B1111Y11aY1+1h/w/d:F1JqeGXTlGJXtbhTcd3vM0y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694822431, "uuid": "3e0b6b86-d3d1-491e-b7d1-07e59e50b806", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694822431, "uuid": "e75312a6-335d-4475-b9cd-d6dd3e3e99a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694822431, "uuid": "df4fcacd-4401-49f2-8ba3-96c0e298c12b", "value": "2d147442b8c6c121cc80c1d4533b2e2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b864494-5439-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694831689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694831689, "uuid": "ee03e7ec-4199-4c76-b865-22cfd79a2923", "comment": "Malware payload (Stealc)", "value": "382c67e9b4bedb4007e0445192e3ee71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694831689, "uuid": "e8dd555a-171f-4c4f-963d-9d4e3ec4c86f", "comment": "Malware payload (Stealc)", "value": "96aee723f4e99b71d216411e44fa8f10a9ce7a01df947cc0c41aa8856076fa1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694831689, "uuid": "23105296-86e3-45ad-9f71-ea2d7a071d29", "comment": "Malware payload (Stealc)", "value": "549e6d43f325efca5b5e6d9c77d1b9f571a4fadb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694831689, "uuid": "e114dde9-0e9e-49a0-8333-e0741f157aef", "comment": "Malware payload (Stealc)", "value": "fe46ad5ab55facccc6ff250c60095146e353d6031b83299a9ea03e67c55f57266e9a737579b8b00cc405cb2efa7fc2c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694831689, "uuid": "47fec1e9-12c9-408e-a33d-e8d6f944000c", "value": "T1FD74AF13B390B871D6164B329E2DCAF4262EF8614E6B779BE3185B2F05B31A1C5F2711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694831689, "uuid": "4171f932-b314-407e-b63b-8fc7a1b27081", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694831689, "uuid": "183cbd0c-4ad7-4585-a312-8885845d21d6", "value": "6144:gYbvk62Lsxd55lHaLoFGVs8aJAyizYU7NK/amcIk:gw/2OKTS8NyQ+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694831689, "uuid": "4d51df23-594c-44ef-845a-c0ff660732c1", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694831689, "uuid": "91d37b10-da5f-48cb-b81c-069cfa51a8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694831689, "uuid": "27bf69a5-8daf-4d59-8ecb-f7a9e4fc9598", "value": "SecuriteInfo.com.Win32.BotX-gen.2760.31706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693416b9-546d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1694853938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853938, "uuid": "de32456d-50b1-446e-8d92-dd74013ef2b9", "comment": "Malware payload (AZORult)", "value": "a1199ed6fcf3f1c71ec6f7985e5100e3", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853938, "uuid": "bda6a97c-af63-4063-978c-f761b29ad446", "comment": "Malware payload (AZORult)", "value": "97cb55e3d35fc1c1d67b760d2e71ccd40f561bf06855e5ef06affac9ff4a5fd7", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853938, "uuid": "0d69e4ce-2bbf-4f65-bab6-c347050e3f22", "comment": "Malware payload (AZORult)", "value": "18b851e06738affda16d7e34d7692d1d7dbf3ba9", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853938, "uuid": "0a8ae91d-e575-45d1-95b7-c9a1d76b21d2", "comment": "Malware payload (AZORult)", "value": "0dc53c0f8f0d171c1266d0c86c61ed35428ac56e9ee6b2c9d4a7ccf49275a325553442d64263fa3eb513cdc755db730c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853938, "uuid": "ce14810e-1266-4564-843c-fa573ad97474", "value": "T100D48D93B764CDB7F4A715B66E4FC06024B12D5D81E9960D62AEB71891F330260FFB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853938, "uuid": "cb4022c2-baf9-48eb-9aff-0dbbc91dd1e6", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853938, "uuid": "b94235a9-546b-48cc-a4ef-40ea0efada28", "value": "12288:Sgm/SMJhGty5uhp065Q9BcK1DttFe4ANiX0:Sg1gRR6SQK1DttFYik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694853938, "uuid": "4bfd822e-9855-4dd2-84cb-ac014e7ccc75", "value": 631018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694853938, "uuid": "be46c77a-865b-483b-803a-2d3130243693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853938, "uuid": "648961a8-6f81-4e4c-8df1-203c96ff6abc", "value": "RFQ#110923-AQUA CHEMICALS .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d999126-5484-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694863690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863690, "uuid": "0c85605e-3041-487c-95c5-4ec9c91599b5", "comment": "Malware payload (RedLineStealer)", "value": "100adcb5d1fff446ff1f6b0e26ab6693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863690, "uuid": "754be699-7445-41b6-aa1f-b38540620ad7", "comment": "Malware payload (RedLineStealer)", "value": "984d4044b4abb03d6fe785d6a7a2d6182c6e309f7050afc93f2b1e4027279629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863690, "uuid": "0c7e9921-68c4-42c5-b341-fe44fee3ff77", "comment": "Malware payload (RedLineStealer)", "value": "95090670d427c18ed0bb80280172680482a7c53d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863690, "uuid": "aa5289b6-0494-43a2-83f5-3adfad2cfb91", "comment": "Malware payload (RedLineStealer)", "value": "9e383c53c523596999c8ae83cae793841c3814b51bdbc995b88d75475a8b6381cca9281409e980da50f1851d609fb582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863690, "uuid": "801a1872-95db-4c29-9738-91b73744551b", "value": "T12CA4CF02C2A1BD21E32A4F754E1EC6F4651FB8214F687ABB630A7B1F18B1DF1C562758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863690, "uuid": "8543db08-f08b-4e35-aff1-1f42c03699dd", "value": "d189d43af23bbb5425431a74f9f591c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863690, "uuid": "f3a67800-e430-496f-af9e-3fd5286b09eb", "value": "6144:UWPbfVCA8sJKCnsNpVgMHP1rLka1I8xRctYPJFChndA5:U2r0AxfnipVg2hGYciIhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694863690, "uuid": "ca0384b0-b180-4d4f-9c55-5d4cdf2b6826", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694863690, "uuid": "aa0efa8c-0321-477c-b658-7f4cb53f1605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863690, "uuid": "1dfd4595-554a-42b3-94ee-984aca635faf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e79bd48-5471-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1694855719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694855719, "uuid": "5e2675ef-22dc-44bd-8a01-ac885098b6a4", "comment": "Malware payload (DCRat)", "value": "abc231cbaeacc6a78ffb0b0b6c41d888", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694855719, "uuid": "8670920d-b996-4bf4-b030-01a4843b9f90", "comment": "Malware payload (DCRat)", "value": "985a754dff1bbb8dd0417b2b5ed7bcae4b11e21e3cb601b3c71dacffe01ad2f6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694855719, "uuid": "cec793d3-36d3-4cfa-be0a-2d68e6669cf0", "comment": "Malware payload (DCRat)", "value": "d4b029852dfdc661f2c97577eefd2cc4c84938f9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694855719, "uuid": "a1320fb6-314b-44ec-852c-f53d01c77070", "comment": "Malware payload (DCRat)", "value": "e27e0d1733c85bf9cc36218fc14a6c2a6e5dc4699eb257d11c0c33666359acbf984ae5db52e1bae2a40c04d94428d3f8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694855719, "uuid": "fcea81c7-d97a-45ce-aad5-6ba58f0f7c43", "value": "T1EFB5BF027E44CE21F01D1633C2EF495887B099516AA6E32B7DBE37AE15123A77C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694855719, "uuid": "5df26834-e4d3-4a18-b3ae-1c862ffa9757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694855719, "uuid": "8581a67c-0008-4330-87be-da55067da537", "value": "24576:P52L5jWV9sHb/UIklezx1GPwi3+8zjG5RfX46fJrCEYHi4HDhrPIZm0XkeSm0bGU:P4N7Fi/+8cfomBYHioDhUZm0towEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694855719, "uuid": "322e4fe2-08c5-4d42-855c-a79a5c3c150a", "value": 2284544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694855719, "uuid": "8356a2d9-d646-44ab-b77a-6af423582377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694855719, "uuid": "b62f036e-6038-4fd7-b8d9-beab65072b27", "value": "abc231cbaeacc6a78ffb0b0b6c41d888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333d6258-5482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1694862867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862867, "uuid": "10083f6a-ea17-42d9-919f-1cf551ca0b3e", "comment": "Malware payload (XWorm)", "value": "d8fa975de692d69da160564073e68a07", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862867, "uuid": "397cf8e2-20d0-47f5-96e7-fba5995e8b7c", "comment": "Malware payload (XWorm)", "value": "9dbbd33c8a3ff5d19b16ebd64375c33cdf757011ff8751784b85d2ab8a2562a5", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862867, "uuid": "6f8998c5-ab9f-4a31-9aaf-55f11748eb79", "comment": "Malware payload (XWorm)", "value": "1d7f2d2522fff174a2602a9f98645f8d7165dbb0", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862867, "uuid": "49c6d597-b1f1-4a7d-a018-47393b60d8ec", "comment": "Malware payload (XWorm)", "value": "8cd741a3ec8214d14b2118e78f0a455dc9ed9cdac7b1ad8945dd09983befef005b8bab355d3eb82494cfc9a5a6cb73de", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862867, "uuid": "b515af3d-8e1a-41fd-bd7f-a29330cfa1dd", "value": "T155D412AEE8C82418EEDEDD7980F116B1B3E61CFD0AC44AC961BD7B525E254FE851002E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862867, "uuid": "e8dd30ec-1d5e-41de-95bf-5fb42d807075", "value": "6144:TEXsHglJfID4il4XDDhKFDBjfVn2c5lk6tz:TEXsHyJfIDRGXsFDBj553k6tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694862867, "uuid": "2a8fa148-5fcf-4eda-946a-61c0abe8ea93", "value": 633930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694862867, "uuid": "09eca8ee-09c6-4a44-8f36-50b8066c4bd8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862867, "uuid": "35a571c4-ec41-4cf3-8212-785fae8c333a", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf098b3-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694835798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835798, "uuid": "66f25008-8c74-4c1b-89c6-71058a0832a1", "comment": "Malware payload (Mirai)", "value": "969136d63d9d55253a1df2016ac879ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835798, "uuid": "b00e93b0-c5bd-417c-a2c2-c3e4f4ea2420", "comment": "Malware payload (Mirai)", "value": "9fe6985330ff295ca9c9139c22ed0dd0142c6ec132f4d16ee9b06066f7da0083", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835798, "uuid": "2d0e4ffb-a443-4315-825a-eefd33932955", "comment": "Malware payload (Mirai)", "value": "43b66214517c8d288464739ca8f3247c89256f88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835798, "uuid": "5a0839de-a101-484a-b347-c530a0acdb4d", "comment": "Malware payload (Mirai)", "value": "46c83f85511d46faac4e57a9d7497d1129a518cd0a56fd504fdb16deebe4b53c76f63428fdef4b695f0128a2593d5209", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835798, "uuid": "b739c589-77fe-4e8b-9710-0fabe9843a9f", "value": "T1C9F2F1FD61F82A8ACE8C5D35CABC0365D890B0CA73CA8B78980E48D1F57C15B318E85D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835798, "uuid": "8b8a6ca1-6252-4df5-91b7-4bbfb7b1b260", "value": "768:kVmMTkMIuNyuhoDNKzMY//p+eDwgRyWKFoW2:kAskMIuwuho5KzMY3plLYWYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835798, "uuid": "17559bcc-8008-4179-a70d-5526ff850152", "value": 37236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835798, "uuid": "003b8a0a-b441-40f9-9e94-85444681757e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835798, "uuid": "b172f49d-fd8c-4cc8-87fb-ce1d2e986744", "value": "969136d63d9d55253a1df2016ac879ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47f3d8f-5463-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694849743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694849743, "uuid": "d599cf7b-95c7-4575-a625-353f086e16dc", "comment": "Malware payload (Mirai)", "value": "6dff26308ab226397a804b1df64ad7b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694849743, "uuid": "2c258e25-e49e-4eeb-95bf-c4a261611b88", "comment": "Malware payload (Mirai)", "value": "a1182e2d435be42813881dacfe21a06722069c8e1f892b1fa60b56b6d397ce65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694849743, "uuid": "8b0411bd-1c19-499e-8b1a-f42cbee30e96", "comment": "Malware payload (Mirai)", "value": "a30b82c28b8dbe4692ed1a3a86b9079351748336", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694849743, "uuid": "14b4b107-b912-4a4e-9b08-27c75588e009", "comment": "Malware payload (Mirai)", "value": "6c15ef926e5fb17ff44699f0f349b38979cede487278d0b34993f06ea7454bc4b2f2f6490ee44d6c62dcb068be04cef7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694849743, "uuid": "46684da6-9d63-4312-95e9-f18c210fc7a9", "value": "T193233AC89683EAF5EC1509712477FB729B37F43A5019FE87D395A532BC41A01A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694849743, "uuid": "7b37bf7f-0c57-44c9-9e1c-89aef9a77a21", "value": "768:J2AMjySxIWBeMnW0dhBmB0vKLg2GXFtwpDfS6fgeZdk:J2AMjySxIWBZW0dqfgbPs7S2hZdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694849743, "uuid": "af3d0506-bc51-47b2-9666-575f9f23fc02", "value": 46608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694849743, "uuid": "b056580d-8629-4b3c-8260-155a0f2e6992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694849743, "uuid": "c611b4e6-20cd-4b0a-8077-4e83e92ff542", "value": "6dff26308ab226397a804b1df64ad7b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847da320-5484-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694863863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863863, "uuid": "d424352b-0221-49df-ac96-e7fc6823aa64", "comment": "Malware payload", "value": "c932ae4681828ba4113b4290bc212b8e", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863863, "uuid": "42aa4528-da58-472c-9449-2e1988a0dafc", "comment": "Malware payload", "value": "a281df4c43a238570f6416eb18beba9336d2c8dd3d568f7a15fb9a6075a87e51", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863863, "uuid": "58465478-95fe-4294-908f-3b9c9ee23369", "comment": "Malware payload", "value": "7fefc7eb2e427cce8c9e106e0f928e3b5de25ad2", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863863, "uuid": "25a5ccae-2dc1-474b-a07e-4d5343a0f8a5", "comment": "Malware payload", "value": "e7c4e3a4bd936693ad539c082dd81a81c4f1cc7e457aa9b54d8ba33d7f390f4584d8579e925217d4796b7c0975950fe0", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863863, "uuid": "367b4755-9b65-46b7-b6a6-ca9e99c40814", "value": "T1BE3190E99493DA550DF747E242048895CF56C1AB253A941F3B8CEC883F343E989F15D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863863, "uuid": "a93d82ef-a5d2-4038-b595-a12d415afa8a", "value": "24:KqaAwAiNRfX+Ir45wkQ1kLMBRH/zSXLtGL35Mt45FLZYvgGdGIG2XGV19I/FeATO:QrNRfHE5wkQ1kKH/wkVMsF1YBHc19I/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694863863, "uuid": "4a0267e2-e81c-490f-b0d3-a364bab4f100", "value": 1455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694863863, "uuid": "04f05900-e337-492f-9491-59debae296d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863863, "uuid": "6c35ff3e-3bcd-477f-8284-11c2b55280be", "value": "fud.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c6b86e-5465-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694850408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850408, "uuid": "aadedd19-25fe-492f-940f-a912d66bbfcf", "comment": "Malware payload", "value": "3fb2bfd9e590454b66097385492339c3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850408, "uuid": "47dc05da-8cd3-46d2-8a81-06d658866225", "comment": "Malware payload", "value": "a387f2f5a3bf7e995a223c1f14ed1357c27fb97c6af1800e30fba1ca649e8728", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850408, "uuid": "b6775093-297f-45bf-9afb-7b44d9b056bb", "comment": "Malware payload", "value": "fa3359d34cada19091999e53fe0aa9386365be5d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850408, "uuid": "ab5c722e-9aaa-47c6-92da-849bb392980b", "comment": "Malware payload", "value": "ae71a3b05f0fd8a414e94c34702dc2d934909948e3b0d45c97d164e1a3765351d0ba963df88aafcd46ff08006b3430c4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850408, "uuid": "1b656eb4-7a7d-466c-9aa5-fb683c454f8e", "value": "T1C6C62325B3D7C526D64C057BE869FE4F0538BF63173551E7B6F438AE88B08C062B9A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850408, "uuid": "adc9ac75-d2f6-4eb6-9a3b-562369b87d62", "value": "196608:apyMPBykVw34e9jhsUAneFjUEOhGy84WzdD3gdodBec53+GgP7usz3mi:apbPByow34e9yovO38hdD3g+dP051", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694850408, "uuid": "4c2a23eb-74de-4115-b0b2-b33e0fa7be4a", "value": 12349952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694850408, "uuid": "477a818e-d153-471e-8dc0-56d84f0bf493", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850408, "uuid": "1235811b-aa38-46ba-a8b2-40b92619558f", "value": "NFE_098734_br.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a94050-5488-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694865447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865447, "uuid": "f483881f-e942-4580-9ab9-e84d4b262908", "comment": "Malware payload", "value": "1f56b0dc47f4fd38b9d3f1312747f7dd", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865447, "uuid": "1af1c18f-5994-413b-ae60-8d4b155771d8", "comment": "Malware payload", "value": "a3ba0408eda35a0e503b73280f012b7bba53f13793bb1f0556803f3e96cf75f4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865447, "uuid": "71fa90f8-159a-4aee-a8a5-d90414e06c3d", "comment": "Malware payload", "value": "7d6b0cdf9a307217f1bd15d4c82fb8844ff1006f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865447, "uuid": "c52fc9d5-8e94-477e-acae-c2d8cd29b522", "comment": "Malware payload", "value": "363c3ba3b1745f48456e6dfbaa4d34928873edd161febb1fdc7bf65e410fbb4a3f58a7f864f38119b8f06119490944ab", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865447, "uuid": "dc80d7e7-69e8-4947-b6ed-73d706571ff7", "value": "T1B341EB021DF90333D23A8771D2F4C5A56BA13453FB828BACD0A4821E0033F0BA819F9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865447, "uuid": "e8e27683-010e-4c5f-9d56-70c035c04f82", "value": "24:8FAjUr8//4I0HkuR3/Tc1UrwUMe8h/KUrNn3E588+Cj+7SxRQvMNZuw7UrQMvf/R:8SoIZuR3ohj3S+7siwjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694865447, "uuid": "9e10c02d-7a95-4fb6-b5a0-2dcb422cb69c", "value": 2299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694865447, "uuid": "1604c533-6752-4b60-856a-e7ecd14fec6a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865447, "uuid": "ce4dc0de-f390-4c43-b62c-fcb7be253097", "value": "Payment_ref_#83943494.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9392fb64-5461-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694848855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848855, "uuid": "983495fd-749e-4c30-ab17-68154414cee8", "comment": "Malware payload (RedLineStealer)", "value": "d23f996f0b6f63e922490be267ffbc38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848855, "uuid": "4e6123dc-3b05-4ee2-9e39-367b7f31d36c", "comment": "Malware payload (RedLineStealer)", "value": "a3cf3e8a2a44ac90b160dc908784b66611258f34a0d00f84c9c80eadd1cf155c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848855, "uuid": "c0d321be-ee64-427d-88e5-a326e7244d1c", "comment": "Malware payload (RedLineStealer)", "value": "a1454db92e374e9a820873dec28e1bfc6ce0f1b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848855, "uuid": "7a01805d-840b-42da-bc71-f57b04fec339", "comment": "Malware payload (RedLineStealer)", "value": "6dffaa20391cf5a2a46e7ed8f46e4b8799ad6a7fd1c53430bd77f9565d716b3274443c0fe9e7b53900fafb28183c9038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848855, "uuid": "e22a9804-7cf3-4064-bd97-8822fa385080", "value": "T1C7847C18B1A18C32F7B6C1725D7EC9BAB729B8300F9562DB4BAE4F99DF301D18670512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848855, "uuid": "49aa056d-861f-446a-a1ff-90ab92325aee", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848855, "uuid": "910af3f2-b6e4-449d-824b-b2290b46721c", "value": "6144:heOcF7qOXciQ3xFF1kCaX4z4AOSlXfLmiDFQH2CkSvEqW8fi:wOc1tXcve44QlvLmipQHNknR8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694848855, "uuid": "894708a0-a2e4-4c51-bf74-0c464e322d15", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694848855, "uuid": "49ba1c41-a271-4671-8e43-fde29df69f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848855, "uuid": "89a244b6-3ffd-4365-99aa-ff9c8856894a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51b0388-5431-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694828403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828403, "uuid": "0e4db0d7-9f49-4b1e-b474-c7f5f9047cbe", "comment": "Malware payload (RedLineStealer)", "value": "4ea30635eed2b533a725480e326257ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828403, "uuid": "1131c4fe-7d9a-40f3-b41b-c4e91cc80fd6", "comment": "Malware payload (RedLineStealer)", "value": "a3ecec0dc331e402e4c9ae68e1c5554b373e39298800e1a74da6a320aafa940e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828403, "uuid": "12f97516-076f-4f0f-ae7c-130dd1fc84dd", "comment": "Malware payload (RedLineStealer)", "value": "2a9dc001cf4dcbc967607350bd7a58aa78992817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828403, "uuid": "b88c2442-db19-4ba7-88ff-7e1821d89ecd", "comment": "Malware payload (RedLineStealer)", "value": "7422aaf581caf7351479457323a578866dd28d830095d9b2c05d71ef904717ba30d7f4cc5737cedb309f9643657ad53d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828403, "uuid": "05c02fd8-c903-49f6-8f0b-950c9f119c6c", "value": "T129847DC531928531F5F6183695E4C6ACCB2E282D836905FFA3A0E95DD6D32D24F31F68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828403, "uuid": "727163a0-2a20-472c-a65d-755e6a8f56ee", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828403, "uuid": "4664ff47-2323-4b8a-98dd-03fc56d43a8a", "value": "6144:rezcF7qOXciQ3xFF1kCaX4z4AO8HU0+gsxzVY8u7a87+K8fi:qzc1tXcve44KHVkzqfu8V8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694828403, "uuid": "e5a7d715-b817-42d9-9f69-0eb76a9594e6", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694828403, "uuid": "35175ace-ee37-4e05-bb6b-4475938a245b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828403, "uuid": "ffbefa5c-f0bc-4e03-93ce-5248d91d4714", "value": "SecuriteInfo.com.Trojan.Siggen21.29429.18699.21600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5994887d-5477-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1694858207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858207, "uuid": "6dfe4a27-1fd9-4de0-bfc4-7d73ba4eee4a", "comment": "Malware payload (MarsStealer)", "value": "29df412b9bddce9b6080d7fe66610868", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858207, "uuid": "5ed18960-ff48-4440-bbfc-3b0d24db6cff", "comment": "Malware payload (MarsStealer)", "value": "a5e7f0781b82d2f124bd113e2be8df4e6bdf61b1b25b31ad813b41336a174844", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858207, "uuid": "da7e7b93-3507-47d3-8608-b0280ab60374", "comment": "Malware payload (MarsStealer)", "value": "500fc57fe1af43a9a13878ff08a2ce6a2969dfbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858207, "uuid": "07e0d01a-4a5a-46bc-bee6-b1b272e7d7a1", "comment": "Malware payload (MarsStealer)", "value": "9c6404c70995551c0d877a626956ddf451fed399e6500182bf47eae1f9ff1770bffba4c6663d6e3f628c1af699999cb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858207, "uuid": "c6140fbf-b0ac-4fa4-9d6a-2523e55f8740", "value": "T1EF449F03B3D1A8F1F63646318F2DCEE42AFDBD618E65665723E85B2F09B01E18972351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858207, "uuid": "39101850-2921-4d78-bbdf-366516fffd3d", "value": "be971270bdc2a8fd4ff1ab41bb993dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858207, "uuid": "44227608-82bd-4193-a37a-f86cc00b241d", "value": "3072:vbkLgYBMvWahM0NbfEywI4Ds3RAM7jz9Snj7NKp3wXGwNW+f:DkL8vWahM0Nbx4DsB1j87NKp3wXGGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694858207, "uuid": "2807105d-1e16-49a7-9711-ac8dfea1fca5", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694858207, "uuid": "d9437f9e-3bc5-4d7f-be43-66b0dd9d73e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858207, "uuid": "275258a4-ea4b-41da-bd40-aba0d6998b46", "value": "29df412b9bddce9b6080d7fe66610868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f68f06-54c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694889735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889735, "uuid": "b2b43e0d-4194-48b9-81d6-0721a3b82454", "comment": "Malware payload (MysticStealer)", "value": "fceadd39dfd3ee2656a8794d6953f939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889735, "uuid": "ff4b1cee-5b52-484f-8f07-d77f9be3031a", "comment": "Malware payload (MysticStealer)", "value": "a615c86cb0cde7ab5389667672a5975b4cbe7908c483b29234f7a1afcbe3ba4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889735, "uuid": "98567189-333d-4cd3-9dd5-d4c328dd3143", "comment": "Malware payload (MysticStealer)", "value": "4bb32053a733c709b9ff4187bf29c91d0ac40b44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889735, "uuid": "ea2142a4-850b-4912-ac96-7dc5a6b8d7b3", "comment": "Malware payload (MysticStealer)", "value": "0764d715252ed85522ef7c6956906a108a491bcbb0775d1ffafe84dc537cd8cce6a2dd3ab7b6dca0d99e8b971ed0cbc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889735, "uuid": "d074eb66-6c15-48bc-af99-61a16a24ab37", "value": "T19074BF01B4D1C0B2CE76793149E487FE8D3EB7602BA958EB13D48EEE8E24DD39534652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889735, "uuid": "4b559668-454c-4c85-b584-bfe74c1e4ecc", "value": "fc6316c96fc105fcdafe08845aa690ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889735, "uuid": "ecb619da-8d2d-4d2a-af8b-91e5f9519d7c", "value": "6144:gRcaGEZt20ZSwbz8+Dxe8kVAOfljgN2PaPsDaJdmvNoICuh8Ey:gRFzZtT78Th3CPsgUtXh8Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694889735, "uuid": "8d6b1c86-8dd1-415d-b9bd-ac4e6fa9b09f", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694889735, "uuid": "9210f2b8-192c-4bc3-a178-1b01139ade7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889735, "uuid": "08295358-d46b-4a87-8a45-3486069339fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b7c8a2-547c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1694860581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860581, "uuid": "451732c7-4b62-4a77-a757-9d1a0feb4ebc", "comment": "Malware payload (LummaStealer)", "value": "daf5fadf4e42743fe0463d23ffaf8a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860581, "uuid": "92744c43-dc41-4d77-9c5d-301c12fb8c71", "comment": "Malware payload (LummaStealer)", "value": "a65b98c3ab3e2131237638386efc92c6c3fa247f52fad896252cf3f6556ab651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860581, "uuid": "e00c4e52-00d7-4651-abc6-d9812443b596", "comment": "Malware payload (LummaStealer)", "value": "78b8e7b69231767feb1fe01648e1092ff15997de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694860581, "uuid": "849aa9f1-7cc6-476c-8c83-930d7223dac2", "comment": "Malware payload (LummaStealer)", "value": "cf5a0d772e5e6419fe2068041c6f21d92dce166e39b7e32cbda48c2fd2a596a28a47397f29231cf0cdedab25bd0023cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860581, "uuid": "216a3ca1-b1f8-4a63-a66d-34b0a4957bd2", "value": "T1854527136E868DA3C3871B32C18721643FAAD5883317C7AFA8597355A76336BBC4F506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860581, "uuid": "b559aec2-a761-4b56-a3fd-f81262a01d4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860581, "uuid": "74f7bbf3-7f82-4e92-8acd-450e6676fbee", "value": "24576:d++s5Nyo6C/aNWH5XQ3uk2fpFkLGkiR1Zn:dPsXaoQ3ipFIGk8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694860581, "uuid": "9023043d-d26f-45e0-9e09-cd265b96db56", "value": 1205920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694860581, "uuid": "b0911070-665f-4735-bd63-b05c5765c397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694860581, "uuid": "c6369d48-df59-4f47-b2ca-19c9279c87cb", "value": "SecuriteInfo.com.Win32.PWSX-gen.6681.17605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28051932-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841374, "uuid": "d2e6379e-3665-4b0a-8f18-aa9f6301c657", "comment": "Malware payload (Mirai)", "value": "0c9095103d5268edc807937bcfcbb82e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841374, "uuid": "d6d2e0a2-7578-44ed-a0fc-3a80d2aa28d1", "comment": "Malware payload (Mirai)", "value": "a66452e290ddc323e8f9cc47081cc72a8e57530dae0d5c3cdfd0d7486d3645a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841374, "uuid": "54b559d0-d635-4b59-a278-06f3ea3e3a27", "comment": "Malware payload (Mirai)", "value": "5d41359941af2204b0141571d39339272bad6a76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841374, "uuid": "d0476431-ef73-4e9c-92c8-99f7ff63705b", "comment": "Malware payload (Mirai)", "value": "7f04a944a7b29fdea035f5a20c77b4606704a085f513621da52eceff4c71ba77ee820fffa29a77b34d7b7a261749cf5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841374, "uuid": "2bc00385-7d8b-4426-9f16-e0e7c1f6578c", "value": "T163A2E01462A32D55F3EC1C3DC9AA836BB9671BFC90F6327679445620C90D20A2E38B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841374, "uuid": "22a0819c-a9d5-4dff-bb49-4716f0eb088a", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjzwhymdGUop5h5:TvQn4j+ZO5fKAlxvws3Uoz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841374, "uuid": "090af02a-2880-42c3-89a2-9a030737c23f", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841374, "uuid": "d59d94c0-884e-4357-aebd-50ab7d3c9c3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841374, "uuid": "4976851a-d3d5-43d4-807d-177c3d87237e", "value": "0c9095103d5268edc807937bcfcbb82e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be625e3-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841326, "uuid": "73f9ac03-8778-46da-997e-4d6faf17278b", "comment": "Malware payload (Mirai)", "value": "379365859c6014f6101385d024ad0414", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841326, "uuid": "d2ae7d81-91b6-44a3-8cb9-e014a4ebdc02", "comment": "Malware payload (Mirai)", "value": "a6d5044d802401e9228a4ab18fe928f8df6c6ae1f507dbd0c5273fe6449a4c30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841326, "uuid": "3f214cdb-6f4d-42f0-8836-03be9e757b3d", "comment": "Malware payload (Mirai)", "value": "401e9f9e2145ab69aec78cd10a62bd702baa9501", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841326, "uuid": "02976d67-80c9-4bc5-9cf2-f7106b15870c", "comment": "Malware payload (Mirai)", "value": "00ac788c8dd178de55d4d29435e9a2c3acefce6149e7fe67f0368ed9cc4bf8b6f687eeb0866858b158a4b39e752d51e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841326, "uuid": "9dd228a8-e593-45b2-9a0e-0a96d9ba8fb1", "value": "T17CA2E015BF1C86CBC832297555E9F6D21352FC62F2ACCC192A40C15FB4A33E96834F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841326, "uuid": "86abd5ae-aa69-4a22-8d44-6029852136ee", "value": "384:Mg/Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKK:598o08kxofBE+ZkXaqGbp2F2TWul0c5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841326, "uuid": "335d42e3-76ac-4521-82e7-88dc847d24ba", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841326, "uuid": "3392313e-83b5-4dbc-b5c7-508efe4a3f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841326, "uuid": "a9d86262-fcca-4e55-8644-754a3b19007d", "value": "379365859c6014f6101385d024ad0414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1167e223-5460-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694848208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848208, "uuid": "5a1dda94-fd19-4abf-93de-5e675e0fc68e", "comment": "Malware payload (MysticStealer)", "value": "8d864441bbf84427b28ec3886579abf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848208, "uuid": "123b6cae-1672-4ca0-80e0-bcfd2dfacc7a", "comment": "Malware payload (MysticStealer)", "value": "a85d4510bd0322448cc594e1416863ac721db711d57d35f754a83469c6613f30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848208, "uuid": "537a2773-a8ef-4feb-90dc-02ca5fd03335", "comment": "Malware payload (MysticStealer)", "value": "1e39e23d3c857e74b755cc08d592c4b42a8dd818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694848208, "uuid": "c0233b9a-973d-4531-9394-5af5a3a5a9a8", "comment": "Malware payload (MysticStealer)", "value": "550cceec4210746f9eb66bb9b4177933018cda6be72e80b05f58246407375b9e7aea1191085cba1f0fd390cb53c22372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848208, "uuid": "65a63df4-7ee1-47dc-b7d8-c5605ece052c", "value": "T168749D1D35DD8032E8B334314BF4A7BA55BE64611B65A9FF67E80E2E4F282D3E671021", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848208, "uuid": "4e9c3a40-35d4-405d-893a-5ca22ef2e2b2", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848208, "uuid": "1e11695b-4a60-4f8d-a44f-7ed53634d8cd", "value": "6144:f/ZXR/bOEHHkwxOSeyCKrJz4AOo8J1po0EQcEyiRtCxdyFo8fi:HZX1aEHEw9468vpo0EJ/iRI+m8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694848208, "uuid": "16ed2221-94df-419c-b872-7b0168c43404", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694848208, "uuid": "c6b5c1c3-9d61-40dc-a60c-243adf563a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694848208, "uuid": "77ff77fc-1e62-4cef-83c8-40308db56c7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac44f6f4-5465-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1694850615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850615, "uuid": "d52c9286-0eb1-4566-b86e-4b31ae20a7d1", "comment": "Malware payload (DCRat)", "value": "a952fa4049673f3d3ac43de0850e32f8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850615, "uuid": "d8ac9a57-ca49-427e-a4cf-9749b3cc4c2e", "comment": "Malware payload (DCRat)", "value": "a85def6a9c93df7a6c059e5e305dc374ef74c44a4cc77e628b0c945354e4ecb6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850615, "uuid": "e05a3e65-89a0-4122-b818-391d5abf84d0", "comment": "Malware payload (DCRat)", "value": "d53041c60c2b1afccc24c7dba37bd5f202dd54aa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850615, "uuid": "2ea01fe1-db3e-41a3-9c87-9079e1aa722b", "comment": "Malware payload (DCRat)", "value": "b09360eb6f1aa5cc604c8956e7734c04a2bbf584387011499d3e04b4f2c99e475e598df68d6f3c9862ce419923e55519", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850615, "uuid": "f7b0bcbf-d31f-43a3-9d5d-33ea7ee4ca16", "value": "T1EC557C017E44CA81F01A5A73C1EF520847B1EA516AE7E31BBDAA337D15123A77D0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850615, "uuid": "dac23527-84a1-4a17-abac-e3c949e105c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850615, "uuid": "ec820855-6095-4226-ba77-eb6e3a9ed178", "value": "24576:0NTh+5PmqhyBpS+AtVbI1xiJSaE60F0hoYHF6HscOqNqZqBqD+zLhFFHK3z:0xh+5P9EAtV49F0WHsjrZTDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694850615, "uuid": "63bf3654-074a-4481-afa6-f2f35ea5831c", "value": 1342464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694850615, "uuid": "9ec500b6-dd79-46d7-abb1-f32cbefea968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850615, "uuid": "f6041ccb-fc15-4a97-8b36-4535dfed3e77", "value": "a952fa4049673f3d3ac43de0850e32f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a230d8-54bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694889265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889265, "uuid": "aa1e67d8-285e-47db-84b5-ee743d54008f", "comment": "Malware payload (Smoke Loader)", "value": "c712b6840bb62aca6ed0c34c4c4023e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889265, "uuid": "168f6741-3c36-4670-a490-df5a75f96588", "comment": "Malware payload (Smoke Loader)", "value": "a93c61d7bd1e389896a858835e1b035a12759086ddb4a25b77b772ee2854d7b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889265, "uuid": "fc801f3f-3561-4dbe-a345-548bd54df441", "comment": "Malware payload (Smoke Loader)", "value": "bd4950c97057194538101e899969364504f0404e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694889265, "uuid": "f01775b3-4f13-4e4a-98c1-dcfa2c5239ba", "comment": "Malware payload (Smoke Loader)", "value": "5e10c4cd5e32168f82d4a9c09b277987e0a5ec61f9a2a7f8a227076654dbf61f234e311854633936d2caaa46dd79cc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889265, "uuid": "b27b93a2-534e-4d0a-92dd-80ba941132c4", "value": "T1CE445B0292A17C10E7294F769E2EC5F8261FB9114F69BBBB520ABF2F0471DB2C572714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889265, "uuid": "84952340-587a-4748-9b00-901577e687b6", "value": "d8c39d5ff6edc55fa56f3300f617117e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889265, "uuid": "9f1a0e0c-5449-4679-b4a3-19a2834fadd3", "value": "3072:R8HYrv0xhZI0F0PJsDxDq2vWHA5Af2zDmOZ1F:OYrM/Zb0PCFDqpyDma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694889265, "uuid": "4503282c-e328-4c7d-9f6f-c9f120d2b15d", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694889265, "uuid": "dee8ff79-fdec-4e53-8ea4-990c284b0a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694889265, "uuid": "5fc175d4-cf07-4d21-8487-1644d07487b8", "value": "SecuriteInfo.com.Win32.BotX-gen.1554.13371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722fe849-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1694852235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852235, "uuid": "ec19a9e0-3d3f-450a-971b-4565ff8a89ad", "comment": "Malware payload (DarkGate)", "value": "7996ed8cc6479124c941ab5d136e4841", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PFO GROUP LLC", "colour": "#216C9E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852235, "uuid": "ea7fe1e2-cf1c-4775-9eff-3ecbc4d9cbc1", "comment": "Malware payload (DarkGate)", "value": "a9ee4f3dcb9ae9ef57d9677a899d5f1c011dcb17275e95baf87a869f4f3dadeb", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PFO GROUP LLC", "colour": "#216C9E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852235, "uuid": "05402b3c-9a4b-4a50-b096-3788f0bc7d32", "comment": "Malware payload (DarkGate)", "value": "092bd61e92aa0745af69e777f341ea7184c3d743", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PFO GROUP LLC", "colour": "#216C9E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852235, "uuid": "c51b7be6-c251-4823-821a-5557fd385f4c", "comment": "Malware payload (DarkGate)", "value": "9c3b6ecd61c6779c1aa80b814d98f083244cb632e79e70849324d80f7f1846f506a7aed095cc15b803917553c9884c43", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PFO GROUP LLC", "colour": "#216C9E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852235, "uuid": "9e009e1d-1062-4ef6-8590-273a8bdfe8fa", "value": "T1C8B523623BD5C539D69B173680BA87752A6A7D245B30C0CF7B4678B86F322D39638312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852235, "uuid": "9bab4553-d3d7-4211-be75-278ed18d909e", "value": "49152:NpUPhaTtpSD6TmY7GBXGBr4wBlBLr1GAtrlc+jjK0I7SfBx1jDbKg5A+:NpgktID6dFBrJBLrY+rmR1s3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852235, "uuid": "9589ae4b-ac91-4220-9afc-0b4ed77b6b27", "value": 2306048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852235, "uuid": "3fd0d901-b7a5-4664-ad8c-3b360e4b0eae", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852235, "uuid": "797dd317-73e5-456c-a110-df17766d05cc", "value": "p_terminal_x86_install.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c8eec9-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852449, "uuid": "074ba8f3-da9c-435e-8cbf-72b936d6218d", "comment": "Malware payload (Mirai)", "value": "d2471b89c89f5e7bd597d996b6bc45f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852449, "uuid": "55419d0a-2151-4316-bdb4-0ff4126931dd", "comment": "Malware payload (Mirai)", "value": "ab09de1d1ed43ae4275e26532da3a3d5365081026fcbab5af8b8c4643e65d4a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852449, "uuid": "32e2c77c-8777-4b00-98c5-013bc89321bb", "comment": "Malware payload (Mirai)", "value": "ccbb9f77cabc135356b3d0c0585868bd66dd1844", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852449, "uuid": "9fb1e46c-3c10-45a2-bc1f-0d4591a984ec", "comment": "Malware payload (Mirai)", "value": "81e2c105a516e66321c49c937cee9e061d60a367bcbe863e4f1c9af1575a0a95140c62b73daeb6249bdfad6ace86ec22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852449, "uuid": "1bbf85a9-a309-4b25-9d63-50fb3490eda0", "value": "T17FA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852449, "uuid": "c92b43e8-99a0-4807-90a3-c27986bcf9a4", "value": "3072:VK1z13U6HzHoXRtmTUhQog2EmmFVcqq0GnDZT:VK7DDeKlog2EmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852449, "uuid": "90c4fa9a-67d7-4400-add5-e7fd03eec974", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852449, "uuid": "5f8debe9-6ad7-40e5-bfc9-c14db7aa539c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852449, "uuid": "5a58ca9a-91ff-46a7-af2e-62553e694214", "value": "d2471b89c89f5e7bd597d996b6bc45f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e5b971-5442-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.DownloadMR)", "timestamp": 1694835459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835459, "uuid": "cfd551ad-a7c5-4501-b60d-e3472164fd1c", "comment": "Malware payload (Adware.DownloadMR)", "value": "e6f506f57365deb1b24b84eafbd9271f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835459, "uuid": "4445bc22-9263-4e2b-86ed-fede2294fe23", "comment": "Malware payload (Adware.DownloadMR)", "value": "ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835459, "uuid": "efa4506f-5007-439a-804b-142b699b96c2", "comment": "Malware payload (Adware.DownloadMR)", "value": "d120720527f6d02f2c6e058bc95cc18d8c23f269", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835459, "uuid": "20e41a4b-a713-4fa6-aaca-076a3f8c6434", "comment": "Malware payload (Adware.DownloadMR)", "value": "b0bfdef92e54750b4d57323cf75b8ca233c437011b5c27bfa4d21c06440de98f067c903a1cffc63416c417891f6fef34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835459, "uuid": "872808b5-8292-4d2d-8619-9299648eb44c", "value": "T1A0A42354C31A93B9D10E493B1C0ECC975B94E39962079FAF894E6166FC0B98D44C2FBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835459, "uuid": "62d00649-fba8-4287-bbb1-283d3320fea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835459, "uuid": "95d3b236-26af-41d1-b22f-bda4278d9ef8", "value": "12288:zPmdD7nWjmGR5iErreKOOkLsxhDzfrroATRwJJ:7mN7u5iEKOKalroATRwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835459, "uuid": "459a3269-1cc6-412c-bc18-27441d5b345c", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835459, "uuid": "19bb98fd-3c88-4d50-9676-8caf1c2036ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835459, "uuid": "4fb01717-752c-45fa-8f7c-e77d17b3764b", "value": "e6f506f57365deb1b24b84eafbd9271f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c446704-5493-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694870318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694870318, "uuid": "92a2ff97-1671-4be8-89f4-8987e719ebc5", "comment": "Malware payload", "value": "ec1e2a7c7179f8e8d89d0a26c28a53d2", "object_relation": "md5", "Tag": [ { "name": "cve-2010-2568", "colour": "#28681C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694870318, "uuid": "4f7c4bf6-1970-4598-b6bd-3b1bbbf026da", "comment": "Malware payload", "value": "abe980c40afbf06e52925fcdbd73701467f0f4b7b19739fa4b949b81852917cd", "object_relation": "sha256", "Tag": [ { "name": "cve-2010-2568", "colour": "#28681C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694870318, "uuid": "6f069288-69b2-4f63-9c00-bb81e518263b", "comment": "Malware payload", "value": "ef71dfc8ce954e5d9a98aa3041551da075771189", "object_relation": "sha1", "Tag": [ { "name": "cve-2010-2568", "colour": "#28681C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694870318, "uuid": "37382c71-8b00-481e-b1e8-574202985b52", "comment": "Malware payload", "value": "397b571c71219a69251941a188c0155e399f3c62741a5ca2b26e78efb5b4be45e05168a2e3094422efdba88ee01fffe5", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2010-2568", "colour": "#28681C", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694870318, "uuid": "1c439e7c-8af5-491d-bcc1-97105e251917", "value": "T13B0423A101524551F3D8A37F3EE877097A983B8B04A1E7A685C379BF6C18C7A46BD00B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694870318, "uuid": "1f3253ef-b2bf-486e-adc6-9914f6523e26", "value": "3072:bU8ni5YHf4o2OT4m1Ow4U/1ddYJC5xANNSfg6IdRU6gaoY8TTqty/U4xZWU:g557o2OrOhUtduJGxANkfC7toYK8y/53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694870318, "uuid": "7873adae-e100-4a06-a345-49ceaf00c5bb", "value": 185667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694870318, "uuid": "4723e767-84c6-41ee-8ed4-da02d570b320", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694870318, "uuid": "ae7f5baa-c05c-4362-ad50-8406500785e2", "value": "NASA Database.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b1388e-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694835753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835753, "uuid": "42672b32-f470-476f-bdaf-3c3fd795cd2d", "comment": "Malware payload (Mirai)", "value": "30b6f5a0de1cdc5c4238eb30dcd91a26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835753, "uuid": "fb0526d2-e062-40f0-b738-81051502647f", "comment": "Malware payload (Mirai)", "value": "b07194492852a6ac6b09b343f5aa10bc6353fd95dc33b229757a9233f1830e79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835753, "uuid": "0a079691-56b2-4ff2-a003-dd2c49c8b0c5", "comment": "Malware payload (Mirai)", "value": "4b0893211b16d00488c71fce07c64e8e3ce166b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835753, "uuid": "eab67c96-0da2-4c0b-aacf-7df2320b6dea", "comment": "Malware payload (Mirai)", "value": "f43c61feeb0f41c787b11201b8144bf69885f06b912bbdc79ea4e3193ecb17402e194faa92b32ef0afb540ac54dae535", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835753, "uuid": "8a4897a7-0cad-46a5-9bf4-4314710f653e", "value": "T195E2D017469A5698C8BC52BD60FEF9471054C31BF260CC9BEDE2303A9D4EFA43641BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835753, "uuid": "27944155-6cac-46de-af0b-e05ff1bdccd0", "value": "768:Y7bb9ZSHVcNEpYFPj3iqE3Uy8zDBzBcbcDEMErdnbcuyD7UoQRjX:Y7IVAPj3N3ziGk5nouy8oyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835753, "uuid": "5d5edae4-482d-437a-bc85-07cdc96608a7", "value": 32664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835753, "uuid": "b7df2df2-409b-4719-9b47-a66562d0618d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835753, "uuid": "3e1dabd5-936f-4c0a-8869-6bf16875ed6e", "value": "30b6f5a0de1cdc5c4238eb30dcd91a26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112761dd-5488-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694865387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865387, "uuid": "10813cfb-d8ea-415f-8301-500efb5c6a5e", "comment": "Malware payload (Smoke Loader)", "value": "deb9302060c7ff8df9216a531ce7f447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865387, "uuid": "9f65738a-e74e-4b05-b50a-aceb3be08d7e", "comment": "Malware payload (Smoke Loader)", "value": "b2843f650b2dad5ef0013b57f06cd51763f62365cf2c8db59fc2cad126dad682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865387, "uuid": "40322735-ecc1-410f-8248-ed7109c98f9b", "comment": "Malware payload (Smoke Loader)", "value": "dddf7bc6246bd26e222c630c090871ecb7fd1985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865387, "uuid": "5a80bcd9-3adc-49b7-a3a0-95f45a190913", "comment": "Malware payload (Smoke Loader)", "value": "9da06e7c9d719377513c76606c30687ed7d562382f3d6eff3fca8be4cb24d01c89b896fcc4a002b02f391f6258921d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865387, "uuid": "71011482-526b-4346-85b0-cd76c12050ee", "value": "T12B546C0292A07C10E7294B768E2EC6E4661FB8614F68B7BB621A7F1F04B1DF2C173755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865387, "uuid": "3c3ed820-c1ac-41ce-bf95-5a913ca9c1ef", "value": "d189d43af23bbb5425431a74f9f591c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865387, "uuid": "77ea404c-49cf-4700-b682-e4394b4daecf", "value": "3072:0af0kPlr7aoj/CQiVCynGWZ8GV0lMECipao9rkI4mKhW:jPPlr+RQiw2v8c0lMEbxrkIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694865387, "uuid": "c71023eb-e971-420f-98a3-4ab5eaa5f387", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694865387, "uuid": "c827b9a3-87ec-40b8-a07c-d1d7c6cc2581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865387, "uuid": "06de7fec-02b5-4867-ad1f-09e2064ba815", "value": "SecuriteInfo.com.Win32.DropperX-gen.2236.8653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dec2a8-54df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1694903112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694903112, "uuid": "739724ce-c825-4ee0-8d75-4ad760edc5a2", "comment": "Malware payload (RecordBreaker)", "value": "e3051f579b8d3ec8e0b33d212a1aecf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694903112, "uuid": "7e39310f-9ec6-482d-acb4-8689558d54c1", "comment": "Malware payload (RecordBreaker)", "value": "b2f12a3ef735f92b67cf807fb8be7df8400c065318ad3b0f8cd144738db7b96b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694903112, "uuid": "64a20dff-6c24-4f9f-b6f8-eee460870ba7", "comment": "Malware payload (RecordBreaker)", "value": "ddf4d372cbc868e1b033e824c757d48f9f71d151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694903112, "uuid": "7c21d013-8915-4def-8b39-4d5d1566f9af", "comment": "Malware payload (RecordBreaker)", "value": "3586dd89e79cad4f00cb9fd02ef820a423417e77e418f1cd4200b4dd08fdcf2cbbe6d0c950762860cd6b1bc244cb64f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694903112, "uuid": "df6fbbb7-557d-48f3-906a-141e8ada1e16", "value": "T15F649543D6A23D8CE9278B729E2FC6E8764DF2508F4D777D32199A2F04B40B6D1A7610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694903112, "uuid": "b5d370ce-1ed8-4f11-a31b-250d545308f5", "value": "4204b9f7d0ffdbe2928a3ddb092604a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694903112, "uuid": "27d48884-ad56-4b9a-b4a7-f30a7d47b7ab", "value": "3072:6IP9bYYgLULlD9cRfTr0QDJw14jsIRJxjs3fQi4j5W/S0Jkuzi:V9TgLUBD9chDJwGP5w/Smi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694903112, "uuid": "65db1fb4-475e-4071-8061-af538a061c35", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694903112, "uuid": "763f9b36-05b2-49a9-abc9-f4886daa6732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694903112, "uuid": "993cbcf7-5c60-4534-b43c-0f3e940a049e", "value": "B2F12A3EF735F92B67CF807FB8BE7DF8400C065318AD3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9568df9-5485-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694864381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864381, "uuid": "ca54d8ac-a571-4add-9ca9-fbdf35f3a29d", "comment": "Malware payload", "value": "f9d97c8a51759dda4766283bba74d723", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864381, "uuid": "41c2fd17-3d29-4d27-8d4c-bbc11e9a6bc7", "comment": "Malware payload", "value": "b4cd01f15e6dcbae16fab36b7a74117fb5db01e1693b7b8ed48aeafa662eb054", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864381, "uuid": "e349a4ea-c06b-4ba5-bb07-d0b8935e6b0e", "comment": "Malware payload", "value": "31244978d1a7f36456bbd768bd31c9f8b1b5d933", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864381, "uuid": "a57a2965-dbfc-4f9b-a349-4d72f04586b3", "comment": "Malware payload", "value": "00e7252088759ead0c031c4306c427dd961108880b9d8b62c3f34c309218e5d493d8acdc114fd40092925bd620808991", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864381, "uuid": "8e5f168b-feb8-41ff-815b-4a75a3fb1587", "value": "T18C31AFE99493DA550DF747E242048899CF56C1EB253A941F3B8CEC883F343E98AF19E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864381, "uuid": "3c940909-f1c0-419c-921c-9dea12c76d83", "value": "24:KqaAwARXRfX+Ir45wkQ1kLMBRH/zSXLtGL35Mt45FLZYvgGdGIG2XGV19I/FeATO:QWRfHE5wkQ1kKH/wkVMsF1YBHc19I/Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864381, "uuid": "d38d8d72-8be2-4c1c-ba0a-498d680d8507", "value": 1456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864381, "uuid": "2ba912d0-a311-4334-a53d-c36e6912d728", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864381, "uuid": "eecb424f-9788-43da-b83a-93d85ca48d0a", "value": "fud.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ff5570-5476-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694858015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858015, "uuid": "ffb5b9e1-f00b-4971-9aa2-f58ae9d55f5a", "comment": "Malware payload", "value": "8fcd1e0d9ef51198d8dd8d3a9d83872d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858015, "uuid": "9a5dc4dc-59ef-45c7-9db2-d1a5d912d105", "comment": "Malware payload", "value": "b4d11a7b17a7e0acc6b4f32a3f51a40ae3882b60b2498f39faf6aaf2d017ea54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858015, "uuid": "5b6bb9d1-5eba-4f23-a44a-b19efa3d0563", "comment": "Malware payload", "value": "fa06cd9918617a9ed6246b677f3290b2bd5a622e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858015, "uuid": "b7187f9c-3c16-420f-b972-a1acef5269c6", "comment": "Malware payload", "value": "75c14185c92b68ca75c58782e8042b22399e64d926660a071cad94d936fc51335615f060585f5d07c44f878960a48cf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858015, "uuid": "2a0de4f7-c047-43b5-9e4c-8c00cc3e8ccb", "value": "T1B9255B9AB2E4FCB9DDD847F74944965443B3F183864BE04F3268FF5CC11AE069E1AA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858015, "uuid": "4ea61f7b-d04a-43e9-90c3-13d6db71a1dc", "value": "f4c39e3a04d0676587a8adcf2ea9f91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858015, "uuid": "af7b2457-82f8-42b0-a01b-42869c9afea4", "value": "12288:tRhLthiFWgkp5s4fz6VTPwm5L8JznyTwcShiMRsOtfuk:hhhiwRp+4f8TPz58JzykcShiMRsONuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694858015, "uuid": "fe350d37-3027-4b84-8e6d-acbbc79be65b", "value": 965968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694858015, "uuid": "f09cf690-5ee9-4018-ada4-745c18e34798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858015, "uuid": "5fb04f3f-c271-4db9-8198-49f719935f3d", "value": "wssays.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8614bd-54c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694892844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694892844, "uuid": "e7b23a25-782a-4abb-9ced-3b348ddb3d2d", "comment": "Malware payload (Smoke Loader)", "value": "aa61de6ebd02482cd16996c6f42ba8ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694892844, "uuid": "a2814012-d273-4fcf-8025-a1663e765a3a", "comment": "Malware payload (Smoke Loader)", "value": "b54f42b5b0d19670960eb10c6789968a30df7e8532519b32d5ef33bf155fc034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694892844, "uuid": "16fff30d-8b06-4de6-b32f-692fde48312d", "comment": "Malware payload (Smoke Loader)", "value": "dea6f794cf98f0084bf14916d956818169a36b76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694892844, "uuid": "fddbcaa2-042f-4b07-86e2-c5d2c8f8c0f3", "comment": "Malware payload (Smoke Loader)", "value": "e2efe98c69860e2a595ca1cd801c61deb12071688ccda54a54b5fad16ca6e4a3b1ba4c435bc557f4d1056145b925b612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694892844, "uuid": "436c2143-3f84-4943-8b3f-b7602171947b", "value": "T1FB44AE02A3F1AC20F32A463D9D29C6F4262FBC524D299A7B2347772F09B1E73D552719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694892844, "uuid": "d386ce1d-ca08-43f0-a905-b668c921b620", "value": "bb9eb0cb309094dee794967585ee1533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694892844, "uuid": "a670c476-5565-49a2-a831-ebd3b2fc06d4", "value": "3072:ajHIbQtMJSCTEKvAw2P7bhICAgYGlA5XFAf0jDb+:aEEtMJNEYAw2TCgvcX2MD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694892844, "uuid": "0e14fdae-9c4c-41db-af02-b84f613d68d6", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694892844, "uuid": "0fc136fc-ef20-4ca5-9289-2e568aed830c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694892844, "uuid": "cc522e21-5a9e-407a-adb8-f9f986ad78c1", "value": "SecuriteInfo.com.Win32.PWSX-gen.3998.7908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04720a31-546d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1694853769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853769, "uuid": "b97f2e07-5d31-4f6e-ba33-3c9bf2779782", "comment": "Malware payload (RustyStealer)", "value": "4e1620f245e908bc4ca3cf41dc43db11", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853769, "uuid": "ad103e8e-94d5-43b8-bb7d-70256cb10266", "comment": "Malware payload (RustyStealer)", "value": "b5950e2154e6be0826795126ac8a59874d7d9abd7dba5857a6a05936100af22c", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853769, "uuid": "310d3447-b0f6-47be-a9eb-7d7be0a78de8", "comment": "Malware payload (RustyStealer)", "value": "1d205726f4d4dac3fa4ef1ed0c5575af8d3b74cf", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853769, "uuid": "ddf839f8-9d54-4bc8-aba8-14dbcefc4f34", "comment": "Malware payload (RustyStealer)", "value": "6c540895799e16609e152fa2195f9c887f5d9fea35196db734ffd144c22d80f66b52335a46ac887bc98c1794145411c9", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853769, "uuid": "e66ff985-b80d-44b5-a986-c23274f8ead2", "value": "T1C7A5E021F9153A22EC4DC5F406F12DA403E5ACB8127F47C463B4791FC677EADABA0625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853769, "uuid": "eaf790b9-e144-4285-b246-64ddc123a95c", "value": "3072:N5muw3iulcW3yuk8lkT0G4kX8H9UbOCA8fBYyQ4AowmUC91d:N03iulcW3Fk2W0o8dUbC4S4B7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694853769, "uuid": "658b8c62-9ed3-4545-98c9-f0eada29ee33", "value": 2199215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694853769, "uuid": "7d6248fb-55e3-4fca-8149-0dba849af9f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853769, "uuid": "c183103d-2f81-403f-9c5f-9bc00d9f52c6", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1590baa2-542f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694827169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827169, "uuid": "b435c9ba-1fb5-4667-810e-fe0b729c49d3", "comment": "Malware payload (Mirai)", "value": "83262080e6ec4807cca14c5e7c42028d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827169, "uuid": "b0a4e255-04f8-45cc-88f0-f21c725e64d8", "comment": "Malware payload (Mirai)", "value": "b62b6e770293a0fd4ab8b7e7094e13f1ae72c3888ae606dc0d335604fcd984d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827169, "uuid": "ee722839-32e3-4e8d-b781-662145d01f8f", "comment": "Malware payload (Mirai)", "value": "9dd15565fd73b48cadc742af096bce84f929000d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827169, "uuid": "2d0cb356-310e-4d2d-b5cf-c2c8c017bf0e", "comment": "Malware payload (Mirai)", "value": "203fd793aaf61345660a9ac19ce0f779ef73333a9c3f04dece6c410708fd6652a8577d46792e520dfb6485d2623de1d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827169, "uuid": "0a49bbb8-ee16-4a0c-a82c-a00ef437f8bf", "value": "T153B2D01EC0AE3E74FEDB7E796D45E2817FA19B9F3A61CDC016C156110622E281F8C6D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827169, "uuid": "6149a8a3-656b-4750-a202-1482683fed5d", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoo+M4uVcqgw05VxJ7:KApCdvwJr69VJoA8FZtxCo8t94uVcqgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694827169, "uuid": "96faeaa0-ea2f-4e5b-85bf-83ec43acf9ca", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694827169, "uuid": "a0989c38-febf-40df-8358-c040e7a5a954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827169, "uuid": "16976a8d-5a75-4afe-bdfd-0dfd014cfd70", "value": "83262080e6ec4807cca14c5e7c42028d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccdc158-545e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694847582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847582, "uuid": "b655a878-4553-47fd-a806-a27e3b8d5ad6", "comment": "Malware payload (Smoke Loader)", "value": "820ef2d9b619e118c4f4a593390f060c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847582, "uuid": "bfdc6f9b-161b-4d3b-9129-e785fd8640f3", "comment": "Malware payload (Smoke Loader)", "value": "b89197aeed2150dc1faf66186d824c261f41124a17c531297181d7d744c10e0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847582, "uuid": "b95c319b-1728-4676-afda-d2051eab2ccf", "comment": "Malware payload (Smoke Loader)", "value": "5f2da4ce1c322eaf8d4020132be31e0da24869ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694847582, "uuid": "eaedc6ac-6162-4139-a2de-6f51de9dffff", "comment": "Malware payload (Smoke Loader)", "value": "cc9d0dcd5a477cc0f060bd7c46a63429520dea7722f8f527d9289f620a209c3c5d5be33f1d2373e18d7764cda2e8886c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847582, "uuid": "48793c1c-fcc3-48b3-b65a-1cceaf079d45", "value": "T1E8446E13B290B861D6264F329E2DC9E4362FF9214E6B775BE3189B1F09B31E1C5E2711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847582, "uuid": "cab881b4-8870-4225-8d67-bda20a1c1bb4", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847582, "uuid": "bc47241b-85b7-49a3-9947-40283c5bad2d", "value": "3072:LQW4gMOkvQVHjJpcu24PcenMKOo83MeiM6wgyaMjzDbENh:sW8vQVHjJpcuFflj8JNvjzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694847582, "uuid": "bd52727b-0ec0-4b83-8146-f60b3bebbe3f", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694847582, "uuid": "69264a38-d034-4fa4-b508-8a7cb3f5b911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694847582, "uuid": "49911208-249d-4df5-a069-1857b872c1ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb35216e-5488-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694865672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865672, "uuid": "97864b96-5e1e-4571-a5a0-535763f5715b", "comment": "Malware payload (RedLineStealer)", "value": "6ec122a50a06cd9d94a06a82b4b91789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865672, "uuid": "fe003380-cf86-42f4-9100-250360b91455", "comment": "Malware payload (RedLineStealer)", "value": "b8d463e2b0046d76e717bd780e222ee3bafb1c074f7114308139832425860007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865672, "uuid": "d99fd638-f56b-4158-8076-4f1b9ef1b98a", "comment": "Malware payload (RedLineStealer)", "value": "ffefdfcb36605a8651a900c4108723211de7d746", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865672, "uuid": "6447ebd6-03e0-4912-a294-639e0e916216", "comment": "Malware payload (RedLineStealer)", "value": "967edc38a267fe68bf2ec881c7524aa1be5e54ad37e3d261b2700fa0b8d99419c0ef35abff170e2df4080647a1cc1f68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865672, "uuid": "c1a52496-7179-44cb-afb1-9c23184297cd", "value": "T1C45439B9E1F272A5D97D453220B089BA663DB8723B6345D78339771C0BE51C017E6CCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865672, "uuid": "f1610acf-a345-4e0c-b476-bef95b4f9b33", "value": "a051afa6afb2fed9c604c2121e6529dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865672, "uuid": "5c123f6c-3e7e-41c6-bc78-25a4cd0b4bb3", "value": "6144:L4pDUoUt3fmkPlhGxutgHrIqoNVrjCKmBMixAPXEXEYN:L+UvNlooyHrITNpOKmBBxAPXEXE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694865672, "uuid": "7523b490-6850-4e32-bdd6-b9ec677bda8e", "value": 297288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694865672, "uuid": "0f91d57f-e43b-40df-9790-0faab71d071f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865672, "uuid": "a330f242-1d3e-465c-8f95-ac9d3d8088cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce89c33-546d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694853945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853945, "uuid": "c7af5ac8-f498-4f72-99f7-56b46fee1214", "comment": "Malware payload", "value": "1d7868c0b8d9f1293fab2f7cab84e37a", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853945, "uuid": "802fe775-5f1e-4a3a-8777-b3d148384463", "comment": "Malware payload", "value": "bd59eec2000a8ef39c43744ed73cd48d9df07bdd479ec42df38cfe4de7a5a3b2", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853945, "uuid": "1905062f-3e34-46e5-b404-21deda709df1", "comment": "Malware payload", "value": "d7b22d4869739f212a6c7f75531a8a4cfe512bc4", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853945, "uuid": "0f37779a-dd6a-4b6d-9708-3202ecd130e2", "comment": "Malware payload", "value": "086b1e200a45da6302612578436df4d991e412f38a8d4ef62f3b106d80a87a1c792bcb9950fffd92dd6b0217d1884617", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853945, "uuid": "c8873e51-3c5f-417b-ba3c-cdc7dada3b5d", "value": "T10531A2E99483DA450DF747E242048855CF56C2AB2539841F7F8CEC887F343E94AF15D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853945, "uuid": "e7e0817f-9bed-4b03-b464-a26e69008a59", "value": "24:KqaAwARNRfX+Ir45wkQ1kLMBRH/zSXLtGL35Mt45FLZYvgGdGlXG2XGV19I/FeAu:QENRfHE5wkQ1kKH/wkVMsF1YoHc19I/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694853945, "uuid": "391bf5be-6374-4d70-b0bd-cce2b1f82de0", "value": 1452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694853945, "uuid": "bc34db54-acf9-4d5e-9e1d-44420f3ad3fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853945, "uuid": "32029765-7d7b-476c-b039-b0d2c56370e9", "value": "trial.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae799e5-5439-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694831688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694831688, "uuid": "3d6600b3-25c9-4de1-8a77-f06d7d936feb", "comment": "Malware payload (MysticStealer)", "value": "d0f494e69cce608d7f8e0f45e4473144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694831688, "uuid": "5e1bc66f-acc5-494f-bebf-2b41f73b666a", "comment": "Malware payload (MysticStealer)", "value": "bd8ca809bfe619888f9da0e1bba3ad8f412c85113056c0d7fcc68586dc301739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694831688, "uuid": "2e05511d-7dc7-4b73-aec4-b492ddd3b56d", "comment": "Malware payload (MysticStealer)", "value": "441e62894b563da0d18e707153df0e1c00c7e846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694831688, "uuid": "3fc2ff4c-a781-4965-b5ab-990b201d97ec", "comment": "Malware payload (MysticStealer)", "value": "09c3ca18fe2612e4525c7cd2ffd21e4870a35f3ad6654a7ad59b4c818bee6dea216336fc52ee2f2559f4600f755d988e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694831688, "uuid": "9ac15526-4038-4c82-9846-a484ac3e90a7", "value": "T13074CF0278D0C432F47612764FF89E756E7E7821075598EF63F82A2E8FAC7D0A5B015A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694831688, "uuid": "a26ff0f3-9e05-455f-845a-9202564d19df", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694831688, "uuid": "0ec41e63-e629-43db-a75b-accb94dc1fa1", "value": "6144:D/oXR/bOEHHkwxOSeyCKrJz4AO8zExTZfJcu2nhfPeeZ70A2jw8fi:ToX1aEHEw94yoxoVnh+E8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694831688, "uuid": "909890fb-26cc-4514-9bc9-7e609e4054ce", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694831688, "uuid": "4bdc1ec3-9926-4b1f-b834-2b5ff93c6fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694831688, "uuid": "34a0264a-f3dd-492e-afa7-e8403eea84d1", "value": "SecuriteInfo.com.Trojan.Siggen21.29429.30980.2835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241a3213-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841367, "uuid": "606f1b65-4f94-4aea-96b2-d88460ab0a14", "comment": "Malware payload (Mirai)", "value": "120c3e2672edefce61e185b40fc2fb91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841367, "uuid": "044ba26d-9f15-47ae-8da1-a3b07aa38bb7", "comment": "Malware payload (Mirai)", "value": "be67c29d708a0eeb4b7079c989a14f6cbb836c80eccc9625217e07e6c631cd76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841367, "uuid": "e1d60d7c-555c-49e6-b71c-6f1e005cdaa6", "comment": "Malware payload (Mirai)", "value": "75668f382ab09991cafc5e3c8fea558b7552f4e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841367, "uuid": "3bdde77b-33d5-4226-bf0d-fd85e60082db", "comment": "Malware payload (Mirai)", "value": "48ed058a00651dd6b6a3eee7c31c18b3b5f60f9b368dad63ce0158ffcae699e01163850c90ff9e419e7bcfaf3b7c4200", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841367, "uuid": "75c0d170-27e3-48fa-8bfb-5c18cf06a0ac", "value": "T12B432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841367, "uuid": "e8c1ae46-ecbe-4dc6-9559-334b05c10093", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwn:RqtmZPuutfbltZFBSJsBcfDSTFI+BEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841367, "uuid": "bb9da324-9be7-42f1-916e-91a6f928eb9e", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841367, "uuid": "a128e03e-3af6-4b46-a5a6-87a1b3a00b1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841367, "uuid": "3ca031fc-c073-4576-bfe1-e4acce3994aa", "value": "120c3e2672edefce61e185b40fc2fb91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1feff535-542f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694827187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827187, "uuid": "59861848-a2da-4674-b126-33f516ace250", "comment": "Malware payload (Mirai)", "value": "2bf8458c2a2740eec6b2c31a9f03bb32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827187, "uuid": "28bb0889-1c80-4fea-b1b0-5d046fc58c93", "comment": "Malware payload (Mirai)", "value": "bf92b8f642c42d2aa40a09d392a38ee6830e8c52dcf36be5ea69114765538d11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827187, "uuid": "d71a38be-27de-4bce-ade6-41c82c5a6b8a", "comment": "Malware payload (Mirai)", "value": "f32d00d3c4a14e043fd1c324f8b94df46aa9fb1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827187, "uuid": "62dfaab2-fc42-44db-84a6-1c120c7d7962", "comment": "Malware payload (Mirai)", "value": "fc9e6fd0b83fd72c990d8b8fbeb66da4a03f178dbe83a2ec83b10505c4cea751b71c346c15033dbeb05ad49ec36b977a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827187, "uuid": "abe416b4-ca9e-4846-9be1-5b869e01d464", "value": "T14DC2C07DE8A4BD4ACDED08388CDD13B40D9D3686B6CE4F9DD2261DC46B6128B3C9E464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827187, "uuid": "2a631f37-b50b-4cd0-a1ba-8d14c529c40a", "value": "384:PmWTv+78AdGa2nS3xbjJUFbviosPlozhfbIAawprR9gICSk3kImQ0KnEzrEcftw4:a7ddenS3j6Koolozxfk5JmsEzrtt1eWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694827187, "uuid": "554ecb46-1ef7-4d93-bfed-061a7d94eb11", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694827187, "uuid": "596f679d-c5d8-4a19-bdbd-520877ffabaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827187, "uuid": "042df529-7ada-4f74-9a5e-a83eb4439d14", "value": "2bf8458c2a2740eec6b2c31a9f03bb32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c28b85-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694835759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835759, "uuid": "a4425b2c-fb4a-465b-b246-75b36a89a260", "comment": "Malware payload (Mirai)", "value": "3a476aa135cb18a9cd58951ccb018b44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835759, "uuid": "d203baa2-6986-4943-8bb6-3a1c14a04b5b", "comment": "Malware payload (Mirai)", "value": "c0bb9138cb6d6fd4b33d7c035c9e5aa1a398875fa0ced47daa1036c8b7bcb8d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835759, "uuid": "e24005ae-6ff1-432a-b2e3-d79847174da4", "comment": "Malware payload (Mirai)", "value": "f501b93fd9f540c4c0be45bb5400fc0270f1fee4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835759, "uuid": "b443dc6c-3e5e-46f4-8ccf-661525ce4046", "comment": "Malware payload (Mirai)", "value": "536bbb26a9a0f15fe3835bc16d062b044ad0d3538d9eb2ff58b0f51a8f5c7f0e8fedec7e40e5e8ffd1e6ed33a1c071e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835759, "uuid": "2b0b0214-ecc2-473c-9810-312c4656ba63", "value": "T18C4302214F6F645CC8A12A77DDA881C01A65B7F8E276AC87B91B4BEC53B100707F165F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835759, "uuid": "4d6982ad-1e00-468a-a10b-fdb1ad102427", "value": "1536:zcm7hsB563TK2ERHiGS/odGDJEG7dLqG9OEjxTyr/wgp:Nh80PE+/h2GJLqG9OEFycgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835759, "uuid": "30147526-043c-45d8-9be4-ad3414f0ad1d", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835759, "uuid": "2347420e-5228-4462-8465-d9ff2b618629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835759, "uuid": "2690acd8-46bf-419e-af6e-efa4ad02e4fe", "value": "3a476aa135cb18a9cd58951ccb018b44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ab02fc-54b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694885710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694885710, "uuid": "807050a8-3ae1-4e62-91de-bf0a2b63a20a", "comment": "Malware payload (Smoke Loader)", "value": "0bc39833dc442b17ca0abd9242be9fdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694885710, "uuid": "d6a40ec0-34b5-4afc-a00a-88f9488ba690", "comment": "Malware payload (Smoke Loader)", "value": "c30d2cb931fdee3e3ddd9ec2589ad02efbe981101df6ec4f6d2e1472e0374e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694885710, "uuid": "a355a834-d0fc-4c5b-ac54-f878c3ddb75b", "comment": "Malware payload (Smoke Loader)", "value": "6ecf0122acf1e0f4d4226295828e6885065b1bad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694885710, "uuid": "4b046c62-194b-43ed-97bf-9cd6a464d145", "comment": "Malware payload (Smoke Loader)", "value": "08765da987675f9cd168862bd2406e257f053039407e4a17d0849e8a461e1131528a47900add565f6705a467c3ad2450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694885710, "uuid": "1983c7a0-5cb0-43d1-8f19-935bf105d3ab", "value": "T1BF444B1292A17C10E7264F3A8E1EC5E8361FB9104F696BBB620ABF1F04B1DB2D573715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694885710, "uuid": "06b3ba1d-fc04-4886-ae4e-40ddd7f45ce6", "value": "d8c39d5ff6edc55fa56f3300f617117e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694885710, "uuid": "bdbfc509-97d8-49ba-839e-93ef64020d85", "value": "1536:wmN8cKwjhYskAPbc8anAFKirUVsJF4aruqZ1a89vpx/KzXJDpKh/uV7YTYpAZf/V:wjc3aacjnirU64eXa8vpx/WJI8gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694885710, "uuid": "9b599b33-8202-4b26-bb4a-3b8bd5edc0da", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694885710, "uuid": "31122895-50f1-4e4e-8584-fc096187a5e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694885710, "uuid": "84db61cc-bde2-4cd0-8d02-d32a8043f7f3", "value": "SecuriteInfo.com.W32.Kryptik.KMY.gen.Eldorado.19625.30887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687a0263-546d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1694853937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853937, "uuid": "bd607a99-8a01-47af-81fd-53e605d0b47d", "comment": "Malware payload (AZORult)", "value": "c38e43f9ac00d74657f46c30c1609cc8", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853937, "uuid": "a19b8ea1-a8fc-42c2-902f-a76d18d9b8ea", "comment": "Malware payload (AZORult)", "value": "c4f0dd15698066b5d8d480a6d254fa7cd96f89236a0266bde9b103b400a1e6d0", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853937, "uuid": "9421307d-cefe-4236-800b-db043dc5c7b7", "comment": "Malware payload (AZORult)", "value": "4e456e37eccc1d9ed75677dcca4730a2a7b59925", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694853937, "uuid": "c9c8e4ae-adf5-437e-929f-dcf67f8c9970", "comment": "Malware payload (AZORult)", "value": "d19361278b7ca16fbfdfdd7ed75df17ed3bf1da70c79df139ec12012a5e19e39be20b6e4b62e02405c95a78c287b9970", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853937, "uuid": "af76b3a6-5aa4-4dd6-bc2f-468fbae47c45", "value": "T115458D93B764CDB7F4A715B66E4FC06024B12D5D81E5960D72AEB71892F330260FBB0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853937, "uuid": "109e4378-e51a-4a2b-8d60-324aca7cbf7b", "value": "12288:Ogm/SMJhGty5uhp065Q9BcK1DttFe4ANiX:Og1gRR6SQK1DttFYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694853937, "uuid": "4c68a384-1359-4c02-8692-82c25cda2be2", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694853937, "uuid": "2baef1d2-3aa1-40d9-8113-53b4417dcd6c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694853937, "uuid": "dae49464-3b7f-40ca-b77e-fe04b0d7c9bd", "value": "RFQ#110923-AQUA CHEMICALS_1.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25649e1d-5478-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694858549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858549, "uuid": "7a290cdd-357d-44a1-a41d-8d48f7ef1ce4", "comment": "Malware payload (AgentTesla)", "value": "f61bfec08b5fbed4e4721f681b83e4da", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858549, "uuid": "adf69865-8589-48b8-b310-8181844df2eb", "comment": "Malware payload (AgentTesla)", "value": "c5b6985cc8e63c04d1ee674684e6362353c00002fdfaff33e15affae9c005b00", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858549, "uuid": "614f8e47-37eb-498c-9054-f1f236e291a7", "comment": "Malware payload (AgentTesla)", "value": "5ee88ab9e81bec93237b0334b754bda9d1cf8d0c", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694858549, "uuid": "9a0a5e41-e121-4f6d-b999-0e9050c8a33e", "comment": "Malware payload (AgentTesla)", "value": "a4b03240ff5975aef80efc8e3e6c046fd5a7c294758ad3707340b0c7d4c717c4ac374c00226a5d404ce2e2e67ed01d2d", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858549, "uuid": "44b65362-2954-457f-84d2-3db1431a07d7", "value": "T1A1F4010A33B8591BE2B861F94416B61203727E2A19A8F7EC5CDA79CE15F0BC181537DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858549, "uuid": "f78f3a86-8da3-4a7e-bf39-27e2450f6164", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858549, "uuid": "ad28ca28-de6f-4f98-9e5e-4fd5f1a03229", "value": "12288:pA5WIPr4zID/KFICxATrPsbmC4Fl3eSY7JHVEjxxXNYb8sxf:+iCHS4FRGHCjvMNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694858549, "uuid": "4ca3d6fa-90a9-4ba3-8a46-8ed19066300e", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694858549, "uuid": "be325dc7-91c7-4810-8227-3801861f634f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694858549, "uuid": "d9731be9-9d43-40b9-aaf0-96588019aac0", "value": "sc0pe_carved-0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63817c3-54a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694878522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878522, "uuid": "31608ccc-c902-4c28-a8e5-2598edc462bb", "comment": "Malware payload", "value": "151218fec66bb600cd332836c08a1936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878522, "uuid": "9b756d54-e634-49be-8a13-8673bf7570ed", "comment": "Malware payload", "value": "cc46dcaf1c9f9be0e98058eb356f0a6f5a776d86770f313ad6a07d2a807f0020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878522, "uuid": "7e196573-4022-46a7-ad86-7886779f4ebf", "comment": "Malware payload", "value": "ac8bfffedbbbef42960c0d9f23b86d9c37424f05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878522, "uuid": "54c7f288-f540-4dab-98dd-d96202324242", "comment": "Malware payload", "value": "958e905a97d6893a31f520b5de35a2fd45e4a7d030913335b2e35b96b6da3f1137423a110dec0914c940ec5529916850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878522, "uuid": "5dcec513-ebf3-4208-a5e3-3b7baedda8e4", "value": "T1C5E5230277D1C5B2C4631D365629FF51F628BE305F368ADBA384642DEE221C1B635BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878522, "uuid": "2884bfde-1282-44ec-94ad-10c6707241dd", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878522, "uuid": "b11508f4-f264-47b8-a091-4d62f4e0afdf", "value": "49152:HdgokOEY+BOhUI32mKJH1o5MTepxfMoaWeX9RialiTWKI6dbTNvpm2quVAzHKlnN:HUHY+FrO/CWetRx6Plzm2LVAzqqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694878522, "uuid": "a2c8042d-3be6-4adb-ae9a-cdcd3d8fdcda", "value": 3045295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694878522, "uuid": "3f76ffcb-6caa-4ab0-9083-88a8e6475375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878522, "uuid": "14391166-77ad-441a-8ce8-0f2f0ecf4312", "value": "SecuriteInfo.com.Win32.CrypterX-gen.8271.2040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64abbc10-5483-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694863380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863380, "uuid": "9b6731bd-604f-47af-8811-f801751f58c8", "comment": "Malware payload (RedLineStealer)", "value": "d799d97bed17c25d712a022e5ea975c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863380, "uuid": "c92f0f77-d73b-4be7-a0fe-ccd2e1e670a6", "comment": "Malware payload (RedLineStealer)", "value": "cccc9e44afb3839868c474e6e4942f0a359861c5322c6a9fe1ebd9ba79175b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863380, "uuid": "cfd0bed4-d0d6-482d-b95c-5b5e3dba884b", "comment": "Malware payload (RedLineStealer)", "value": "3192db644947fe56602573651f234af2155d1ada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863380, "uuid": "da20a15f-1e24-4afe-986d-d4544c489b1a", "comment": "Malware payload (RedLineStealer)", "value": "6613a34b8a6d6f92c947fca7d20b1712168f2f100149175c6697cf21ab52e5a1cabbe6e9ac1469eb97caecd55750d72e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863380, "uuid": "fd3609fb-c4ea-441e-9f74-9dc3dc549ba4", "value": "T178846C103092B038E631EC3347D5A97D947AF8150B7A1DE78BB0CBA97E3D7D49A25362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863380, "uuid": "c106af20-6597-4394-869c-1332943f2e57", "value": "fc6316c96fc105fcdafe08845aa690ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863380, "uuid": "490e6cf1-8415-476a-8673-60e4718f072f", "value": "6144:9XcaGEZt20ZSwbz8+Dxe8kVAO2lyVjdBlmRjBc0L4Kch8Ey:9XFzZtT78TUWzsZBc0L4Kch8Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694863380, "uuid": "b8b73ab9-7ca4-4d44-904a-1894e4fe4ad9", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694863380, "uuid": "6ae260ac-b657-4baa-80c6-0be3e3de08a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863380, "uuid": "50511d85-620a-4f44-bbbe-36234978ac16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349c5e16-5484-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1694863729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863729, "uuid": "0c036912-702a-4443-82aa-a592b70b89b8", "comment": "Malware payload (RustyStealer)", "value": "f311a23e935b239794d59f02daced842", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863729, "uuid": "a54f7654-12f4-4835-b8a9-d5ee76525e9e", "comment": "Malware payload (RustyStealer)", "value": "ceccc7327c2ca4bed5ef627e413ed28fae26b04bc16a8e2fcf18a22539c8af15", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863729, "uuid": "119a275a-968f-430d-9f2e-dfc9f6bc2927", "comment": "Malware payload (RustyStealer)", "value": "87b3b41088f367a79380116175fa54fa6c3cccc1", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863729, "uuid": "eddc0440-7c14-4f5e-b20d-4ef4a3327fba", "comment": "Malware payload (RustyStealer)", "value": "605ad9b83869eabb35c06082d7c214fab83957d1956bb05f25df1a57e03b3b5e1fccdd96d89e7a4a73c296b1d8821934", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863729, "uuid": "f6d901d7-8e74-4fb8-82fc-7f9902397a6c", "value": "T1EAA5E022F5563662E84DC1B401F12DE403E6BDB403AB1BC063B4B46F9177EADEA70635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863729, "uuid": "e0f03074-307f-4c45-bf59-71a89ff52ebc", "value": "3072:r5muw3iulcW3yuk8lkT0G4kX8HfO7Ng0nOpSlYhKj:r03iulcW3Fk2W0o8HGapSlYhKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694863729, "uuid": "97950c3b-2cd7-41f1-8e2f-2a981304eb35", "value": 2193137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694863729, "uuid": "15dbd518-36fc-4687-b7b3-79002b471e68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863729, "uuid": "24db0cee-9ea5-411c-927f-3f3964ee5baa", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce694b7-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841382, "uuid": "1ad7d35a-6a08-4db6-a30c-3b3a7e424a25", "comment": "Malware payload (Mirai)", "value": "b6338cbe59b085e1cf57a4edfb9dc749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841382, "uuid": "a66ccd03-a000-4a7b-9d2b-0ea79fd535e0", "comment": "Malware payload (Mirai)", "value": "cf1c40f60a7ba0935dcf5d99ae66d23cc5514e4fef41edda3e5d58560fa06042", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841382, "uuid": "3b702cba-a588-40a2-a855-d1c4f7ec97d3", "comment": "Malware payload (Mirai)", "value": "df86614627e5a41970824453a09bb944f4a4001c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841382, "uuid": "69a5446a-6924-4455-997c-435d2d072b7a", "comment": "Malware payload (Mirai)", "value": "18ff40f55bb0ad575d4df40df99bd28faa1b11885fba2420d4a7061af695322a9bf7d7fda9f2e3acde5e3267651e1d6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841382, "uuid": "6a0433a4-bd3e-4619-9cd2-6ca46a7c3cbe", "value": "T1E6C2E1E07726FD31C4206C7DE52B8D893A51063C90FF393664258D359EC1A8B27F88BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841382, "uuid": "231519b3-d5fc-4919-80e0-67d2d0c6954e", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrj+9q3UELuK:PKy4qfqoeJdXWgXLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841382, "uuid": "233596b8-149b-418a-b1d9-df9e13ad80b8", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841382, "uuid": "f3cf6cd0-a465-4a74-bdad-447570024f1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841382, "uuid": "4bf89b91-f657-4f27-aac9-7c1364351043", "value": "b6338cbe59b085e1cf57a4edfb9dc749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a41baa-5485-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694864373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864373, "uuid": "bebf9bee-2b77-4c4d-be9f-627e12ca7fd9", "comment": "Malware payload", "value": "3fcc6ef580320ac48e8bcdc3890bfcc0", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864373, "uuid": "da93c615-458c-4c66-a09a-c96517838cc7", "comment": "Malware payload", "value": "cfadfa39448049cda509263e7b954f4f3acc00dde8a72d4c792fe7f62809bb8d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864373, "uuid": "216978c7-ddc1-404b-af0b-42a486f6124d", "comment": "Malware payload", "value": "8cf5b900bc2528de82cbcd0f1413e0e19403d456", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864373, "uuid": "ca8441c9-e1ce-4a80-9d6e-08a29c3f16e0", "comment": "Malware payload", "value": "ae953be110c310f96c9fb139d0a2af2bd0178f1e98f8e907aed8ae2f1ddfe7724b84469caabe3de16059324159ea16aa", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864373, "uuid": "38e0008b-8475-48ef-9b67-8d58e8fee3a6", "value": "T11C51DD0253A48723E3A54EB191B995A16E322091FD82F31ED091816D24B2E08DC7EAAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864373, "uuid": "a88dc4e3-b2d3-4873-8180-b6e7e0914065", "value": "24:8LsDqV6Hm85iOAonzE58y7V6GCj+7S6rQvMn6te2pV6HyCUR51laUm:8b6GOiyz26G7v76tv6SBR5CU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864373, "uuid": "b1278f3e-d072-4576-b3d5-5bf8ad61f541", "value": 2834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864373, "uuid": "cf794109-3dec-4d44-b0c8-487064a5df19", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864373, "uuid": "2fb48308-1fd3-48b4-88f6-13fd43afd3c5", "value": "Invoice22108.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f69a16-5443-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694835785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835785, "uuid": "f0821b0b-62fc-42c5-abb5-6bf7b4ae9769", "comment": "Malware payload (Mirai)", "value": "d6fa09db9233af924c4f0555d55ac172", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835785, "uuid": "cff65534-88d0-4cba-9bd4-4714ef4cc6f3", "comment": "Malware payload (Mirai)", "value": "d0064fa241da624f7186f43e13d8fa5b8c2610f506712cbbb94424926da534c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835785, "uuid": "ac2f4d6c-0368-4819-8cf8-5adf370d7065", "comment": "Malware payload (Mirai)", "value": "f458ed429e882021b9b96a704c58fcb4735f310a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694835785, "uuid": "ddce8680-9e4a-4d86-826d-4f7d23b4617d", "comment": "Malware payload (Mirai)", "value": "5dc903ff4a46e6f582cde4221284e8f468f8f7036af37ee73f774538450ef11e1061b591ed4eb50128d6aeb06f37cfc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835785, "uuid": "9bb53330-4a17-46c3-862b-ae40cdf4ebdf", "value": "T172737C76E82A5944C08986B4BCB8CF352F53A5C582732EFB16D5C1B58053EA9FA05FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835785, "uuid": "9d912abd-bde8-441a-a8b0-a582fa80d04d", "value": "1536:RatVs0V3mwtZ57pFbXoPlKUyCu4DozCc9H9q3:RKs5q57pFToPsUdDozN9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694835785, "uuid": "6552a0d7-ede7-450f-9da1-1f843050ef73", "value": 76456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694835785, "uuid": "a45608dc-3b9f-4999-be9d-27770bdd2e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694835785, "uuid": "fe3b6ace-75e1-4148-a08f-c9e3c440acfd", "value": "d6fa09db9233af924c4f0555d55ac172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e7a38e-54c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694890042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890042, "uuid": "d0ca14fa-3211-48bd-aaf2-f5beac5eee8b", "comment": "Malware payload", "value": "f7f1e3789c0ed6932481581a530bbf0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890042, "uuid": "622d3e47-a18a-43af-85a4-3d63a33a483b", "comment": "Malware payload", "value": "d11ed50a37eda6e3af40f8b66b1cbf8d297085e565bfeb61fed65083c4fd242a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890042, "uuid": "43c0018e-dc2f-4731-ae9b-e69a3a2ef56a", "comment": "Malware payload", "value": "55f69dece300cba3c7cc1830a389d32bfd82a476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694890042, "uuid": "72a7bd5f-4066-4b60-a060-24b2af63aa92", "comment": "Malware payload", "value": "4d8c89e3427f4b94914452a2fd7d6f325616f8603362f7e4e025c3ede7322c0ff781a51e20a7831fb685092c433568ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890042, "uuid": "d3a618cb-a507-49f4-b3c9-813f3b5f25a4", "value": "T18515CF15B7A9E942E0EA5235ACF3D30AA377BDA0A30317C7745C691B3F317911C3962A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890042, "uuid": "1f2aeb6d-3c18-41ff-a896-4ce1578360e3", "value": "02bc376d1ae63a2fef892492d891a666", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890042, "uuid": "ed63d942-4acf-4b67-81a4-284c49d870e9", "value": "12288:CAGetS/ITJqrraq/t2qny6xdRhMAK4vcmPEl0Io:UuS/UEn/tUIMGPEl0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694890042, "uuid": "493f1def-b498-438c-bacf-06c50b4524b4", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694890042, "uuid": "a28a000e-c46e-475c-847c-b83104508b83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694890042, "uuid": "6ac76ffa-d0ef-4d9d-85e7-cd7bfa6baa51", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e850df-5445-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1694836810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694836810, "uuid": "ca225c18-9022-4b17-bcca-98a8cd83b504", "comment": "Malware payload (NetSupport)", "value": "fafb2ade02cb0ec3acceae8f61a7234a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694836810, "uuid": "ff3e7457-2d57-434f-a056-7ee6ec63c87d", "comment": "Malware payload (NetSupport)", "value": "d1ff939a417eeb03bdf7e6ab45c99d2c7dcd1875e457b1f6f98920812a50c87b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694836810, "uuid": "4f7dce1b-fab7-425b-a3f3-e61ecdaad06d", "comment": "Malware payload (NetSupport)", "value": "a17732e746fe36f52be96478aeb1d12465b48a52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694836810, "uuid": "8bcced6d-03bc-4fc8-a076-2a42283e0094", "comment": "Malware payload (NetSupport)", "value": "fbbbcbc8d6e46d1ffc32955e14a1121846732176f6603ec49b418dea275ee24ec36ea12be51bf19fb83681c3a12c2fe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694836810, "uuid": "7b2660c9-1b09-478d-9f53-4dab4da92ed8", "value": "T12B74BF12A2D1B871D5124B329D2DCAF4662EF8214E6B776BE3186B2F09B21F1C5F2711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694836810, "uuid": "be6ca9f4-5251-4127-8c78-da3cfae506fc", "value": "a9bf299729b09a43be583e7770d2853b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694836810, "uuid": "11ef26b5-9f8b-4afc-9bad-79f7a2a45708", "value": "6144:v4JvSws00f5TEW/qJI0+CMi+1HnS9gtVyUC2zA2:vKnsFn/qJI0+CMignQgtVlC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694836810, "uuid": "16f051d7-6c77-46aa-a5a7-91a84ecc6b12", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694836810, "uuid": "7ab59e38-d001-4bd5-93b6-1ffede3002df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694836810, "uuid": "b4c2e961-6335-482e-85c5-26dbb102e5e2", "value": "fafb2ade02cb0ec3acceae8f61a7234a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe9e703-548f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694868391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694868391, "uuid": "2b63cd4d-9354-4071-838d-a31f5c34e243", "comment": "Malware payload (Smoke Loader)", "value": "13f85e6dd696a643f15806688354d75b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694868391, "uuid": "50351191-7cb4-4459-bc95-63e4f51078f6", "comment": "Malware payload (Smoke Loader)", "value": "d570c7efc7e3e6c43ac25349f43cf3664d6a7caa13cb859848f3fe99c40bb277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694868391, "uuid": "7b3ccfb4-f73c-49a5-87c8-6d1de8a0acfc", "comment": "Malware payload (Smoke Loader)", "value": "590dcb3783f28e742e2317ff88d6d443d79cb3ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694868391, "uuid": "e9177e93-37ea-4fa1-afb2-7e3a2b92099b", "comment": "Malware payload (Smoke Loader)", "value": "8e66146d011fd6fe703347fb33309d43f70aaf401c1cc174e4192a088ea304a47e01cf76b1907169897d05522e2284e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694868391, "uuid": "915dcb00-6363-4a6a-9051-c019dd521bbb", "value": "T176545B0392A07C20E7294F764E2EC5E4661FB9614F59B7BB621ABB1F04B2CF1C163725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694868391, "uuid": "f8a239b6-4ba9-4a9f-abc9-16b9ae0f6c88", "value": "d189d43af23bbb5425431a74f9f591c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694868391, "uuid": "905ff510-8c9a-4a24-ab97-f97b5a938959", "value": "3072:yRA0kPGK1K4A3js44ZDE1OkwlxAZwyDEXSGOBCZrKZVt:60PGKAQ1ZDEClKZEKQ2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694868391, "uuid": "087dc677-330c-4706-9519-a111a11ad162", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694868391, "uuid": "552ca265-027f-4950-83c5-402490e6e846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694868391, "uuid": "6509585d-461c-413d-ba77-2aeca6ef2114", "value": "SecuriteInfo.com.Win32.BootkitX-gen.13696.19726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33e5270-5431-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694828400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828400, "uuid": "d7bf7d1d-d058-470c-b267-566b62cb40dd", "comment": "Malware payload (MysticStealer)", "value": "acafc20a0889b1342dda0528a70b8e8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828400, "uuid": "96502855-f63c-4a93-a769-64933a647d3e", "comment": "Malware payload (MysticStealer)", "value": "d67853e4ae89ba83920b4b76b599a4aee3db117498f3a522ea6321adf3d181a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828400, "uuid": "e9763d32-eec8-4e64-adc1-c3b2b8d4e2c4", "comment": "Malware payload (MysticStealer)", "value": "4897cec55f9e217e373f4f6864d48ec860bea415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828400, "uuid": "dec94548-412a-4ce6-9db7-830f04223adc", "comment": "Malware payload (MysticStealer)", "value": "8fbc50f685fede20c42b54b41a422c3732a5d26b5dd24d644352be14465b712659748f6d5174b9d953c4212aedadda57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828400, "uuid": "a61e3288-4a65-4e66-9163-2521a499fea9", "value": "T15474BF0175C2C872F87728315AF99A744A6D7AD31BA108EFB7E00B3E8B745D09735CA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828400, "uuid": "0d543075-5aff-49de-b8b3-5f8b112f2919", "value": "c8144f386a1d9b87b36aea6b6202dfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828400, "uuid": "3473c152-9ab8-444c-9d6d-d94d40040323", "value": "6144:5/1XR/bOEHHkwxOSeyCKrJz4AOyUo1d7BMpGfOQ5j8ooX5+8fi:91X1aEHEw94IUiB+w8oi08fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694828400, "uuid": "cae7ee73-053d-4796-adb6-ac64efd32294", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694828400, "uuid": "f0400208-4812-46fa-9fc1-65b9e1a2b4c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828400, "uuid": "9f6af155-a228-428b-9389-22b76e007d2e", "value": "SecuriteInfo.com.Trojan.Siggen21.29429.19556.8377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a582874-5484-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694863765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863765, "uuid": "a5d6c276-b4b1-4cc2-a8a8-9fbb5d165668", "comment": "Malware payload", "value": "1ebbf045b3b0ddb1c1e0be352a6491d2", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863765, "uuid": "b8212697-cc40-43f8-bc39-c7601ba6dfc0", "comment": "Malware payload", "value": "d7a593693a9f6156bb6b9d32b5e1c2f4059843be8571eb737dd0541b9fc7d28d", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863765, "uuid": "94824dfe-3a1b-482a-9993-e97fc78aa47e", "comment": "Malware payload", "value": "ed7964e5041a5f1c10ee0fee0186ab520b172718", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694863765, "uuid": "1bd84105-4adc-4bbb-afae-e3a40cc10135", "comment": "Malware payload", "value": "82839d973dc6129097d85e39813bbc1e212c345392c3d2b39187c64d4e996481e7633a7ad8fdc61505c4213755059d1f", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863765, "uuid": "7e1ddd9e-6b58-4f1f-8288-bd05b91aedef", "value": "T124319DE99493DA4509F747E242048895CF5681AB253A941F7B8CEC883F343E98AF19D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863765, "uuid": "e13260cd-e28d-49f5-9a7a-8534b54dc417", "value": "24:KqaAwAilRfX+Ir45wkQ1kLMBRH/zSXLtGL35Mt45FLZYvgGdGDEoG2XGV19I/Fep:QrlRfHE5wkQ1kKH/wkVMsF1YLoHc19I4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694863765, "uuid": "e82bc80a-1bcb-411c-8731-ecedf6a7f9a0", "value": 1451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694863765, "uuid": "9e9b2d4b-667c-4f1f-8e23-b7e0b44e5a70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694863765, "uuid": "49a21599-c4c2-4c90-8784-625f0defcae9", "value": "fud.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7befb4-5487-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phobos)", "timestamp": 1694865034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865034, "uuid": "7cba433f-932c-4bb9-9f31-630c8cb63c16", "comment": "Malware payload (Phobos)", "value": "9824d07cea51069c0042eff0e46d1ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865034, "uuid": "c94b4eab-199a-40d4-90f4-2267255cf647", "comment": "Malware payload (Phobos)", "value": "d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865034, "uuid": "f2353433-0c04-434b-90b8-f53c9a430e5d", "comment": "Malware payload (Phobos)", "value": "70ef130a8f88076dc671ab9873b2a3a3c45818fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865034, "uuid": "b091dd37-0c8a-41e4-8692-a0aad8c1943c", "comment": "Malware payload (Phobos)", "value": "e5e4d14568ca4450cbea1736466d274ab65f7e8e1ad4b265455ee27217ac93a67aca6946167504a65f07565d0a8ced15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865034, "uuid": "51ca574a-ce3d-40a9-a0bf-ddcbb7c2600a", "value": "T13264018BE40B95F1C6841B76C59BA9C40B71DB83B6A3D71A744F131228C3BFEC849657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865034, "uuid": "7a789e0d-5247-441a-a239-728e6783935b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865034, "uuid": "82da8d97-48bd-4bd9-ab65-b04728a5bfd3", "value": "6144:XAo4v3KmeRDWs0cSsm42PWB1vEtf8h81dZgjvxbtIGnWSPgYYshfnmU3H1l5Fy4:XGimeAs0cuvuB14I9JWfWnNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694865034, "uuid": "2c1a222c-7eef-4de2-b511-e41fa9ed3436", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694865034, "uuid": "13272493-235f-46a5-8682-de8bf326a1e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865034, "uuid": "5dc092d9-8e65-4abd-9de7-6a0c0ac2cc5b", "value": "9824d07cea51069c0042eff0e46d1ad2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f3495c-5450-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694841315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841315, "uuid": "baa0f8c8-3725-4bfa-a28d-af2627a94f8e", "comment": "Malware payload (Mirai)", "value": "cb3bb502ddee9e6581bd70088255efc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841315, "uuid": "d31c2b1a-a7bf-429f-a3e2-8fb9fed6a783", "comment": "Malware payload (Mirai)", "value": "d8225ef95e834d07a7c6f1ee2f5129b456f1ea40ab42f5bd79a99100840ccbfb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841315, "uuid": "9c116730-1d6d-4b3a-8a0f-cf86e8f542e3", "comment": "Malware payload (Mirai)", "value": "abb5240be9ca0fc43923516539a44fdfe81ca76c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694841315, "uuid": "90ad87ec-dc26-48f3-9ffc-ac107ba3f33f", "comment": "Malware payload (Mirai)", "value": "f28722430c3d66bebcd8e3cae2b5ef712e16ad8039df5593ee1fd3291939d3542f10e19cf22fa4d85855f526e750b728", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841315, "uuid": "97080d40-7bce-4c2f-8be8-ee70869c9e82", "value": "T19FB2D0CC65943084CA8D7C7C178D4A664F6CA1D0BAED8B16E354CDD8B3BDA8F3859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841315, "uuid": "3b1760db-9d87-4aff-9b95-12b0f9ae1d39", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBpnZq8WvP:BQlS07FUXqIYSXQKquZqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694841315, "uuid": "15222285-c9d8-43f6-bf82-15aff442681f", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694841315, "uuid": "3bfb55fb-6b8e-4dc7-bf3a-e6716198559a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694841315, "uuid": "46a3e43c-f042-4fa9-9369-d9c3a7781e0b", "value": "cb3bb502ddee9e6581bd70088255efc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2094d676-5491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Empyrean)", "timestamp": 1694869278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869278, "uuid": "56e4fe22-a8df-473a-85e9-21e67e3e8ab5", "comment": "Malware payload (Empyrean)", "value": "1f8221e08f7b7dc9d5bef87eee08effe", "object_relation": "md5", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869278, "uuid": "2d4c88ea-32a3-4653-977b-d9d0ca8421bc", "comment": "Malware payload (Empyrean)", "value": "da0859d7ef74a81f15c3a6ba0d9a02c3c829fa1144d8a0a678dfa36ddb396301", "object_relation": "sha256", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869278, "uuid": "0dc42103-0c49-4681-8391-31b604dbe2c5", "comment": "Malware payload (Empyrean)", "value": "6544535b63ff2abd38e7a613d2f45f6ecb128397", "object_relation": "sha1", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869278, "uuid": "22fb6b8b-14e5-4847-832f-3f24219cf80b", "comment": "Malware payload (Empyrean)", "value": "94487f79b6c1c5c91423b5d394c49f4b05d2c69d39fbdb3eabf5038b99b1965fb64e2b847ba657d44c51d4c665ef8f12", "object_relation": "sha3-384", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869278, "uuid": "bfc69a66-1b9f-4c9b-8d92-f260e23f7e51", "value": "T1D50733F452580592E8E6A63E9C1FC86B116BFD422364DCCE83B095348F53B661E7AF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869278, "uuid": "6ee37f33-55eb-4062-89ad-93b2bdd1faa6", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869278, "uuid": "301b96d8-4532-42cb-b254-481779862aa6", "value": "393216:1qPnLFXlrPUgQpDOETgsvfG7g/vnvEl/eFrQLw:sPLFXNPtQoEqavMYFrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694869278, "uuid": "d1c5b5ba-dbb4-434a-9b53-669864c4fdd5", "value": 18380828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694869278, "uuid": "042cde32-e4ab-48d8-9b2b-a2d0ba840bd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869278, "uuid": "3ee701c1-6183-4cd7-84aa-c6b590997fcd", "value": "auto.winmedia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0c666e-5485-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694864087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864087, "uuid": "f3b4945c-aeb8-4b7c-81b7-e5aaca1cdfba", "comment": "Malware payload", "value": "15ca797770a98bbb6f4c692314171a95", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864087, "uuid": "82b07fc5-318e-4bac-894f-e8f478b359ba", "comment": "Malware payload", "value": "da898bcd1e618402afea7eac58c94fce29046a9a73d7f50a0ca42ecce5f7569e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864087, "uuid": "763edba9-fbcf-45f9-adc4-0d8e84c2b1fc", "comment": "Malware payload", "value": "55e193568150e917722b593525b04d4970b144ce", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864087, "uuid": "1c2ecc18-6ba1-48f8-bf0c-0d3f9fe049d3", "comment": "Malware payload", "value": "1e3d07af60d49e290c78295bec0744c910a4fa72387b000067bcdc402d11aa5b96d92f532ba26e33d0f13729c05ebba0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864087, "uuid": "d58bc084-610c-4a93-afb9-597469b25c56", "value": "T1EF41A0125AAD0B27D26E473051EAD4979B713583F382EF4F989482590177E006CB4FAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864087, "uuid": "cf3f3f63-19ff-4ddb-8ba6-988d1f15a141", "value": "24:8ujNwoMkGakM6nzE58PCj+7SOMfQvMOUDYarDMoZYaFJntD0LaucMeraeYazmK:8Et6vz17Na/DY2WcjAL6CM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864087, "uuid": "fd3c59a7-3fa6-41f1-abcc-40f5cd7230ff", "value": 2132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864087, "uuid": "c0a1f71c-d2af-4e08-b055-a6353f7547c5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864087, "uuid": "99b43a77-c574-48b7-ad1f-bfbc0c7fbe29", "value": "Invoice_4323.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aac5bd2-54b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694884516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694884516, "uuid": "f364f6e8-5188-4b84-9c39-ed2112eb8b2c", "comment": "Malware payload", "value": "b86af5012dbcece105e62075b6001b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694884516, "uuid": "c769207f-a982-4287-84b9-fea0c2967778", "comment": "Malware payload", "value": "dc995ac1448564b5ab4ddab43cef6eca758a1cc2a5a95984036371175248fb52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694884516, "uuid": "c4c5d628-3b86-4d2e-85b2-3afc2a8db658", "comment": "Malware payload", "value": "08a611b93742c90d8cc84fa74109041e119294f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694884516, "uuid": "083aba7d-0a0e-4ce3-a9cc-5b6dbd3062d6", "comment": "Malware payload", "value": "cfee2e211d231c613a71b974b2c1be4f85180b4df6dbc81f457449f4dfb5150c9a824ec5900162d869ba0cf711b81a84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694884516, "uuid": "aa58521c-9f35-415a-a645-9dc1410b66a0", "value": "T17DD63315EC9117D8D8A3603AC849A16DAD62EC928726C7DF833676420F5FFA11D3AF13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694884516, "uuid": "a7f6fcc3-77f8-4302-b8d8-04ec17d02a14", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694884516, "uuid": "aa3e452b-32f5-4051-8c11-8fda159699f6", "value": "196608:y+YCvGaaVhTDfyGex21X5Sp6GemDMPwNUXIZVPWqGwCu2DASNsPRS5kib55CRNYy:tYC+aaVBDfDeMpfaMPO9oueSg225zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694884516, "uuid": "b6e3c762-e2d3-472d-b8fb-b34a5d853449", "value": 13603320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694884516, "uuid": "0e4bc712-15be-48d9-84d1-da738ff47d3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694884516, "uuid": "7defa98c-38b4-4901-8c90-d57cd7e33e10", "value": "b86af5012dbcece105e62075b6001b2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d967d85-5469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694852174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852174, "uuid": "b515548b-632b-4920-9a8c-d715df687fee", "comment": "Malware payload (AgentTesla)", "value": "82512c1c3a19270d6793a28975e35ef2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852174, "uuid": "f77cde4e-7734-423f-93bf-962308a9f876", "comment": "Malware payload (AgentTesla)", "value": "dfec19b2418939555f65e61d31c45c4714605150b83315c6adb735567f3b4d36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852174, "uuid": "a571850f-74da-4e02-9ebd-fe513c47e863", "comment": "Malware payload (AgentTesla)", "value": "014c1d471715f389c3456c2b6c3fb70fe73efd35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852174, "uuid": "b585aa49-8a09-4a49-98a0-a361dff6dea2", "comment": "Malware payload (AgentTesla)", "value": "c5e802f3e54fa74702e4b8ddd6936141c3d21e6365dfcca04fb4283dd286703c36eb6ea87cbb2a193c705491da0af7ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852174, "uuid": "19b7bfbf-285a-49ea-ae58-11177c890250", "value": "T147455F4841077DE1F0EE357E50506ADE6B612EE26AC4BC0E95B6BCDF2670F39043A687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852174, "uuid": "f2c2b298-922f-46e4-a494-221fb662419c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852174, "uuid": "9813052b-4dae-44b0-8715-d18feafee531", "value": "12288:FDoS9IMVPrEAuyxMBFVjjjkbPVA3mGLqjkzVucZ9f/2FvQk5c/HZVUH4Y/:SyHuyxmFVg5A3mG+I5ucZlQo1P/9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852174, "uuid": "ff049a56-2028-45e6-aab6-c1fbd527073b", "value": 1185280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852174, "uuid": "3dab1111-ff82-4b3f-8148-8175bb639c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852174, "uuid": "7a161cf9-1a37-4451-9b15-b0450fc12de2", "value": "FRAIR00113735.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686f07dc-5498-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694872405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872405, "uuid": "83ce8b21-2b96-4534-abdf-b6ee79841e40", "comment": "Malware payload (AgentTesla)", "value": "ca205a348cb2eb985844eaebdf7b405b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872405, "uuid": "0c7a5312-8c3d-4e42-803b-14754aa198d6", "comment": "Malware payload (AgentTesla)", "value": "e039dd26593878b06d221a99b86f553fb29581f67697320843decd94cf54fbdb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872405, "uuid": "bd31a29d-83b7-4697-b00e-6f8e4655477d", "comment": "Malware payload (AgentTesla)", "value": "b1fdbe6a569ba7199e619fd062f6d16c02103c9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694872405, "uuid": "d2e79516-513b-4847-9911-3bbbe4dc582b", "comment": "Malware payload (AgentTesla)", "value": "2574e8493ab2bdcb6f9e31ef54831ed70d0339079e91ca8d06297ffd138ebbdb38752a2dc100b1cff14b59baa00f84b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872405, "uuid": "dc3c0123-d745-431e-a34c-596f2b2de3c7", "value": "T112B423951C0132CBFEB4DAE5597A94903572200B79B3A6C02DC09FFA4E93ED4385DA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872405, "uuid": "fd6dcd14-eff5-4826-a74f-dfb4035652a2", "value": "12288:NcG/4A4A9jYv4QldbyYWB0v/z9ezhz2bcOxjjFtGd:+3XA9jIyT6z9ezhAxqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694872405, "uuid": "eaa61ad8-b80f-4344-a0ae-8e5b67fc76a3", "value": 513139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694872405, "uuid": "ae7f9b2b-1f57-45cb-9c53-47163dc79f98", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694872405, "uuid": "28d20046-2bf2-4806-9885-6b2e4e9815b4", "value": "PROFORMA INVOICE.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0999ba8e-546a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694852489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852489, "uuid": "8857764e-4630-4cf0-8a7a-afbdde4adcaf", "comment": "Malware payload (Mirai)", "value": "487f1df6598b7824dbce66d06ba16592", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852489, "uuid": "65795ff8-84d3-4f91-8e30-16510f3ede47", "comment": "Malware payload (Mirai)", "value": "e32f02a2a319685bbc5d9fbeddc0221c9cc61b1078280b90e1450c3b22afb630", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852489, "uuid": "55e06485-938c-4010-8762-f9fb21545cb3", "comment": "Malware payload (Mirai)", "value": "bd0b35c16477e10aed64bba4a20d4dddb951c13e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694852489, "uuid": "b875bc43-7f99-42cb-bfa6-33e3160b9a13", "comment": "Malware payload (Mirai)", "value": "d3cadb4793a50e4637d83cd69e02164ce090bfbcc0b4ca3262a347898495c3f7db03f6ffa6c1e7fc7d5818f8730f7db6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852489, "uuid": "2f409f88-7442-4b25-988b-4caedd0a4a23", "value": "T132C3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852489, "uuid": "7b1db02f-609c-4367-9e40-f5f6678e03a8", "value": "3072:6jVlyaL5JCrIpv04sQbttiEiTmP46aQyfPlfKsNb:yoCJCN4sQbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694852489, "uuid": "25038c17-6665-4122-a243-909c01af22ec", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694852489, "uuid": "924d940a-70c0-4526-9dd7-7c426ddb8421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694852489, "uuid": "93425fd8-5f07-4c87-a691-c89c33cea1ca", "value": "487f1df6598b7824dbce66d06ba16592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ae1daf-54ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694881125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694881125, "uuid": "ab4e71a4-d5b2-436e-9a97-3688ce4fa422", "comment": "Malware payload", "value": "8221e7bfac3a17a9eb519f2c80c0ad9f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694881125, "uuid": "ea9c1364-2913-4212-959b-0622ec505461", "comment": "Malware payload", "value": "e44900af2562cd4be197ae3122ae8a83e8a804e1d000e19e8a8fe5a3bd3f4471", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694881125, "uuid": "33fcd805-03cc-4d58-8c1e-d85960e0ce4a", "comment": "Malware payload", "value": "0db61f241107b7ad64f5765e38b606b9e5b2caa6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694881125, "uuid": "4c77e5fe-3d95-4610-85f8-81de725d12a0", "comment": "Malware payload", "value": "375f5d977708da3f1c96c54aa651eafdc34966b9ba0b1622d146115f698ffafc5ec46062212063ada788d8545b953ca1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694881125, "uuid": "5daa8cc6-15a5-4cb5-bf9c-0568eeb5cb73", "value": "T157F2F15F13083F396475BD100FF368E15326E8A7549D35BAF1DBAB5313E2420AAE09C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694881125, "uuid": "5dd9bcfe-3c42-47dd-8f4d-212cfcd43c18", "value": "768:KRwQ+NSCAdj/k/8phI68GKBXjy98n/ipiqujikw+sD5UhvvN3G:MvBs/8E68VTfmuikzc5UhdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694881125, "uuid": "b806f937-1855-44ae-a5f7-b74ce1db50fb", "value": 35166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694881125, "uuid": "fa22c8af-cf91-44f5-8a2e-e101322e25f2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694881125, "uuid": "091bbcee-49ff-494d-8a31-408de6347aa4", "value": "KIOSK-APP 105.vbm.crYptA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f48820-5463-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1694849561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694849561, "uuid": "28c1b44d-511f-4d22-ab28-0e2bcde6b74d", "comment": "Malware payload (LummaStealer)", "value": "379a74d6449d77be437b78c8ec875022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "rogue-ads", "colour": "#F48136", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694849561, "uuid": "2f7dc2dc-6d6c-4678-a1bf-9c9539e75d6d", "comment": "Malware payload (LummaStealer)", "value": "e8f15cce81d73dd30199ac900f7c6b04b213121a8a8b00440399422d65a7b083", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "rogue-ads", "colour": "#F48136", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694849561, "uuid": "22347070-e4ac-4cee-9438-f0577efe55c7", "comment": "Malware payload (LummaStealer)", "value": "6826d7db1411432b5fedaf8661c37a7d7da0162c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "rogue-ads", "colour": "#F48136", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694849561, "uuid": "b48ec5b3-786f-4a5e-acee-89f52833b467", "comment": "Malware payload (LummaStealer)", "value": "4aff4affb9fac1b80a04fa1fe2c59787b8d73b7b8271c12f95a6a485c6a91a87a05544b4a62dc0ec34ce6be17ccaaf77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "rogue-ads", "colour": "#F48136", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694849561, "uuid": "e9f57c08-4b41-4425-9aec-05c1717a3b27", "value": "T15966D728E71107E4DF424ABE49D3E7C29CACE561F1111968928E23DB99534EC9373E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694849561, "uuid": "76f74c17-eea6-49d3-ad78-34beaf1d575b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694849561, "uuid": "16cce51a-ec0c-4001-aef6-e9e0c3c4099d", "value": "24576:NR5sykTElJqVMbCWCphFIcRt/SH4vypK/wBmRKmPehq9p24E1Z:j5sy/4VyiphFL3aH4vyoOmcweQ2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694849561, "uuid": "3c766067-0bb6-4634-bbf2-ecbc9d2bd111", "value": 6510335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694849561, "uuid": "01a2450c-cb5e-4b55-9f7e-e6dd86c5b0f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694849561, "uuid": "65999070-8b62-47f2-921a-94c7452d52ea", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0a04b0-5426-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1694823313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694823313, "uuid": "988c975f-3ed9-4eea-a999-23bdfa656d1c", "comment": "Malware payload (RecordBreaker)", "value": "2dc9fec8afa21eb021e9600b6610d1f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694823313, "uuid": "9dfec4e0-be32-4407-9edb-e8324ee5a839", "comment": "Malware payload (RecordBreaker)", "value": "e99001e2850a7ca06197fe50955a8f488f315e1060164f5e669bf9b882f2cdea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694823313, "uuid": "f9b13fb6-3184-4c04-a879-a99379e1eba1", "comment": "Malware payload (RecordBreaker)", "value": "acb9f583281ac2fefd542ecfddc2ae5920cbb6b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694823313, "uuid": "63cc7cbf-d523-4bdb-a7b5-29bdd702bf3c", "comment": "Malware payload (RecordBreaker)", "value": "9a72e1855c0c857857f61cb0429cadd67f3f2a32e61f310ea046cf903c07c9470a3e4a6f62210d5f73acd0bd33204cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694823313, "uuid": "e95a5b9e-5d03-45d4-a0f8-a67f937c158f", "value": "T1E71733B1F9F4D6E5D49B31B2DCA1B5F955E19EA0EC284C6F2C093EA4B4B245E0031D8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694823313, "uuid": "8742a92b-91f0-43a8-bdd0-8e8b6f4f1654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694823313, "uuid": "2fba3928-6ce4-4ada-b3f9-f44cff682b6c", "value": "393216:zCj1Le3GL/pSyG51YVDWMrBuwMnP96tDOz8HgYXf:+j1K4S7YJLBu96tOz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694823313, "uuid": "6e3f3f7d-e83c-4c15-8559-ee8f00e91452", "value": 18974208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694823313, "uuid": "78a21a16-156c-4394-a1fa-1f05cb18283c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694823313, "uuid": "e1a86d18-52c4-4f3b-adb4-8ef00a28a5aa", "value": "2dc9fec8afa21eb021e9600b6610d1f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5056cf-5490-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694869219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869219, "uuid": "469ddb00-68cc-480c-bf30-c87d58dce891", "comment": "Malware payload (RedLineStealer)", "value": "b0ec1323c75efd81238b324835a90a37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869219, "uuid": "07b88d64-6f2b-4c16-bff9-4a0645636331", "comment": "Malware payload (RedLineStealer)", "value": "ea2cf112e4a740b9c462ec93b9157c9cc5f86ee2bb490f32a7c552d4411af6e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869219, "uuid": "20d7836a-36e9-401a-ab49-6f521c9e2632", "comment": "Malware payload (RedLineStealer)", "value": "c356f315c5767981a732ead9f81063349c9414eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694869219, "uuid": "cb184a04-3f38-443d-8577-a69ce6af08ae", "comment": "Malware payload (RedLineStealer)", "value": "07ddf497727d5b3b127acb8bd5f4b0eace907a8003f9603e2892194989dfe4085249fb5b202368bbbda57ef475e87b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869219, "uuid": "4666643f-dc22-464f-b029-81ad1d716334", "value": "T1C47419C0338469CFCC4F8AF1636117688A60D642E657BB93BCCBACF7385A7456E051E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869219, "uuid": "f132c58a-c67f-4cf7-83e8-4ddf4e913973", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869219, "uuid": "68087f8f-86df-44cd-8b22-3da46567acc5", "value": "6144:eSMWzqiQBWL4sevEc5/jSybom0Wb9fqTrN1aPTi:eSBqR043h0Wb9fqTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694869219, "uuid": "7801c1ec-6597-4358-9ecb-496ee2dd47e6", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694869219, "uuid": "cb60d797-38bf-4c93-b732-e897507337b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694869219, "uuid": "ed99e685-c35b-4abd-b2df-6692ba894f71", "value": "b0ec1323c75efd81238b324835a90a37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc6d9d2-5487-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694865274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865274, "uuid": "4bd15b7a-33af-406a-9ef7-37c871babded", "comment": "Malware payload (RedLineStealer)", "value": "58fa69cdac0d6b16bfbd5523944b4d93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865274, "uuid": "6835b7de-24b0-45e0-b378-b2cb981d6093", "comment": "Malware payload (RedLineStealer)", "value": "ec53e2555605c5424630d394f6b11677be607c4060ea5772b4afd9ed4f0f94c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865274, "uuid": "03a0c3aa-a66d-4852-8490-5309933b3f75", "comment": "Malware payload (RedLineStealer)", "value": "e88e831be4e2e2d600ed99e3857839b08bbf74da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694865274, "uuid": "3027752c-07a4-4030-8f25-755b14ed1882", "comment": "Malware payload (RedLineStealer)", "value": "c2a19dd48ae3cbdfabd939f7ce9cf1417e515a3ce6b2cffef94b8139d10c172ffa41fe7c9fe76226509b974f801f3ab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865274, "uuid": "d74e831b-b068-41bf-83d9-4ea8c7462782", "value": "T159846C40A491C1F3F43650339DA4D2B407AEEF7527A534EB5B6C09EA46503E3A7B8B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865274, "uuid": "12b94303-588e-43a1-af31-2ad9746d4828", "value": "fc6316c96fc105fcdafe08845aa690ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865274, "uuid": "37dba217-8296-4c07-910a-1a15b25e8f3a", "value": "6144:UAcaGEZt20ZSwbz8+Dxe8kVAOnlGlIlFeDrVnZiYfFqOiTbqwNhgwEapoGh8Ey:UAFzZtT78T1wIl8TndYRhh8Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694865274, "uuid": "86095c5a-405c-4c12-9234-452448b9d42d", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694865274, "uuid": "7decd63a-4023-4cf7-89dd-789d4a7a7f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694865274, "uuid": "43720022-69a2-41ad-9618-cd990688a173", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218e8fb2-545b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694846087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694846087, "uuid": "fb98c0c0-3e61-4a40-9f9d-994820822a69", "comment": "Malware payload", "value": "2e4c47c36452522c07a184e742dc9e10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694846087, "uuid": "dcf25120-dc64-4a17-be54-6568dc943f3e", "comment": "Malware payload", "value": "ee3eb8aff1a2ed730c158471e8f06b15dd572d649caf9bdd537bd5159f96bb3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694846087, "uuid": "96681eb1-e4dc-4e23-a135-731deddb229e", "comment": "Malware payload", "value": "39da9cfc163f54b08e4bdde8d1b7fd60198becaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694846087, "uuid": "5114d85e-0511-4a99-80f0-81905755a784", "comment": "Malware payload", "value": "36b022ea8890a3e0596ebbb64bd9e00b1c5cfefbc32e56a4edf5f876d71744925eff8b2a00172f7559c176583169ec52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694846087, "uuid": "a5615f26-4c6a-4fc7-b933-dc711de7eac5", "value": "T12E058D66ABB800F9D1BBD138C9475607E7B2B4551320A7DF02E0CA6A2F237E15E3E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694846087, "uuid": "6ccce71f-4645-4d07-a677-252f763075ec", "value": "ad7508e80e34c66e8423e7649f566aa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694846087, "uuid": "c9761c45-98c5-4ab0-8558-5a9c9cda5936", "value": "24576:yeiCrC5CdVAdf29jZc0D10zOEiBTOhMC:y2rCLVmjTsOBKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694846087, "uuid": "d5d016c4-5a87-4a5c-8fd9-431b22a57f24", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694846087, "uuid": "048047c6-0878-44ab-81fb-a155d724efc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694846087, "uuid": "b020e4ad-991e-4682-a6ab-061672710984", "value": "static", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb22bb0-5465-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1694850453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850453, "uuid": "3b37227b-efab-42ab-8f5f-55a90556ad10", "comment": "Malware payload (LummaStealer)", "value": "1e3e29c9dab3904f5dd3b25defb1f4d8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850453, "uuid": "918ccbca-b0fa-4a66-9a91-29a07071e51a", "comment": "Malware payload (LummaStealer)", "value": "efa3344e794905e7c09951a2ce69b18ced2ef56006fe9215d2af9e1364730dd2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850453, "uuid": "b0f9db53-edd5-493a-ba1b-79f11ac9c36f", "comment": "Malware payload (LummaStealer)", "value": "a1a10193fc2cc6ec0cc20e6da78848be00134e93", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694850453, "uuid": "a3bc20bb-4ac4-4afb-81ce-a970859f88e6", "comment": "Malware payload (LummaStealer)", "value": "1d59f37cdd717264bb2a23cb91536a62e204c4df8b4798329f38d9d788eb46b2f357ee9921268ad6632587bed3e20738", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850453, "uuid": "61a51dd9-81d6-4d0b-bea3-59be095d00b6", "value": "T1E8418E100BF10358D7FB8E39ACB6F3125A32B955EE139FDD028056844C75128E8B5F1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850453, "uuid": "b2a9f985-f596-4adb-bd22-0435d037700a", "value": "24:8NaSXwgX8bjPbKyW8ilAQWkp+/CWP2+/CqxkU1RI7PS7QAv4I0WCXOuE4uEepK6/:8NfZ0jUy4n2eP4QAQI8VK/BcaMNnq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694850453, "uuid": "aa4caae8-4a87-4568-a6d8-4fc344f1e6b7", "value": 2098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694850453, "uuid": "7b229747-4e97-412e-bfe3-1925bc64063a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694850453, "uuid": "5e2af65d-b508-4c44-9645-2ba487ac5f58", "value": "NEW_BOOK_ARTICLE_FRELANCE_WORK_NUMBER_1_txt_PROKECT_NEW_PROFI_UNICEF.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8980888d-5446-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694837242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694837242, "uuid": "2b167922-02b7-4a63-a7f8-3c08c24ebe4a", "comment": "Malware payload (njrat)", "value": "df99e753c2a7ee4f8945b47116ce6a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694837242, "uuid": "655f9e92-8a0c-4bfa-a915-3ad99fb0e42a", "comment": "Malware payload (njrat)", "value": "eff6aaeb772d0315098c03cd75f0efe84275499d604889e5888547116b8ff7c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694837242, "uuid": "030832b5-8176-4be9-a467-c7d4679f6c4e", "comment": "Malware payload (njrat)", "value": "1a70c169fad4226c250b4f11e027affc5af03e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694837242, "uuid": "f1f1f182-40e1-4e83-a607-00438acfec30", "comment": "Malware payload (njrat)", "value": "47ee1632b3cd0e2803448e1eadfa641696b516302d90b47b18371353043612db7d7aa3c4bbf794dbe43ed240ac760bd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694837242, "uuid": "4fa9706d-758d-4f2e-ac45-a33c852d4ff1", "value": "T13EE209467BE98215C6BC1AF88CB313110772E3478532EB6F5CDC88CA4B676D04295EEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694837242, "uuid": "0faf8e60-9452-456f-8e91-e33288ac9a94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694837242, "uuid": "4d85a970-2b39-4a0a-baa2-c0f3dfcd5e92", "value": "384:X0bUe5XB4e0X6ObaSjgkMRWTPtTUFQqz9tFObbn:8T9BuJ+Sjeqdbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694837242, "uuid": "a15cfaaa-ab9c-432c-a955-085d7b5bcb65", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694837242, "uuid": "54b75414-58fb-494e-8764-7569b2067d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694837242, "uuid": "12ded8d4-052d-46d1-8f56-a710a17ee413", "value": "bPNz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e00a9b2-5481-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694862590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862590, "uuid": "e1d3084c-615f-4daf-a88a-1adcb598e4c6", "comment": "Malware payload", "value": "03f16a35ac32e11ae2e47e265fdfb0ba", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862590, "uuid": "6fcd154e-8765-490c-bfab-451377c03857", "comment": "Malware payload", "value": "f0319eb2f4cf751b01b6dd88cc04599dffeacbf01f6b7d084313dcafc6ff2239", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862590, "uuid": "aa8bd6f3-5b30-4ab2-8e2b-ff31494d9354", "comment": "Malware payload", "value": "3e0eec2e5b85aaefc8ef460ae97704a63d9264e9", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694862590, "uuid": "c8960730-888d-4c68-b880-972e11929af5", "comment": "Malware payload", "value": "aaa993df365c21fe9093bd1937e4f369198657643d2fafcca51749e9dd227a9d8f3eba719367035df39b4ceb4ef0612a", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862590, "uuid": "13e9ab39-098c-4a7b-a292-388dfb6bc27e", "value": "T1A731AFE99493DA550DF747E242048899CF56C1AB253A841F3F8CEC883F343E98AF19D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862590, "uuid": "fc3746ef-2246-4f69-858f-f01e23546cb8", "value": "24:KqaAwAwRfX+Ir45wkQ1kLMBRH/zSXLtGL35Mt45FLZYvgGdGIG2XGV19I/FeATFM:Q5RfHE5wkQ1kKH/wkVMsF1YBHc19I/Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694862590, "uuid": "dab18e26-ad0b-40f3-ac5c-8f0bd7777ab4", "value": 1455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694862590, "uuid": "998c9398-cc23-4600-aeba-680907ce817e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694862590, "uuid": "83710e04-9763-4b0d-842b-da634a1dd9ce", "value": "fud.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47adf3d-5431-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694828402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828402, "uuid": "66a32ef3-f143-48dc-b4e3-7e1d0f160e88", "comment": "Malware payload (Smoke Loader)", "value": "04f39265e36f060b3fb8f834cc3a1c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828402, "uuid": "618bce30-02f7-45dc-9c77-f24e1ebe74ec", "comment": "Malware payload (Smoke Loader)", "value": "f1067936bae4b49f2da4d284584be19153fde9e6aaab6c9657803d8caa684f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828402, "uuid": "85a874ef-9ec9-4053-9f84-08f534d32304", "comment": "Malware payload (Smoke Loader)", "value": "c5f73e312f082e2e875e227b9e5cff4601cd77c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694828402, "uuid": "3d0711f0-76e8-4135-9402-5c159cbee112", "comment": "Malware payload (Smoke Loader)", "value": "edc98a512c57fa6c6e410c8292fbe608929cace9b07efeb551e489c1d1f2959ec01984d292840dfc08fe5b202a3d5bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828402, "uuid": "da3cf6c2-207f-419e-9243-50d5d4943df6", "value": "T192547E03A290B961D5264B329E2ECAF4663FF9604E5B775BE3185B2F09B31E1C5F2311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828402, "uuid": "01459eb8-38e4-41db-bd31-1ac8ff951125", "value": "dc93fa27bb75c7b0817990b59bbc1fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828402, "uuid": "1d2721e0-484c-483e-b838-fa6de92d5d39", "value": "3072:UDiXwgZsvspKFYUd0a0tyIY9EoDi05J0S7oOZyAra+t5b15rN6:+iXMveKFYUd0fkfDFGCoOEka+t555g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694828402, "uuid": "5b73db82-0fd9-49b3-9894-0146acdab7c0", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694828402, "uuid": "7a086fa5-68be-47c0-8e97-415e7680a1a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694828402, "uuid": "ba31ca9b-32e4-4281-8a9e-b4323cc829bf", "value": "SecuriteInfo.com.W32.Kryptik.KMY.gen.Eldorado.15012.26728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc6ca50-5486-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694864841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864841, "uuid": "89bb7048-8970-4c27-aa2a-b699ee22d517", "comment": "Malware payload", "value": "a4c82773687421058df73eb3cda2db29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864841, "uuid": "2179a1df-ffe8-41cd-90c6-e36823b76daf", "comment": "Malware payload", "value": "f3e1355c500340b9eeedfdfbc0645a3497edc65f9d646598dc3c3c3f29777d1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864841, "uuid": "722ecccc-1e91-4ef9-89ae-91dbe44116f5", "comment": "Malware payload", "value": "6e2609f5389d30fe2e66bb18c2a5f20b6ecb7e46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694864841, "uuid": "ace44b63-9da5-456c-9a7c-53980e903f24", "comment": "Malware payload", "value": "f5b034da958168ba3d06439dae0afe55b402fdaafac05c0afc520227c2114bd7f91d25381970c4623b78ffd3ed8ac226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864841, "uuid": "d59ebfbc-259e-4c06-bbe9-4fd54d78f879", "value": "T1F6F618D4F9DB14F0E5035B3008D6627F26352E098B29CBD7DA547F6AF837AE50A32219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864841, "uuid": "a3e3bd37-d105-49e0-900a-0b0e7cd9aa5c", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864841, "uuid": "8d318e74-8b1b-43b5-a01b-70e12336f55a", "value": "98304:bdt7rcHOloky+h3UwdEW4651prMpAU5QWltnHwy555vKVA:bd1rcDPwuW7KnHwm5pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694864841, "uuid": "d6c94ea9-3495-4732-9964-e812125a74a8", "value": 15561217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694864841, "uuid": "c0ef7889-489c-4cb7-aa4d-ef48de8b51de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694864841, "uuid": "c4e063d7-bbb0-459b-9e44-96cbfaa8e6f3", "value": "a4c82773687421058df73eb3cda2db29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ac7489-5458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1694844915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694844915, "uuid": "2e8b2047-c258-47ef-8575-133f76d0625c", "comment": "Malware payload (CobaltStrike)", "value": "a65540439313219a66548c3e0187e8b0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694844915, "uuid": "9d70757b-4e51-4e8d-98a6-d38fa1262361", "comment": "Malware payload (CobaltStrike)", "value": "f5f5d5ce8a754b1a19a7f5b8514e46ee33be1dc933748fb6921d99efc14108d5", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694844915, "uuid": "d7c3c22d-6445-41d6-8839-c463b468eaea", "comment": "Malware payload (CobaltStrike)", "value": "eeb53a3ff3a3b9651d7d531d7300567389851d4d", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694844915, "uuid": "476bddc1-5811-4613-98ab-8c864cf07e84", "comment": "Malware payload (CobaltStrike)", "value": "8ef92127be445e0cba47c96306913a3d0eaffe707b641fad7182af55142c14f4fa52080d5b9119d1b7ffc0fd176ff761", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694844915, "uuid": "e0476868-9d3a-4966-9b3c-2009c6489c27", "value": "T138042320EBE8E937C05926710868E449C010922EA9C1DF81FFF659DB7DB73BEA775141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694844915, "uuid": "25b68076-5084-44f4-ba5a-ec690fe4e36d", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694844915, "uuid": "d5336aa6-404f-4050-8869-6b1a3d833e73", "value": "3072:VmSVlBWcjca9eQ99F62A1SL97U2sZ95NIGc/zN+PbfDDI9tjnR1hN0nogG5:VNlk8Uox9eyzcjA99dN0no5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694844915, "uuid": "f264ecd4-197f-45d1-bbe3-d6e7059ca6cb", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694844915, "uuid": "e9649d0a-f174-4bb7-92b3-f3d35096245f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694844915, "uuid": "79d1761e-af85-4996-ae9a-157324495c7c", "value": "a65540439313219a66548c3e0187e8b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b0f123-5476-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694857957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857957, "uuid": "21fbb363-4d66-4856-9d64-068d735160d9", "comment": "Malware payload", "value": "d14fef191070dbf30ea42b53e90b7218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857957, "uuid": "5805c0f6-3853-4ce7-9479-98cc5edc372c", "comment": "Malware payload", "value": "f606620b5cec0edd90cdc97d0ae4552a64ff0642ce0578ca61e8a1753b017bb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857957, "uuid": "dac8b7bf-41d1-48ba-acc2-44433d513291", "comment": "Malware payload", "value": "8e2ad1a0df90371b5662d8439e66f27bc06b155f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694857957, "uuid": "82a898bb-ab1d-43e5-a8a4-e04686b15d4d", "comment": "Malware payload", "value": "dd254a20b5b205ce71c9159e9b190e412c4d398421201e5b301825df9ed9b0cbf6d1c4fb0c15abe9424c28a42d9617f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857957, "uuid": "9d66fa63-a04c-4b46-ba35-33dbfa4c4de7", "value": "T164458DEF7185B9E7ED895AF32694A26C6192F2A3824FC25F3030FB25011BF164F15A35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857957, "uuid": "628fd659-cbd1-45e1-9d36-7db5c2f39bfd", "value": "a8f256f27bccebbc9a5a1260db8dd002", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857957, "uuid": "6f011bf3-4227-4920-8539-ec5403b95957", "value": "24576:ciDxHpa3Bwa7/AErniS4WSdeoIM2VNyG29FKcwFLAgkyO4xuY:MF29FKJhAgkyO4xuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694857957, "uuid": "77a58832-cf3b-436a-9d8b-5b851c37b963", "value": 1230735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694857957, "uuid": "7ebb9069-55dc-48b9-80ed-450a7b94fcc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694857957, "uuid": "c5bf4bca-e8bb-4cde-a0df-c0ae800dbc8e", "value": "sgiydd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a89d6a-548a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1694866517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866517, "uuid": "d8e4b784-c058-41f4-bf6a-ab1f0a3d6247", "comment": "Malware payload (RecordBreaker)", "value": "93bdc8ce5d2c8ab79b21deb98cfea69a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866517, "uuid": "c844d42d-595d-4023-8e3f-6c3299d8400d", "comment": "Malware payload (RecordBreaker)", "value": "f89a1fc11a995b035aca4d23f8a391079e5d8f889b5a99866d07fdc755a65d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866517, "uuid": "ef850886-242e-4160-ba9d-8d6e2d388cf1", "comment": "Malware payload (RecordBreaker)", "value": "747228359905e5aef23e4b3239531477db3d4478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694866517, "uuid": "152ea7a8-79d3-40a9-bdf9-eb2491b3f7fc", "comment": "Malware payload (RecordBreaker)", "value": "81a3d7e8c5c44aa73ddcc89caf7d3dc01feef378572df4de5410156a57244768f1b4c0b493b1e700924861063112d789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866517, "uuid": "5742814c-737c-428c-86ba-81614f589503", "value": "T113F628D4FDDB14F0E9035B300896627F27352E098B29CBD7DA547F5AE837AE50A32219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866517, "uuid": "0ecbf2c9-50be-4b2a-9dea-fb5331fb00ba", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866517, "uuid": "0563a7e2-8157-4176-963b-e56cfaa3f07f", "value": "98304:bdt7rcHOloky+h27UwdEW4jo51prMRAU5QWltnHwy555vKVA:bd1rcDUwuWOo2nHwm5pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694866517, "uuid": "921dbf9c-2953-465a-9cb7-9b7c3d7781dd", "value": 15561217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694866517, "uuid": "0f3c3e83-cbf8-4927-8c02-6da635ede88f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694866517, "uuid": "c0f0309d-c312-48ff-9323-8d473791cbf1", "value": "93bdc8ce5d2c8ab79b21deb98cfea69a.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a571c37c-54a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694878521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878521, "uuid": "cfd5d45c-24e0-4255-9417-972fc4056846", "comment": "Malware payload (Smoke Loader)", "value": "224b407f73fce273cd03061c374a5d21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878521, "uuid": "02493daf-c9c1-42e0-bfa5-1efb7dab2ce6", "comment": "Malware payload (Smoke Loader)", "value": "fa1fa9f865ed8e2604edf690db58351bf7050f4e04bdaa5c83836c503d3af84b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878521, "uuid": "8f09cb35-ab79-4836-92f0-eed4e2e24a0d", "comment": "Malware payload (Smoke Loader)", "value": "7d1599bc4b9c7541c39c2edd49a702407cd7d189", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694878521, "uuid": "fa0522fc-fb57-454c-82de-4f639e5357ea", "comment": "Malware payload (Smoke Loader)", "value": "c4f4bff7235926c81d96d981442fa1e1fc037113a19942ae3705e65cc051599d74c0deb8372a52b608ae63afe0654327", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878521, "uuid": "8f4d1c32-8335-425a-b5bf-23e28f836167", "value": "T153445B0392E17C10E7194F769E1EC5E8661FF9118F696B7A920BBB1F04B1CB2C172729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878521, "uuid": "de83b28f-435b-4e7f-b12d-6594820481ef", "value": "d8c39d5ff6edc55fa56f3300f617117e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878521, "uuid": "30a360d1-4fe5-4832-8d42-599660098d14", "value": "3072:70h0WBkSC/F6eSmDbtGAO9lgPXKQctvTSJ0SAwt:G0WqieSotGA+WaHs0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694878521, "uuid": "4c164e49-e922-4055-abe1-d36537462c14", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694878521, "uuid": "ff5feb69-59e1-4877-97b6-95e25b7760e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694878521, "uuid": "d3a8f396-0de5-4a16-b90e-b2272d94f67c", "value": "SecuriteInfo.com.Win32.BotX-gen.28985.3894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4983f369-5467-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694851308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851308, "uuid": "659893d1-8cdc-4f5b-9f8b-efc7a2dc275f", "comment": "Malware payload (AgentTesla)", "value": "0a05871f2876ed3e74849aecac809866", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851308, "uuid": "1c0547ae-327b-4583-ad15-7b900f498d74", "comment": "Malware payload (AgentTesla)", "value": "fa86600053f2c904dede44fdaae9e805707ffc3eff31bf0963f8342d630e4b8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851308, "uuid": "5348c52b-25aa-4e7e-8e94-898a1dbbedcb", "comment": "Malware payload (AgentTesla)", "value": "2b6d66cbfef73b29a715e7ccb96f76f05eee9839", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694851308, "uuid": "82e96a68-afdf-4c7c-b99a-e6012f332022", "comment": "Malware payload (AgentTesla)", "value": "2f55868331890fefd3dce440c4e23dcabb6846886338199f220095d1609e9c76f6b767d763dadcfaeb8c038c99d30efd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694851308, "uuid": "fed5fcfb-6263-49e8-8845-b93817023f44", "value": "T18A25539C1C63920AD870143D7A97E4F48A243DBEC48595DB1DE2ED3BBA1D5C22FCC626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694851308, "uuid": "c9ab8e64-228a-4631-a9b5-11202ffbd4f2", "value": "12288:g2NKVY7O6MavWMO6MavWX5opDJ1xGBnvTLeE0MKmeeCLVTk5dx:g2NnO6MavWMO6MavWJoJjan7hILK5dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694851308, "uuid": "fec43dfd-5932-496b-af7f-298856758791", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694851308, "uuid": "95bf61b7-124f-4a99-98d2-ec1132aff9a8", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694851308, "uuid": "ced681c6-df35-44a8-ba7c-9d2083bd9643", "value": "Quote 230901-VP.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d601a4-542f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694827200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827200, "uuid": "1c4de92b-c445-4be1-b22d-f72713b82ccf", "comment": "Malware payload (Mirai)", "value": "0107603941bf3bd0110cdb48860f06af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827200, "uuid": "446da7d3-c188-4087-ba8c-384335318bc7", "comment": "Malware payload (Mirai)", "value": "fd5086235428b7333fe835bc64ae07dae05cc69db4028967026e4f9c6ea1c32d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827200, "uuid": "7ecd868c-cf3e-4754-9c0d-12b46c15c658", "comment": "Malware payload (Mirai)", "value": "c95c0722e8a7bcc40bddf0ce850ed4a65586d266", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827200, "uuid": "a6a8cecd-5fb9-4e43-935a-5d13facb5a62", "comment": "Malware payload (Mirai)", "value": "0bee69d4a2e760006fe2563d17aa1e5faaf357a18427a71db9d4045763f25006e55d3f5328976004e3fdcd9cec4ce391", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827200, "uuid": "e7210f17-a14f-464b-ae09-29b1264bd61b", "value": "T190B2D0B27015F8B2C7E100B79DEDCB83FB801EF8D0E873291465099DE6D5942AAF1647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827200, "uuid": "fb391e3e-8596-4d2e-9c92-ba8218691d0a", "value": "768:aX9nxn8o9wnBoWzEQf2EjKb3pBIPs3UozK:atn+o9wjfBAZaCzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694827200, "uuid": "b9e422c0-503b-40c4-ad11-2210d5c0c838", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694827200, "uuid": "635eb250-a566-44a8-b57d-3c087a102dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827200, "uuid": "6839bbec-c910-46e5-b68c-893a6d9385d5", "value": "0107603941bf3bd0110cdb48860f06af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327a7391-542f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694827218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827218, "uuid": "3d82e611-775f-4a2b-9bde-fc98c774bfa3", "comment": "Malware payload (Mirai)", "value": "c4797da4aaa6c7e544b1c07f8b062b88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827218, "uuid": "5e239f4b-aedd-4469-b094-6b9d8a272a13", "comment": "Malware payload (Mirai)", "value": "fe42d52abfd55beaec4c0cb16f8aa8e112d6e24ed27c77a1072ee146c623360e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827218, "uuid": "7f3b8ba7-79c9-427a-af03-c745b39ec230", "comment": "Malware payload (Mirai)", "value": "95013e22549b27dabe107679c4372886a347562c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827218, "uuid": "75103165-74ed-4b12-84f6-961d7c8982d3", "comment": "Malware payload (Mirai)", "value": "3d55e49aff29408f42ecd86e8a23de86925f1a4aa4640221d26fcd2e0d3a8fb35c19d19d17bdfe0b955278beb5dfc25b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827218, "uuid": "13c7d01e-ae09-4277-8e06-cd2007ac1f2a", "value": "T197431925AD792E26C0D8B57E11F7C724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827218, "uuid": "a3e710a1-7ce6-4572-bfa8-4e994d6e7c94", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDu:eL0AxvSHfymp0xgunvCkV6vTMDaup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694827218, "uuid": "fda46058-9b1b-4c59-9377-ae550cc8dc66", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694827218, "uuid": "9253cfc9-10c8-4a19-be49-e3a7e1be15c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827218, "uuid": "bb901341-3df7-4899-9b20-131f1ace9527", "value": "c4797da4aaa6c7e544b1c07f8b062b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a99377-542f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694827163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827163, "uuid": "c3524ebd-2572-4910-99e3-3dc9e0132ee7", "comment": "Malware payload (Mirai)", "value": "b71a49786207e87c5c56d0a7255a255f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827163, "uuid": "bbfd250d-c9ea-4e41-9d92-a61d0c11cc2b", "comment": "Malware payload (Mirai)", "value": "ff2b353ce13829b41b78d6334a21173e8c15bad9ce5b967742d6d49d3b938bb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827163, "uuid": "4784209b-2667-4b5f-868a-0e9215c904ae", "comment": "Malware payload (Mirai)", "value": "63074e9d199e1d194476d587cd2e24f90d37f48a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694827163, "uuid": "680b1b88-c4de-4806-94a3-671b5e6a275c", "comment": "Malware payload (Mirai)", "value": "5a044323e5670f97b050b5195eef831a983b4b8cc40faead29d00ae4284c7f4c5cc193b414eeb297a3a607a3c706d383", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827163, "uuid": "8f3d6cf0-eab7-44cf-a1d9-15ae53dd10d4", "value": "T17ED2E1016641FEE1C5700232E9678A9772257DB9D1D131FA8B3C0DF8E6E9A1D47F8A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827163, "uuid": "0461d570-9d8c-4480-bf3d-c5d570513c70", "value": "768:vusHfRavjynNKnjFcZIhQzhKMXgp9q3UEL7c:HRwynNIOQQ1KMwcLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694827163, "uuid": "f41e4b48-1052-456f-9f34-5f4c484b8391", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694827163, "uuid": "54d68a0c-b247-49ba-8974-de734554960b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694827163, "uuid": "efc7f9fb-00b6-4a9c-9981-34bbd702bd2c", "value": "b71a49786207e87c5c56d0a7255a255f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }